{ "analysis_id": "246dbce6-c561-4434-bedb-dd496ba758d2", "session_id": "72835fb7-8eb2-480d-ac51-fb873339ae0c", "status": "completed", "filename": "2020-03-14-traffic-analysis-exercise.pcap", "source_sha256": "8df815a53e873e01803010c33752080414b0975709c1c02327e12661eec883a4", "source_size_bytes": 21809321, "schema_version": "pcap-analysis-v1", "semantic_sha256": "205701a0e6aebd9492fa2877a3bf42135b1ae3bbda7370a93eeabc0345e40639", "analyzer_manifest": { "limits": { "max_flows": 50000, "max_endpoints": 20000, "max_upload_bytes": 536870912, "max_exported_files": 50000, "max_events_per_kind": 50000, "max_exported_objects": 500, "tool_timeout_seconds": 300, "max_object_hash_index": 50000, "max_tool_output_bytes": 268435456, "max_exported_total_bytes": 268435456, "max_exported_object_bytes": 52428800 }, "profile_id": "tshark-evidence-v6", "profile_sha256": "aff64bf3786902d5d7a2c1a9be158a5246cc81aecea6c44eda74701431070465", "schema_version": "pcap-analyzer-manifest-v1", "tshark_version": "TShark (Wireshark) 4.4.18.", "manifest_sha256": "1f3c02483cfea06d85bd326f6e225f3f41a4ab703677d40537577e8bb85c1ce0", "capinfos_version": "Capinfos (Wireshark) 4.4.18.", "rulepack_version": "pcap-rules-v5", "implementation_sha256": "1a7d19199ff58059a12b34656620481b502fadc52d115b5f4b42fc28e5817c3c", "requested_fields_sha256": "e7a6eff11f7ae2101845897ce7e3b0a0e9cea31bdea4a824734869f39f3fb4f3", "supported_profile_fields_sha256": "6d94b9bc3aea93d5f7f4f815bdd025560ceba0d5e27b380ad14da28b44947994" }, "summary": "Decoded 30239 packets across 150 IP endpoints and 1083 transport flows. Observed 748 DNS events, 161 HTTP requests, 349 TLS ClientHello events, and 63 recovered file/message object(s). Deterministic rules produced 30 finding(s): 0 high, 11 medium, and 19 low. Findings are evidence-bound candidates and require analyst review; encrypted payload contents remain unavailable.", "report": "# AdversaryGraph Deterministic PCAP Analysis\n\nSource: 2020-03-14-traffic-analysis-exercise.pcap\nCapture SHA-256: `8df815a53e873e01803010c33752080414b0975709c1c02327e12661eec883a4`\nSemantic result SHA-256: `205701a0e6aebd9492fa2877a3bf42135b1ae3bbda7370a93eeabc0345e40639`\nAnalyzer manifest SHA-256: `1f3c02483cfea06d85bd326f6e225f3f41a4ab703677d40537577e8bb85c1ce0`\n\n## Executive summary\n\nDecoded 30239 packets across 150 IP endpoints and 1083 transport flows. Observed 748 DNS events, 161 HTTP requests, 349 TLS ClientHello events, and 63 recovered file/message object(s). Deterministic rules produced 30 finding(s): 0 high, 11 medium, and 19 low. Findings are evidence-bound candidates and require analyst review; encrypted payload contents remain unavailable.\n\n## Capture facts\n\n- Packets: 30239\n- Duration: 2645.912095 seconds\n- Captured bytes: 21325473\n- Endpoints: 150\n- Flows: 1083\n\n## Deterministic findings\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 4475 / TCP stream 207, frame 4616 / TCP stream 207.\n\nMetrics: `{\"content_type\":\"application/x-javascript\",\"declared_body_bytes\":15038,\"destination\":\"10.3.11.119\",\"response_count\":1,\"source\":\"23.211.18.27\",\"uri\":\"/starfield/duel/v2.5.8/duel.js?appid=O3BkA5J1\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 4559 / TCP stream 216, frame 4568 / TCP stream 216.\n\nMetrics: `{\"content_type\":\"text/html\",\"declared_body_bytes\":171,\"destination\":\"10.3.11.119\",\"response_count\":1,\"source\":\"72.246.84.150\",\"uri\":\"/js/300/addthis_widget.js\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 4638 / TCP stream 207, frame 4679 / TCP stream 207.\n\nMetrics: `{\"content_type\":\"application/x-javascript\",\"declared_body_bytes\":2157,\"destination\":\"10.3.11.119\",\"response_count\":1,\"source\":\"23.211.18.27\",\"uri\":\"/tcc/tcc_l.combined.1.0.5.min.js\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 5551 / TCP stream 231, frame 5791 / TCP stream 231.\n\nMetrics: `{\"content_type\":\"application/x-javascript\",\"declared_body_bytes\":23160,\"destination\":\"10.3.11.119\",\"response_count\":1,\"source\":\"23.211.18.27\",\"uri\":\"/starfield/duel/v2.5.8/sf.core/sf.core.pkg.js\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 6154 / TCP stream 237, frame 6254 / TCP stream 237.\n\nMetrics: `{\"content_type\":\"application/javascript; charset=utf-8\",\"declared_body_bytes\":29100,\"destination\":\"10.3.11.119\",\"response_count\":1,\"source\":\"72.21.91.66\",\"uri\":\"/widgets.js\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 8616 / TCP stream 259, frame 8998 / TCP stream 259.\n\nMetrics: `{\"content_type\":\"application/x-msdownload\",\"declared_body_bytes\":466944,\"destination\":\"10.3.11.194\",\"response_count\":1,\"source\":\"50.87.248.17\",\"uri\":\"/YAS20.exe\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 13377 / TCP stream 351, frame 13389 / TCP stream 351.\n\nMetrics: `{\"content_type\":\"text/javascript\",\"declared_body_bytes\":1292,\"destination\":\"10.3.11.218\",\"response_count\":1,\"source\":\"172.217.6.144\",\"uri\":\"/markerly-cdn.js\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 13453 / TCP stream 344, frame 13559 / TCP stream 344.\n\nMetrics: `{\"content_type\":\"application/x-javascript\",\"declared_body_bytes\":35951,\"destination\":\"10.3.11.218\",\"response_count\":1,\"source\":\"65.254.227.240\",\"uri\":\"/js/bootstrap.min.js\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 13836 / TCP stream 358, frame 13891 / TCP stream 358.\n\nMetrics: `{\"content_type\":\"text/javascript; charset=utf-8\",\"declared_body_bytes\":32222,\"destination\":\"10.3.11.218\",\"response_count\":1,\"source\":\"172.217.12.74\",\"uri\":\"/ajax/libs/jquery/1.6.4/jquery.min.js\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 13902 / TCP stream 351, frame 13981 / TCP stream 351.\n\nMetrics: `{\"content_type\":\"text/javascript\",\"declared_body_bytes\":61214,\"destination\":\"10.3.11.218\",\"response_count\":1,\"source\":\"172.217.6.144\",\"uri\":\"/toolbar.cdn.min.js\"}`\n\n### LOW — Repeated unsuccessful DNS resolution\n\nRepeated NXDOMAIN responses may indicate a dead domain, misconfiguration, retrying software, or malicious fallback. They do not establish a domain-generation algorithm.\n\nRule: `repeated-nxdomain@pcap-rules-v5`; confidence: 0.5; evidence: frame 2500, frame 3764, frame 4316, frame 7699, frame 7704.\n\nMetrics: `{\"domain\":\"wpad.mondogreek.com\",\"response_count\":20,\"source\":\"10.3.11.119\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v5`; confidence: 0.95; evidence: frame 2652 / TCP stream 129, frame 2655 / TCP stream 129, frame 2657 / TCP stream 129, frame 2673 / TCP stream 129, frame 2675 / TCP stream 129.\n\nMetrics: `{\"destination\":\"10.3.11.3\",\"event_count\":32,\"operation_numbers\":[\"0\",\"1\",\"12\",\"30\"],\"protocol\":\"drsuapi\",\"source\":\"10.3.11.119\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v5`; confidence: 0.95; evidence: frame 2493 / TCP stream 119, frame 2565 / TCP stream 122, frame 2627 / TCP stream 122, frame 2643 / TCP stream 119, frame 2646 / TCP stream 122.\n\nMetrics: `{\"destination\":\"10.3.11.3\",\"event_count\":74,\"operation_numbers\":[\"\",\"0\",\"2\",\"3\"],\"protocol\":\"ldap\",\"source\":\"10.3.11.119\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v5`; confidence: 0.95; evidence: frame 3866 / TCP stream 180, frame 3868 / TCP stream 180, frame 3870 / TCP stream 180, frame 3872 / TCP stream 180, frame 3874 / TCP stream 180.\n\nMetrics: `{\"destination\":\"10.3.11.3\",\"event_count\":30,\"operation_numbers\":[\"1\",\"16\",\"17\",\"3\",\"34\",\"36\",\"39\",\"5\",\"6\",\"64\",\"7\"],\"protocol\":\"samr\",\"source\":\"10.3.11.119\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v5`; confidence: 0.95; evidence: frame 1216 / TCP stream 58, frame 1218 / TCP stream 58, frame 1220 / TCP stream 58, frame 1230 / TCP stream 58, frame 1232 / TCP stream 58.\n\nMetrics: `{\"destination\":\"10.3.11.3\",\"event_count\":26,\"operation_numbers\":[\"0\",\"1\",\"12\",\"30\"],\"protocol\":\"drsuapi\",\"source\":\"10.3.11.194\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v5`; confidence: 0.95; evidence: frame 1075 / TCP stream 52, frame 1171 / TCP stream 52, frame 1178 / TCP stream 52, frame 1239 / TCP stream 63, frame 1244 / TCP stream 63.\n\nMetrics: `{\"destination\":\"10.3.11.3\",\"event_count\":154,\"operation_numbers\":[\"\",\"0\",\"2\",\"3\"],\"protocol\":\"ldap\",\"source\":\"10.3.11.194\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v5`; confidence: 0.95; evidence: frame 2167 / TCP stream 104, frame 2169 / TCP stream 104, frame 2171 / TCP stream 104, frame 2173 / TCP stream 104, frame 2175 / TCP stream 104.\n\nMetrics: `{\"destination\":\"10.3.11.3\",\"event_count\":30,\"operation_numbers\":[\"1\",\"16\",\"17\",\"3\",\"34\",\"36\",\"39\",\"5\",\"6\",\"64\",\"7\"],\"protocol\":\"samr\",\"source\":\"10.3.11.194\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v5`; confidence: 0.95; evidence: frame 124 / TCP stream 2, frame 126 / TCP stream 2, frame 128 / TCP stream 2, frame 142 / TCP stream 2, frame 144 / TCP stream 2.\n\nMetrics: `{\"destination\":\"10.3.11.3\",\"event_count\":32,\"operation_numbers\":[\"0\",\"1\",\"12\",\"30\"],\"protocol\":\"drsuapi\",\"source\":\"10.3.11.218\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v5`; confidence: 0.95; evidence: frame 48 / TCP stream 3, frame 89 / TCP stream 3, frame 92 / TCP stream 3, frame 94 / TCP stream 3, frame 160 / TCP stream 3.\n\nMetrics: `{\"destination\":\"10.3.11.3\",\"event_count\":73,\"operation_numbers\":[\"\",\"0\",\"2\",\"3\"],\"protocol\":\"ldap\",\"source\":\"10.3.11.218\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v5`; confidence: 0.95; evidence: frame 1683 / TCP stream 81, frame 1685 / TCP stream 81, frame 1687 / TCP stream 81, frame 1689 / TCP stream 81, frame 1691 / TCP stream 81.\n\nMetrics: `{\"destination\":\"10.3.11.3\",\"event_count\":30,\"operation_numbers\":[\"1\",\"16\",\"17\",\"3\",\"34\",\"36\",\"39\",\"5\",\"6\",\"64\",\"7\"],\"protocol\":\"samr\",\"source\":\"10.3.11.218\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v5`; confidence: 0.95; evidence: frame 2653 / TCP stream 129, frame 2656 / TCP stream 129, frame 2658 / TCP stream 129, frame 2674 / TCP stream 129, frame 2676 / TCP stream 129.\n\nMetrics: `{\"destination\":\"10.3.11.119\",\"event_count\":32,\"operation_numbers\":[\"0\",\"1\",\"12\",\"30\"],\"protocol\":\"drsuapi\",\"source\":\"10.3.11.3\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v5`; confidence: 0.95; evidence: frame 2495 / TCP stream 119, frame 2567 / TCP stream 122, frame 2631 / TCP stream 122, frame 2647 / TCP stream 119, frame 2648 / TCP stream 122.\n\nMetrics: `{\"destination\":\"10.3.11.119\",\"event_count\":59,\"operation_numbers\":[\"\",\"1\",\"4,19,19,19,5\",\"4,5\",\"5\"],\"protocol\":\"ldap\",\"source\":\"10.3.11.3\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v5`; confidence: 0.95; evidence: frame 3867 / TCP stream 180, frame 3869 / TCP stream 180, frame 3871 / TCP stream 180, frame 3873 / TCP stream 180, frame 3875 / TCP stream 180.\n\nMetrics: `{\"destination\":\"10.3.11.119\",\"event_count\":30,\"operation_numbers\":[\"1\",\"16\",\"17\",\"3\",\"34\",\"36\",\"39\",\"5\",\"6\",\"64\",\"7\"],\"protocol\":\"samr\",\"source\":\"10.3.11.3\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v5`; confidence: 0.95; evidence: frame 1217 / TCP stream 58, frame 1219 / TCP stream 58, frame 1221 / TCP stream 58, frame 1231 / TCP stream 58, frame 1233 / TCP stream 58.\n\nMetrics: `{\"destination\":\"10.3.11.194\",\"event_count\":26,\"operation_numbers\":[\"0\",\"1\",\"12\",\"30\"],\"protocol\":\"drsuapi\",\"source\":\"10.3.11.3\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v5`; confidence: 0.95; evidence: frame 1077 / TCP stream 52, frame 1177 / TCP stream 52, frame 1241 / TCP stream 63, frame 1246 / TCP stream 63, frame 1248 / TCP stream 63.\n\nMetrics: `{\"destination\":\"10.3.11.194\",\"event_count\":141,\"operation_numbers\":[\"\",\"1\",\"4,19,19,19,5\",\"4,4,4,4,4,4,4,4,4,4,4,4,4,19,19,19,5\",\"4,4,4,4,5\",\"4,5\",\"5\"],\"protocol\":\"ldap\",\"source\":\"10.3.11.3\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v5`; confidence: 0.95; evidence: frame 2168 / TCP stream 104, frame 2170 / TCP stream 104, frame 2172 / TCP stream 104, frame 2174 / TCP stream 104, frame 2176 / TCP stream 104.\n\nMetrics: `{\"destination\":\"10.3.11.194\",\"event_count\":30,\"operation_numbers\":[\"1\",\"16\",\"17\",\"3\",\"34\",\"36\",\"39\",\"5\",\"6\",\"64\",\"7\"],\"protocol\":\"samr\",\"source\":\"10.3.11.3\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v5`; confidence: 0.95; evidence: frame 125 / TCP stream 2, frame 127 / TCP stream 2, frame 129 / TCP stream 2, frame 143 / TCP stream 2, frame 145 / TCP stream 2.\n\nMetrics: `{\"destination\":\"10.3.11.218\",\"event_count\":32,\"operation_numbers\":[\"0\",\"1\",\"12\",\"30\"],\"protocol\":\"drsuapi\",\"source\":\"10.3.11.3\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v5`; confidence: 0.95; evidence: frame 50 / TCP stream 3, frame 91 / TCP stream 3, frame 93 / TCP stream 3, frame 95 / TCP stream 3, frame 162 / TCP stream 3.\n\nMetrics: `{\"destination\":\"10.3.11.218\",\"event_count\":58,\"operation_numbers\":[\"\",\"1\",\"4,19,19,19,5\",\"4,5\",\"5\"],\"protocol\":\"ldap\",\"source\":\"10.3.11.3\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v5`; confidence: 0.95; evidence: frame 1684 / TCP stream 81, frame 1686 / TCP stream 81, frame 1688 / TCP stream 81, frame 1690 / TCP stream 81, frame 1692 / TCP stream 81.\n\nMetrics: `{\"destination\":\"10.3.11.218\",\"event_count\":30,\"operation_numbers\":[\"1\",\"16\",\"17\",\"3\",\"34\",\"36\",\"39\",\"5\",\"6\",\"64\",\"7\"],\"protocol\":\"samr\",\"source\":\"10.3.11.3\"}`\n\n### MEDIUM — Sustained external TCP conversation outside decoded application coverage\n\nThe flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.\n\nRule: `unclassified-external-tcp@pcap-rules-v5`; confidence: 0.7; evidence: frame 28765 / TCP stream 601.\n\nMetrics: `{\"destination\":\"198.23.252.135\",\"destination_port\":443,\"duration_seconds\":116.666,\"packets\":14,\"source\":\"10.3.11.194\",\"wire_bytes\":1303}`\n\n## ATT&CK candidates\n\n- T1105 Ingress Tool Transfer (command-and-control), confidence=0.8, status=suggested; basis=versioned-deterministic-rule.\n\n## Identities\n\n- account: `dominga.mcdowell`; client IPs: 10.3.11.218; frames: 1586, 1594, 1596, 1608, 1630\n- account: `dorian.neff`; client IPs: 10.3.11.119; frames: 3774, 3782, 3784, 3796, 3810\n- account: `laptop-7xmv2sn$`; client IPs: 10.3.11.194; frames: 1130, 1139, 1141, 1157, 1169\n- account: `laptop-i9zpi04$`; client IPs: 10.3.11.218; frames: 61, 69, 71, 83, 103\n- account: `laptop-sqsa42o$`; client IPs: 10.3.11.119; frames: 2573, 2581, 2589, 2592, 2596\n- account: `otis.witherspoon`; client IPs: 10.3.11.194; frames: 2075, 2083, 2085, 2097, 2111\n- account: `User`; client IPs: unbound subject; frames: 8998\n- domain: `MONDOGREEK`; client IPs: 10.3.11.119, 10.3.11.194, 10.3.11.218; frames: 1668, 2153, 3851\n- full-name: `Dominga McDowell`; client IPs: 10.3.11.218; frames: 1698, 29710\n- full-name: `Dorian Neff`; client IPs: 10.3.11.119; frames: 3881, 29808\n- full-name: `Otis Witherspoon`; client IPs: 10.3.11.194; frames: 2182, 29585\n- hostname: `LAPTOP-7XMV2SN`; client IPs: 10.3.11.194; frames: 1090, 1317, 1380, 1429, 1580\n- hostname: `LAPTOP-I9ZPI04`; client IPs: 10.3.11.218; frames: 1, 220, 277, 322, 364\n- hostname: `LAPTOP-SQSA42O`; client IPs: 10.3.11.119; frames: 2513, 2679, 2780, 2810, 2885\n- netbios-group: `MONDOGREEK`; client IPs: unbound subject; frames: 2, 219, 321, 520, 1091\n\n## Observed network and file inventory — not an IOC verdict\n\n- domain: `112.146.166.173.b.barracudacentral.org`; roles: dns-query\n- domain: `112.146.166.173.cbl.abuseat.org`; roles: dns-query\n- domain: `112.146.166.173.dnsbl-1.uceprotect.net`; roles: dns-query\n- domain: `112.146.166.173.spam.dnsbl.sorbs.net`; roles: dns-query\n- domain: `112.146.166.173.zen.spamhaus.org`; roles: dns-query\n- domain: `1605158521.rsc.cdn77.org`; roles: dns-cname\n- domain: `3750657afd7bdc4d4398b8849268b8a3.nrb.footprintdns.com`; roles: dns-query, tls-sni\n- domain: `3af21bab922f1a3fff13816e3eed341a.clo.footprintdns.com`; roles: dns-query, tls-sni\n- domain: `7754def074cd4b67fe16c8cfdb10e874.clo.footprintdns.com`; roles: dns-query, tls-sni\n- domain: `a-ring.msedge.net`; roles: dns-query, tls-sni\n- domain: `act-us.rd.linksynergy.com`; roles: dns-query, tls-sni\n- domain: `adhcinqls.mondogreek.com`; roles: dns-query\n- domain: `ads-bid.l.doubleclick.net`; roles: dns-cname\n- domain: `adservice.google.com`; roles: dns-query, tls-sni\n- domain: `ajax.googleapis.com`; roles: dns-query, http-host, tls-sni\n- domain: `api.bing.com`; roles: dns-query, tls-sni\n- domain: `apis.google.com`; roles: dns-query, tls-sni\n- domain: `arc.msn.com`; roles: dns-query, tls-sni\n- domain: `arc.msn.com.nsatc.net`; roles: dns-cname\n- domain: `array801.prod.do.dsp.mp.microsoft.com`; roles: dns-query, tls-sni\n- domain: `array802.prod.do.dsp.mp.microsoft.com`; roles: dns-query, tls-sni\n- domain: `array803.prod.do.dsp.mp.microsoft.com`; roles: dns-query, tls-sni\n- domain: `array807.prod.do.dsp.mp.microsoft.com`; roles: dns-query, tls-sni\n- domain: `assets.adobedtm.com`; roles: dns-query, tls-sni\n- domain: `az725175.vo.msecnd.net`; roles: dns-query, tls-sni\n- domain: `b-ring.msedge.net`; roles: dns-query, tls-sni\n- domain: `bid.g.doubleclick.net`; roles: dns-query\n- domain: `bolton-tech.com`; roles: dns-query, http-host\n- domain: `c.storage.googleapis.com`; roles: dns-cname\n- domain: `c1.neweggimages.com`; roles: dns-query, tls-sni\n- domain: `checkip.amazonaws.com`; roles: dns-query, http-host\n- domain: `client.wns.windows.com`; roles: dns-query, tls-sni\n- domain: `cm.everesttech.net`; roles: dns-query, tls-sni\n- domain: `cm.everesttech.net.akadns.net`; roles: dns-cname\n- domain: `cm.g.doubleclick.net`; roles: dns-query, tls-sni\n- domain: `combsscreenprinting.com`; roles: dns-cname\n- domain: `config.edge.skype.com`; roles: dns-query, tls-sni\n- domain: `connect.facebook.net`; roles: dns-query, tls-sni\n- domain: `consent.dc-storm.com`; roles: dns-query, tls-sni\n- domain: `consent.jrs5.com`; roles: dns-query, tls-sni\n- domain: `consent.linksynergy.com`; roles: dns-query, tls-sni\n- domain: `consent.mediaforge.com`; roles: dns-query, tls-sni\n- domain: `consent.nxtck.com`; roles: dns-query, tls-sni\n- domain: `cookie-sync-service-prod.steelhousemedia.com`; roles: dns-query, tls-sni\n- domain: `cookie.coreprod.west2.steelhouse.com`; roles: dns-cname\n- domain: `cp801.prod.do.dsp.mp.microsoft.com`; roles: dns-query, tls-sni\n- domain: `crl.securetrust.com`; roles: dns-query, http-host\n- domain: `cs2005.wpc.alphacdn.net`; roles: dns-cname\n- domain: `cs22.wpc.v0cdn.net`; roles: dns-cname\n- domain: `cs9.wac.phicdn.net`; roles: dns-cname\n- domain: `ctldl.windowsupdate.com`; roles: dns-query, http-host\n- domain: `disc801.prod.do.dsp.mp.microsoft.com`; roles: dns-query, tls-sni\n- domain: `dns.msftncsi.com`; roles: dns-query\n- domain: `dp58aslhmbcib.cloudfront.net`; roles: dns-query, tls-sni\n- domain: `dpm.demdex.net`; roles: dns-query, tls-sni\n- domain: `dsum-sec.casalemedia.com`; roles: dns-query, tls-sni\n- domain: `dualstack.com.imgix.map.fastly.net`; roles: dns-cname\n- domain: `dx.steelhousemedia.com`; roles: dns-query, tls-sni\n- domain: `ec-apis.newegg.com`; roles: dns-query, tls-sni\n- domain: `edge.microsoft.com`; roles: dns-query, tls-sni\n- domain: `eu-u.openx.net`; roles: dns-query, tls-sni\n- domain: `f.monetate.net`; roles: dns-query, tls-sni\n- domain: `fareharbor.com`; roles: dns-query, tls-sni\n- domain: `fe2cr.update.microsoft.com`; roles: dns-query, tls-sni\n- domain: `fe2cr.update.microsoft.com.akadns.net`; roles: dns-cname\n- domain: `fe3cr.delivery.mp.microsoft.com`; roles: dns-query, tls-sni\n- domain: `fh-kit.com`; roles: dns-query, tls-sni\n- domain: `fh-sites.imgix.net`; roles: dns-query, tls-sni\n- domain: `files.markerly.com`; roles: dns-query, http-host\n- domain: `fonts.googleapis.com`; roles: dns-query, http-host, tls-sni\n- domain: `fonts.gstatic.com`; roles: dns-query, http-host, tls-sni\n- domain: `fp-afd.azureedge.net`; roles: dns-query, tls-sni\n- domain: `fp-as.azureedge.net`; roles: dns-query, tls-sni\n- domain: `fp-vp.azureedge.net`; roles: dns-query, tls-sni\n- domain: `fp.msedge.net`; roles: dns-query, tls-sni\n- domain: `geo.prod.do.dsp.mp.microsoft.com`; roles: dns-query, tls-sni\n- domain: `go.microsoft.com`; roles: dns-query, tls-sni\n- domain: `googleads.g.doubleclick.net`; roles: dns-query\n- domain: `gstaticadssl.l.google.com`; roles: dns-cname\n- domain: `hakunamatatata.com`; roles: dns-query, tls-sni\n- domain: `help.newegg.com`; roles: dns-query, tls-sni\n- domain: `helpforyourservice.com`; roles: dns-query, tls-sni\n- domain: `idsync.rlcdn.com`; roles: dns-query, tls-sni\n- domain: `ie11welcome.microsoft.com`; roles: dns-query, tls-sni\n- domain: `image2.pubmatic.com`; roles: dns-query, tls-sni\n- domain: `images10.newegg.com`; roles: dns-query, tls-sni\n- domain: `img.secureserver.net`; roles: dns-query, http-host, tls-sni\n- domain: `img1.wsimg.com`; roles: dns-query, http-host, tls-sni\n- domain: `img2.wsimg.com`; roles: dns-query, http-host, tls-sni\n- domain: `img4.wsimg.com`; roles: dns-query, http-host, tls-sni\n- domain: `imk.neweggimages.com`; roles: dns-query\n- domain: `insight-760077375.us-east-1.elb.amazonaws.com`; roles: dns-cname\n- domain: `insight.adsrvr.org`; roles: dns-query, tls-sni\n- domain: `itm-efz.office.com`; roles: dns-cname\n- domain: `k-ring.msedge.net`; roles: dns-query, tls-sni\n- domain: `kcvsmarszhnhqdd.mondogreek.com`; roles: dns-query\n- domain: `kv801.prod.do.dsp.mp.microsoft.com`; roles: dns-query, tls-sni\n- domain: `l-0005.dc-msedge.net`; roles: dns-cname\n- domain: `l-ring.msedge.net`; roles: dns-query, tls-sni\n- domain: `laptop-7xmv2sn.mondogreek.com`; roles: dns-query\n- domain: `laptop-i9zpi04.mondogreek.com`; roles: dns-query\n- domain: `laptop-sqsa42o.mondogreek.com`; roles: dns-query\n- domain: `licensing.mp.microsoft.com`; roles: dns-query, tls-sni\n- domain: `load77.exelator.com`; roles: dns-query, tls-sni\n- domain: `loadus.exelator.com`; roles: dns-query, tls-sni\n- domain: `login.live.com`; roles: dns-query, tls-sni\n- domain: `login.microsoftonline.com`; roles: dns-query, tls-sni\n- domain: `m.addthis.com`; roles: dns-query, tls-sni\n- domain: `mapping.nxtck.com`; roles: dns-query, tls-sni\n- domain: `match-975362022.us-east-1.elb.amazonaws.com`; roles: dns-cname\n- domain: `match.360yield.com`; roles: dns-query, tls-sni\n- domain: `match.adsrvr.org`; roles: dns-query, tls-sni\n- domain: `match.prod.bidr.io`; roles: dns-query, tls-sni\n- domain: `mondogreek-dc.mondogreek.com`; roles: dns-query\n- domain: `mondogreek.com`; roles: dns-query\n- domain: `mrodevicemgr.officeapps.live.com`; roles: dns-query, tls-sni\n- domain: `msftspeechmodelsprod.azureedge.net`; roles: dns-query\n- domain: `muewhinerfhe.mondogreek.com`; roles: dns-query\n- domain: `nebula.wsimg.com`; roles: dns-query, http-host\n- domain: `newegg.com`; roles: dns-query, http-host\n- domain: `newegg.com.ssl.sc.omtrdc.net`; roles: dns-cname\n- domain: `newegginc.demdex.net`; roles: dns-query, tls-sni\n- domain: `nexusrules.officeapps.live.com`; roles: dns-query, tls-sni\n- domain: `nhfbugwsjf.mondogreek.com`; roles: dns-query\n- domain: `notable-quotes.com`; roles: dns-query, http-host\n- domain: `nvzkinvuuinkgs.mondogreek.com`; roles: dns-query\n- domain: `nypi.dc-storm.com`; roles: dns-query\n- domain: `ocsp.digicert.com`; roles: dns-query, http-host\n- domain: `pagead.l.doubleclick.net`; roles: dns-cname\n- domain: `pagead46.l.doubleclick.net`; roles: dns-cname\n- domain: `partnerad.l.doubleclick.net`; roles: dns-cname\n- domain: `pf.newegg.com`; roles: dns-query, tls-sni\n- domain: `pixel.advertising.com`; roles: dns-query, tls-sni\n- domain: `pixel.rubiconproject.com`; roles: dns-query, tls-sni\n- domain: `pixel.rubiconproject.net.akadns.net`; roles: dns-cname\n- domain: `platform.twitter.com`; roles: dns-query, http-host, tls-sni\n- domain: `play.google.com`; roles: dns-query, tls-sni\n- domain: `plus.l.google.com`; roles: dns-cname\n- domain: `prod.mrodevicemgr.live.com.akadns.net`; roles: dns-cname\n- domain: `prod.nexusrules.live.com.akadns.net`; roles: dns-cname\n- domain: `promotions.newegg.com`; roles: dns-query, tls-sni\n- domain: `pti.store.microsoft.com`; roles: dns-query, tls-sni\n- domain: `px.steelhousemedia.com`; roles: dns-query, tls-sni\n- domain: `pxtm.steelhousemedia.com`; roles: dns-cname\n- domain: `roijvdflsx.mondogreek.com`; roles: dns-query\n- domain: `rtb-csync.smartadserver.com`; roles: dns-query, tls-sni\n- domain: `rum18.perf.linkedin.com`; roles: dns-query, tls-sni\n- domain: `s-0001.s-msedge.net`; roles: dns-cname\n- domain: `s-ring.msedge.net`; roles: dns-query, tls-sni\n- domain: `s7.addthis.com`; roles: dns-query, http-host, tls-sni\n- domain: `sb.monetate.net`; roles: dns-query\n- domain: `scontent.xx.fbcdn.net`; roles: dns-cname\n- domain: `se.monetate.net`; roles: dns-query, tls-sni\n- domain: `sealserver.trustwave.com`; roles: dns-query, tls-sni\n- domain: `secure.adnxs.com`; roles: dns-query, tls-sni\n- domain: `secure.newegg.com`; roles: dns-query, tls-sni\n- domain: `securepubads.g.doubleclick.net`; roles: dns-query, tls-sni\n- domain: `self.events.data.microsoft.com`; roles: dns-query, tls-sni\n- domain: `settings-win.data.microsoft.com`; roles: dns-query, tls-sni\n- domain: `settingsfd-geo.trafficmanager.net`; roles: dns-cname\n- domain: `slscr.update.microsoft.com`; roles: dns-query, tls-sni\n- domain: `spo-ring.msedge.net`; roles: dns-query, tls-sni\n- domain: `star-mini.c10r.facebook.com`; roles: dns-cname\n- domain: `states.newegg.com`; roles: dns-query, tls-sni\n- domain: `stats.g.doubleclick.net`; roles: dns-query, tls-sni\n- domain: `stats.l.doubleclick.net`; roles: dns-cname\n- domain: `storage.googleapis.com`; roles: dns-query, tls-sni\n- domain: `storecatalogrevocation.storequality.microsoft.com`; roles: dns-query, tls-sni\n- domain: `sts.eccmp.com`; roles: dns-query, tls-sni\n- domain: `syndication.twitter.com`; roles: dns-query, tls-sni\n- domain: `t-ring.msedge.net`; roles: dns-query, tls-sni\n- domain: `tag.rmp.rakuten.com`; roles: dns-query, tls-sni\n- domain: `tags-cluster.rd.linksynergy.com`; roles: dns-cname\n- domain: `tags.rd.linksynergy.com`; roles: dns-query, tls-sni\n- domain: `tags.tiqcdn.com`; roles: dns-query, tls-sni\n- domain: `tpc.googlesyndication.com`; roles: dns-query, tls-sni\n- domain: `triggeredmail.appspot.com`; roles: dns-query, tls-sni\n- domain: `tring.clo.footprintdns.com`; roles: dns-query, tls-sni\n- domain: `tuscaloosabarnyard.com`; roles: dns-cname\n- domain: `twitter.com`; roles: dns-query\n- domain: `ukrtzhmkwhgj.mondogreek.com`; roles: dns-query\n- domain: `umwatson.trafficmanager.net`; roles: dns-cname\n- domain: `ups.analytics.yahoo.com`; roles: dns-query, tls-sni\n- domain: `ut.ra.linksynergy.com`; roles: dns-query, tls-sni\n- domain: `v1.addthisedge.com`; roles: dns-query\n- domain: `vbwxoaflt.mondogreek.com`; roles: dns-query\n- domain: `vzxmvhjnnsazsyw.mondogreek.com`; roles: dns-query\n- domain: `watson.telemetry.microsoft.com`; roles: dns-query, tls-sni\n- domain: `web.vortex.data.microsoft.com`; roles: dns-query, tls-sni\n- domain: `wpad.mondogreek.com`; roles: dns-query\n- domain: `ww.steelhousemedia.com`; roles: dns-query, tls-sni\n- domain: `www-google-analytics.l.google.com`; roles: dns-cname\n- domain: `www-googletagmanager.l.google.com`; roles: dns-cname\n- domain: `www.addthis.com`; roles: dns-query\n- domain: `www.bing.com`; roles: dns-query, tls-sni\n- domain: `www.combsscreenprinting.com`; roles: dns-query\n- domain: `www.facebook.com`; roles: dns-query, tls-sni\n- domain: `www.godaddy.com`; roles: dns-query\n- domain: `www.google-analytics.com`; roles: dns-query, tls-sni\n- domain: `www.google.com`; roles: dns-query, tls-sni\n- domain: `www.googleadservices.com`; roles: dns-query, tls-sni\n- domain: `www.googlecommerce.com`; roles: dns-query, tls-sni\n- domain: `www.googletagmanager.com`; roles: dns-query, tls-sni\n- domain: `www.googletagservices.com`; roles: dns-query, tls-sni\n- domain: `www.newegg.com`; roles: dns-query, http-host, tls-sni\n- domain: `www.notable-quotes.com`; roles: dns-query, http-host\n- domain: `www.tuscaloosabarnyard.com`; roles: dns-query, http-host\n- domain: `www2.newegg.com`; roles: dns-query, tls-sni\n- domain: `www3.l.google.com`; roles: dns-cname\n- domain: `z.moatads.com`; roles: dns-query, tls-sni\n- ipv4: `10.3.11.1`; roles: network-endpoint\n- ipv4: `10.3.11.119`; roles: dns-answer, network-endpoint\n- ipv4: `10.3.11.131`; roles: network-endpoint\n- ipv4: `10.3.11.194`; roles: dns-answer, network-endpoint\n- ipv4: `10.3.11.218`; roles: dns-answer, network-endpoint\n- ipv4: `10.3.11.254`; roles: network-endpoint\n- ipv4: `10.3.11.255`; roles: network-endpoint\n- ipv4: `10.3.11.3`; roles: dns-answer, network-endpoint\n- ipv4: `104.105.248.178`; roles: dns-answer\n- ipv4: `104.117.242.71`; roles: dns-answer, network-endpoint\n- ipv4: `104.244.42.1`; roles: dns-answer\n- ipv4: `104.244.42.129`; roles: dns-answer\n- ipv4: `104.244.42.136`; roles: dns-answer\n- ipv4: `104.244.42.200`; roles: dns-answer\n- ipv4: `104.244.42.72`; roles: dns-answer\n- ipv4: `104.244.42.8`; roles: dns-answer, network-endpoint\n- ipv4: `104.254.148.133`; roles: dns-answer\n- ipv4: `104.254.148.165`; roles: dns-answer\n- ipv4: `104.254.148.166`; roles: dns-answer, network-endpoint\n- ipv4: `104.254.148.196`; roles: dns-answer\n- ipv4: `104.254.149.100`; roles: dns-answer\n- ipv4: `104.254.149.101`; roles: dns-answer\n- ipv4: `104.254.149.68`; roles: dns-answer\n- ipv4: `104.254.149.69`; roles: dns-answer\n- ipv4: `104.26.8.32`; roles: dns-answer\n- ipv4: `104.26.9.32`; roles: dns-answer, network-endpoint\n- ipv4: `104.36.113.17`; roles: dns-answer, network-endpoint\n- ipv4: `111.221.29.40`; roles: dns-answer, network-endpoint\n- ipv4: `13.107.136.254`; roles: dns-answer, network-endpoint\n- ipv4: `13.107.18.254`; roles: dns-answer, network-endpoint\n- ipv4: `13.107.21.200`; roles: dns-answer, network-endpoint\n- ipv4: `13.107.246.10`; roles: dns-answer, network-endpoint\n- ipv4: `13.107.246.254`; roles: dns-answer, network-endpoint\n- ipv4: `13.107.3.128`; roles: dns-answer, network-endpoint\n- ipv4: `13.107.3.254`; roles: dns-answer, network-endpoint\n- ipv4: `13.107.42.254`; roles: dns-answer, network-endpoint\n- ipv4: `13.107.43.14`; roles: dns-answer, network-endpoint\n- ipv4: `13.107.5.80`; roles: dns-answer, network-endpoint\n- ipv4: `13.107.6.158`; roles: dns-answer, network-endpoint\n- ipv4: `13.107.6.254`; roles: dns-answer, network-endpoint\n- ipv4: `13.249.26.114`; roles: dns-answer\n- ipv4: `13.249.26.125`; roles: dns-answer\n- ipv4: `13.249.26.87`; roles: dns-answer\n- ipv4: `13.249.26.99`; roles: dns-answer, network-endpoint\n- ipv4: `13.68.93.109`; roles: dns-answer, network-endpoint\n- ipv4: `13.78.168.230`; roles: dns-answer, network-endpoint\n- ipv4: `13.78.177.144`; roles: dns-answer, network-endpoint\n- ipv4: `13.78.186.254`; roles: dns-answer, network-endpoint\n- ipv4: `13.78.187.58`; roles: dns-answer, network-endpoint\n- ipv4: `130.211.21.54`; roles: dns-answer, network-endpoint\n- ipv4: `130.211.28.134`; roles: dns-answer, network-endpoint\n- ipv4: `131.107.255.255`; roles: dns-answer\n- ipv4: `139.178.81.9`; roles: dns-answer, network-endpoint\n- ipv4: `151.101.50.208`; roles: dns-answer, network-endpoint\n- ipv4: `152.199.4.210`; roles: dns-answer, network-endpoint\n- ipv4: `152.199.4.33`; roles: dns-answer, network-endpoint\n- ipv4: `169.46.74.216`; roles: dns-answer, network-endpoint\n- ipv4: `169.60.140.161`; roles: dns-answer, network-endpoint\n- ipv4: `169.60.153.61`; roles: dns-answer, network-endpoint\n- ipv4: `172.217.1.142`; roles: dns-answer, network-endpoint\n- ipv4: `172.217.12.74`; roles: dns-answer, network-endpoint\n- ipv4: `172.217.12.84`; roles: dns-answer, network-endpoint\n- ipv4: `172.217.14.161`; roles: dns-answer, network-endpoint\n- ipv4: `172.217.14.162`; roles: dns-answer, network-endpoint\n- ipv4: `172.217.2.226`; roles: dns-answer, network-endpoint\n- ipv4: `172.217.6.142`; roles: dns-answer, network-endpoint\n- ipv4: `172.217.6.144`; roles: dns-answer, network-endpoint\n- ipv4: `172.217.6.174`; roles: dns-answer, network-endpoint\n- ipv4: `172.217.9.4`; roles: dns-answer, network-endpoint\n- ipv4: `172.245.249.117`; roles: network-endpoint\n- ipv4: `173.194.223.154`; roles: dns-answer, network-endpoint\n- ipv4: `173.194.223.155`; roles: dns-answer\n- ipv4: `173.194.223.156`; roles: dns-answer\n- ipv4: `173.194.223.157`; roles: dns-answer\n- ipv4: `18.204.46.201`; roles: dns-answer\n- ipv4: `18.208.78.141`; roles: dns-answer\n- ipv4: `18.211.91.10`; roles: dns-answer\n- ipv4: `18.213.117.209`; roles: dns-answer, network-endpoint\n- ipv4: `18.214.132.216`; roles: dns-answer\n- ipv4: `18.232.32.205`; roles: dns-answer\n- ipv4: `18.233.90.151`; roles: dns-answer\n- ipv4: `18.235.112.207`; roles: dns-answer, network-endpoint\n- ipv4: `185.14.31.98`; roles: network-endpoint\n- ipv4: `185.141.27.238`; roles: network-endpoint\n- ipv4: `185.180.198.50`; roles: network-endpoint\n- ipv4: `190.214.13.2`; roles: network-endpoint\n- ipv4: `192.243.232.58`; roles: dns-answer, network-endpoint\n- ipv4: `195.123.242.48`; roles: network-endpoint\n- ipv4: `198.23.252.130`; roles: network-endpoint\n- ipv4: `198.23.252.135`; roles: network-endpoint\n- ipv4: `199.187.193.166`; roles: dns-answer, network-endpoint\n- ipv4: `199.247.13.144`; roles: dns-answer, network-endpoint\n- ipv4: `20.44.86.43`; roles: dns-answer, network-endpoint\n- ipv4: `203.176.135.102`; roles: http-host, network-endpoint\n- ipv4: `204.79.197.200`; roles: dns-answer, network-endpoint\n- ipv4: `204.79.197.222`; roles: dns-answer, network-endpoint\n- ipv4: `204.79.197.254`; roles: dns-answer, network-endpoint\n- ipv4: `205.185.216.10`; roles: dns-answer\n- ipv4: `205.185.216.42`; roles: dns-answer, network-endpoint\n- ipv4: `209.97.130.197`; roles: dns-answer, network-endpoint\n- ipv4: `216.58.193.142`; roles: dns-answer, network-endpoint\n- ipv4: `216.58.194.104`; roles: dns-answer, network-endpoint\n- ipv4: `216.58.194.112`; roles: dns-answer, network-endpoint\n- ipv4: `216.58.194.131`; roles: dns-answer, network-endpoint\n- ipv4: `216.58.194.42`; roles: dns-answer, network-endpoint\n- ipv4: `216.58.194.98`; roles: dns-answer, network-endpoint\n- ipv4: `224.0.0.22`; roles: network-endpoint\n- ipv4: `224.0.0.251`; roles: network-endpoint\n- ipv4: `224.0.0.252`; roles: network-endpoint\n- ipv4: `23.199.252.214`; roles: dns-answer, network-endpoint\n- ipv4: `23.199.253.242`; roles: dns-answer\n- ipv4: `23.199.253.39`; roles: dns-answer, network-endpoint\n- ipv4: `23.199.253.53`; roles: dns-answer, network-endpoint\n- ipv4: `23.204.16.227`; roles: dns-answer, network-endpoint\n- ipv4: `23.204.68.230`; roles: dns-answer\n- ipv4: `23.206.208.173`; roles: dns-answer, network-endpoint\n- ipv4: `23.206.213.111`; roles: dns-answer, network-endpoint\n- ipv4: `23.209.74.120`; roles: dns-answer, network-endpoint\n- ipv4: `23.211.18.27`; roles: dns-answer, network-endpoint\n- ipv4: `23.211.36.128`; roles: dns-answer, network-endpoint\n- ipv4: `23.4.97.247`; roles: dns-answer, network-endpoint\n- ipv4: `23.44.170.27`; roles: dns-answer, network-endpoint\n- ipv4: `23.46.28.16`; roles: dns-answer, network-endpoint\n- ipv4: `23.46.28.24`; roles: dns-answer\n- ipv4: `23.63.253.147`; roles: dns-answer\n- ipv4: `23.63.253.208`; roles: dns-answer, network-endpoint\n- ipv4: `239.255.255.250`; roles: http-host, network-endpoint\n- ipv4: `3.208.14.195`; roles: dns-answer\n- ipv4: `3.211.188.196`; roles: dns-answer\n- ipv4: `3.212.136.177`; roles: dns-answer\n- ipv4: `3.213.24.71`; roles: dns-answer\n- ipv4: `3.215.9.190`; roles: dns-answer, network-endpoint\n- ipv4: `3.217.52.69`; roles: dns-answer\n- ipv4: `3.218.90.66`; roles: dns-answer\n- ipv4: `3.219.244.74`; roles: dns-answer, network-endpoint\n- ipv4: `3.224.145.145`; roles: dns-answer\n- ipv4: `3.225.102.19`; roles: dns-answer, network-endpoint\n- ipv4: `3.92.109.57`; roles: dns-answer\n- ipv4: `31.13.65.36`; roles: dns-answer, network-endpoint\n- ipv4: `31.13.65.7`; roles: dns-answer, network-endpoint\n- ipv4: `31.13.93.35`; roles: dns-answer, network-endpoint\n- ipv4: `34.102.147.248`; roles: dns-answer, network-endpoint\n- ipv4: `34.192.244.88`; roles: dns-answer\n- ipv4: `34.192.250.175`; roles: dns-answer\n- ipv4: `34.193.215.190`; roles: dns-answer\n- ipv4: `34.194.253.146`; roles: dns-answer\n- ipv4: `34.196.181.158`; roles: dns-answer\n- ipv4: `34.197.12.81`; roles: dns-answer\n- ipv4: `34.206.247.240`; roles: dns-answer\n- ipv4: `34.208.124.133`; roles: dns-answer\n- ipv4: `34.208.131.21`; roles: dns-answer, network-endpoint\n- ipv4: `34.208.36.157`; roles: dns-answer\n- ipv4: `34.209.127.1`; roles: dns-answer, network-endpoint\n- ipv4: `34.211.22.199`; roles: dns-answer, network-endpoint\n- ipv4: `34.212.232.109`; roles: dns-answer\n- ipv4: `34.213.227.128`; roles: dns-answer\n- ipv4: `34.224.92.105`; roles: dns-answer\n- ipv4: `34.225.211.231`; roles: dns-answer\n- ipv4: `34.231.157.146`; roles: dns-answer, network-endpoint\n- ipv4: `34.231.65.133`; roles: dns-answer\n- ipv4: `34.232.94.82`; roles: dns-answer\n- ipv4: `34.234.197.182`; roles: dns-answer, network-endpoint\n- ipv4: `34.234.23.242`; roles: dns-answer\n- ipv4: `34.236.165.152`; roles: dns-answer\n- ipv4: `34.98.67.3`; roles: dns-answer, network-endpoint\n- ipv4: `35.161.118.223`; roles: dns-answer\n- ipv4: `35.161.52.15`; roles: dns-answer\n- ipv4: `35.163.173.161`; roles: dns-answer\n- ipv4: `35.167.5.179`; roles: dns-answer\n- ipv4: `35.169.43.149`; roles: dns-answer\n- ipv4: `35.190.72.21`; roles: dns-answer, network-endpoint\n- ipv4: `35.241.23.116`; roles: dns-answer, network-endpoint\n- ipv4: `35.244.140.139`; roles: dns-answer, network-endpoint\n- ipv4: `40.100.155.18`; roles: dns-answer\n- ipv4: `40.100.155.2`; roles: dns-answer\n- ipv4: `40.119.2.214`; roles: dns-answer, network-endpoint\n- ipv4: `40.126.0.65`; roles: dns-answer\n- ipv4: `40.126.0.66`; roles: dns-answer\n- ipv4: `40.126.0.67`; roles: dns-answer, network-endpoint\n- ipv4: `40.126.0.68`; roles: dns-answer\n- ipv4: `40.126.0.69`; roles: dns-answer\n- ipv4: `40.126.0.71`; roles: dns-answer\n- ipv4: `40.126.0.72`; roles: dns-answer\n- ipv4: `40.126.0.73`; roles: dns-answer\n- ipv4: `40.69.218.62`; roles: dns-answer, network-endpoint\n- ipv4: `40.90.22.183`; roles: dns-answer\n- ipv4: `40.90.22.185`; roles: dns-answer, network-endpoint\n- ipv4: `40.90.22.187`; roles: dns-answer, network-endpoint\n- ipv4: `40.90.22.188`; roles: dns-answer\n- ipv4: `40.90.22.189`; roles: dns-answer\n- ipv4: `40.90.22.190`; roles: dns-answer\n- ipv4: `40.90.22.191`; roles: dns-answer, network-endpoint\n- ipv4: `40.91.76.238`; roles: dns-answer, network-endpoint\n- ipv4: `45.148.120.153`; roles: network-endpoint\n- ipv4: `50.87.248.17`; roles: dns-answer, network-endpoint\n- ipv4: `51.254.164.244`; roles: network-endpoint\n- ipv4: `52.0.81.73`; roles: dns-answer\n- ipv4: `52.109.12.19`; roles: dns-answer, network-endpoint\n- ipv4: `52.109.8.30`; roles: dns-answer, network-endpoint\n- ipv4: `52.109.88.36`; roles: dns-answer, network-endpoint\n- ipv4: `52.114.132.73`; roles: dns-answer, network-endpoint\n- ipv4: `52.114.77.34`; roles: dns-answer, network-endpoint\n- ipv4: `52.161.15.246`; roles: dns-answer, network-endpoint\n- ipv4: `52.173.134.115`; roles: dns-answer, network-endpoint\n- ipv4: `52.179.129.229`; roles: dns-answer, network-endpoint\n- ipv4: `52.2.35.4`; roles: dns-answer\n- ipv4: `52.201.53.231`; roles: dns-answer\n- ipv4: `52.202.136.43`; roles: dns-answer\n- ipv4: `52.202.7.233`; roles: dns-answer\n- ipv4: `52.204.219.227`; roles: dns-answer\n- ipv4: `52.204.222.100`; roles: dns-answer\n- ipv4: `52.206.178.1`; roles: dns-answer\n- ipv4: `52.23.116.187`; roles: dns-answer\n- ipv4: `52.230.220.159`; roles: dns-answer, network-endpoint\n- ipv4: `52.230.222.68`; roles: dns-answer, network-endpoint\n- ipv4: `52.242.211.89`; roles: dns-answer, network-endpoint\n- ipv4: `52.3.121.18`; roles: dns-answer\n- ipv4: `52.45.33.138`; roles: dns-answer, network-endpoint\n- ipv4: `52.70.73.113`; roles: dns-answer\n- ipv4: `52.73.178.122`; roles: dns-answer\n- ipv4: `52.9.108.55`; roles: dns-answer, network-endpoint\n- ipv4: `52.98.73.210`; roles: dns-answer\n- ipv4: `52.98.73.226`; roles: dns-answer, network-endpoint\n- ipv4: `52.98.73.242`; roles: dns-answer\n- ipv4: `52.98.77.66`; roles: dns-answer\n- ipv4: `52.98.77.82`; roles: dns-answer\n- ipv4: `52.98.80.210`; roles: dns-answer\n- ipv4: `52.98.81.178`; roles: dns-answer\n- ipv4: `52.98.81.2`; roles: dns-answer\n- ipv4: `52.98.93.2`; roles: dns-answer\n- ipv4: `54.153.98.238`; roles: dns-answer, network-endpoint\n- ipv4: `54.173.98.209`; roles: dns-answer\n- ipv4: `54.175.87.114`; roles: dns-answer\n- ipv4: `54.197.51.7`; roles: dns-answer\n- ipv4: `54.213.212.101`; roles: dns-answer\n- ipv4: `54.244.36.123`; roles: dns-answer, network-endpoint\n- ipv4: `54.68.183.142`; roles: dns-answer\n- ipv4: `54.83.179.223`; roles: dns-answer\n- ipv4: `54.83.97.43`; roles: dns-answer\n- ipv4: `54.86.220.14`; roles: dns-answer\n- ipv4: `63.148.46.76`; roles: dns-answer, network-endpoint\n- ipv4: `64.4.54.254`; roles: dns-answer, network-endpoint\n- ipv4: `64.44.133.131`; roles: http-host, network-endpoint\n- ipv4: `65.254.227.240`; roles: dns-answer, network-endpoint\n- ipv4: `67.27.98.254`; roles: dns-answer\n- ipv4: `67.27.99.254`; roles: dns-answer\n- ipv4: `72.167.191.69`; roles: dns-answer, network-endpoint\n- ipv4: `72.21.81.200`; roles: dns-answer, network-endpoint\n- ipv4: `72.21.91.29`; roles: dns-answer, network-endpoint\n- ipv4: `72.21.91.66`; roles: dns-answer, network-endpoint\n- ipv4: `72.246.84.150`; roles: dns-answer, network-endpoint\n- ipv4: `72.246.84.229`; roles: dns-answer, network-endpoint\n- ipv4: `8.253.112.120`; roles: dns-answer\n- ipv4: `8.253.164.240`; roles: dns-answer\n- ipv4: `8.253.164.248`; roles: dns-answer, network-endpoint\n- ipv4: `8.43.72.97`; roles: dns-answer, network-endpoint\n- ipv4: `8.43.72.98`; roles: dns-answer\n- ipv4: `89.187.164.37`; roles: dns-answer, network-endpoint\n- ja3: `0ae18052c288c1bd39910255598ed827`; roles: tls-client-fingerprint\n- ja3: `10ee8d30a5d01c042afd7b2b205facc4`; roles: tls-client-fingerprint\n- ja3: `28a2c9bd18a11de089ef85a160da29e4`; roles: tls-client-fingerprint\n- ja3: `37f463bf4616ecd445d4a1937da06e19`; roles: tls-client-fingerprint\n- ja3: `3b5074b1b5d032e5620f69f9f700ff0e`; roles: tls-client-fingerprint\n- ja3: `554719594ba90b02ae410c297c6e50ad`; roles: tls-client-fingerprint\n- ja3: `66918128f1b9b03303d77c6f2eefd128`; roles: tls-client-fingerprint\n- ja3: `72a589da586844d7f0818ce684948eea`; roles: tls-client-fingerprint\n- ja3: `9e10692f1b7f78228b2d4e424db3a98c`; roles: tls-client-fingerprint\n- ja3: `a0e9f5d64349fb13191bc781f81f42e1`; roles: tls-client-fingerprint\n- sha256: `00b3e28e084717e5fb9ba1f8a9cf7e9a854ded1b7b4721ed31110513013461dc`; roles: exported-object\n- sha256: `01428897745e7b37849d922e35e28ad8585aca2a254d55f3b5adaecb0b3cb526`; roles: exported-object\n- sha256: `02db3c6b9aff73bf8a11c41107c836b6c800c919c5d3d1304f336aee03f79f4c`; roles: exported-object\n- sha256: `06cb95758d706e8359a137118c05fb38af14616f870a0448d327c3203ee69973`; roles: exported-object\n- sha256: `088111ecdfb3a045b7d594f7c4632561d30b72e15bc771d79812c172ea77e0de`; roles: exported-object\n- sha256: `0e687e2d9d394d7247d63b61aa33895b436f347eb73d8d1d1f99c199d2a0486e`; roles: exported-object\n- sha256: `0e7a2be431ec48b8483bf126741dba1fc74260a35d944a1b8f0f6c2e0adfc9dd`; roles: exported-object\n- sha256: `1ca2faaa4a7ba86c934c337dcb47ebd521dd5721a9f62302ef36f074c1a4c8d8`; roles: exported-object\n- sha256: `1e7a8021a029a0b1b97d9df2c059ad4fe80ff8d9db9564c593bdde97df48f5ff`; roles: exported-object\n- sha256: `21bd143d38dbbae427615a7266a86a18dc95c417f3e510632d7a9180d98d3571`; roles: exported-object\n- sha256: `232066e3f6f1351afdaee1acb70c409766641fd5669e0b55ce7c77fac0a857ef`; roles: exported-object\n- sha256: `2458ec1dbcd980f7d484f0140f1d88e2088249eacf3411b2b2359afdf7774318`; roles: exported-object\n- sha256: `2aa0809ab9f586e743514b0ef60ece6f30dc7d5583d64c1d90cfb87c7019a2bf`; roles: exported-object\n- sha256: `2ac97370caeb512780c9e407128aaa48e9ea92e34acfb427888e1a8027aa7723`; roles: exported-object\n- sha256: `2e8b2448de2607edfbeba46bc40bdf5ff8a97afc21e36e0f2a8faaeb7802651d`; roles: exported-object\n- sha256: `3291b96690178e55e4114c78a6241d3a6bd18aa7361626ff803b54064d178122`; roles: exported-object\n- sha256: `34efd2a999616fb13ef5fadece4481e978c68f2f3416713a4364a21fe81d3243`; roles: exported-object\n- sha256: `34fc3b82e17c69e3cefd908d8e85848f2cdfcb180ba5c05a84ccd2c65e943e09`; roles: exported-object\n- sha256: `361c9f80feaefdda9eb1bb7ee61de56d922188898f69af4cf8a76c64fb0183ad`; roles: exported-object\n- sha256: `3ddb722a10d4664abeb93659beefa009255d6cda0975a47944665976ad9e64cd`; roles: exported-object\n- sha256: `3fd2858003c32f1542e7f330cfd1ef2dcd578f20c39bfdd22d70c57a801502b0`; roles: exported-object\n- sha256: `49c45399074a6af07b176d55bb85b3de42b2c2889bf9efa37310b4e71cf14f43`; roles: exported-object\n- exported object `imgpaper.png`; SHA-256 `8aa9c596dd3eb7560bc7416ba181e858f1174fcbcb5432050f3f9a663ed1ffa2`; size 582656 bytes\n SHA-1: `7082e465fac0b6bb7ac2e9d9b5a72182144bf12c`; MD5: `179345004c39336eaba39863b95f268b`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.3.11.194\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":18431,\"response_frame\":18931,\"server_ip\":\"64.44.133.131\",\"status_code\":\"200\",\"tcp_stream\":434,\"url\":\"http://64.44.133.131/images/imgpaper.png\"}]`.\n Static content: `{\"content_kind\":\"pe\",\"features\":[],\"inspected_bytes\":262144,\"inspection_truncated\":true,\"interpretation\":\"Static content only; not proof of execution, intent, or malware family\",\"pe_kind\":\"executable\"}`. Not execution proof.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":262144,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":true}`; do not infer the destination without an exact transfer binding.\n- exported object `cursor.png`; SHA-256 `68798ccf8e2a5f9682a4e011bec288ad9b3f900244f82c6ae5e8ca538725f92e`; size 582144 bytes\n SHA-1: `f8af3d1f92be28c30c42b97d4b891b733181eb4a`; MD5: `9dfb3952172deeddb3a5e3cafed933bc`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.3.11.194\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":19014,\"response_frame\":19533,\"server_ip\":\"64.44.133.131\",\"status_code\":\"200\",\"tcp_stream\":434,\"url\":\"http://64.44.133.131/images/cursor.png\"}]`.\n Static content: `{\"content_kind\":\"pe\",\"features\":[],\"inspected_bytes\":262144,\"inspection_truncated\":true,\"interpretation\":\"Static content only; not proof of execution, intent, or malware family\",\"pe_kind\":\"executable\"}`. Not execution proof.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":262144,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":true}`; do not infer the destination without an exact transfer binding.\n- exported object `cursor(1).png`; SHA-256 `fef9b646dba5c7372fe92b6a9d227833c1d15d8cc3a73fd22be9d1869b21cd67`; size 582144 bytes\n SHA-1: `4ae71ff8059e4be68ac5d6b16189b2c3b90d83ef`; MD5: `e40d7846eae7d8a98c0e3512e5461e4c`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.3.11.194\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":19562,\"response_frame\":20107,\"server_ip\":\"64.44.133.131\",\"status_code\":\"200\",\"tcp_stream\":450,\"url\":\"http://64.44.133.131/images/cursor.png\"}]`.\n Static content: `{\"content_kind\":\"pe\",\"features\":[],\"inspected_bytes\":262144,\"inspection_truncated\":true,\"interpretation\":\"Static content only; not proof of execution, intent, or malware family\",\"pe_kind\":\"executable\"}`. Not execution proof.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":262144,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":true}`; do not infer the destination without an exact transfer binding.\n- exported object `YAS20.exe`; SHA-256 `02db3c6b9aff73bf8a11c41107c836b6c800c919c5d3d1304f336aee03f79f4c`; size 466944 bytes\n SHA-1: `53b97a9f6b4894d99386a42ab7196d83b719e012`; MD5: `c74656862b16f81d02c109030260245b`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.3.11.194\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":8616,\"response_frame\":8998,\"server_ip\":\"50.87.248.17\",\"status_code\":\"200\",\"tcp_stream\":259,\"url\":\"http://bolton-tech.com/YAS20.exe\"}]`.\n Static content: `{\"content_kind\":\"pe\",\"features\":[],\"inspected_bytes\":262144,\"inspection_truncated\":true,\"interpretation\":\"Static content only; not proof of execution, intent, or malware family\",\"pe_kind\":\"executable\"}`. Not execution proof.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[{\"source\":\"referenced-profile-path\",\"type\":\"account\",\"value\":\"User\"}],\"inspected_bytes\":262144,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":true}`; do not infer the destination without an exact transfer binding.\n- exported object `98b20fd6aed4cfc29e428d4dd8e00930%3fAccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1`; SHA-256 `5638ee72bed581aec1cf09b1e7fdeb37a23b69d8f5927ca00b84f2286a695066`; size 117306 bytes\n SHA-1: `d16e388721f7e3ede6eab7b73763c5267840e160`; MD5: `55dfe78b7ea9148705ed9ae202ad90fa`; completeness: unknown; transfers: `[{\"client_ip\":\"10.3.11.119\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":6156,\"response_frame\":6580,\"server_ip\":\"23.209.74.120\",\"status_code\":\"200\",\"tcp_stream\":238,\"url\":\"http://nebula.wsimg.com/98b20fd6aed4cfc29e428d4dd8e00930?AccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1\"}]`.\n Static content: `{\"content_kind\":\"script-like-text\",\"features\":[{\"excerpt\":\"IeX\",\"feature\":\"dynamic-evaluation\",\"offset\":20086}],\"inspected_bytes\":117306,\"inspection_truncated\":false,\"interpretation\":\"Static content only; not proof of execution, intent, or malware family\",\"pe_kind\":null}`. Not execution proof.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":117306,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `duel.js%3fappid=O3BkA5J1`; SHA-256 `1ca2faaa4a7ba86c934c337dcb47ebd521dd5721a9f62302ef36f074c1a4c8d8`; size 41029 bytes\n SHA-1: `f444238560e671e29ba974c9c72b2f7d09e16f4a`; MD5: `1ef02cd398011e906762d0ab0c9da5a1`; completeness: unknown; transfers: `[{\"client_ip\":\"10.3.11.119\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":4475,\"response_frame\":4616,\"server_ip\":\"23.211.18.27\",\"status_code\":\"200\",\"tcp_stream\":207,\"url\":\"http://img1.wsimg.com/starfield/duel/v2.5.8/duel.js?appid=O3BkA5J1\"}]`.\n Static content: `{\"content_kind\":\"script-like-text\",\"features\":[{\"excerpt\":\"eval(\",\"feature\":\"dynamic-evaluation\",\"offset\":12678}],\"inspected_bytes\":41029,\"inspection_truncated\":false,\"interpretation\":\"Static content only; not proof of execution, intent, or malware family\",\"pe_kind\":null}`. Not execution proof.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":41029,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `3f2de843c79e006d37fb2ff42ab0d18c%3fAccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1`; SHA-256 `a869f2e254fb5a41a1745f2ad858148a990c11f543012e43f14780a0e3b57538`; size 422099 bytes\n SHA-1: `e1041ac30b171376d025bbe5e8663bc1dd5e2e6f`; MD5: `f68d885c1a593231f8bd9f654299ea23`; completeness: unknown; transfers: `[{\"client_ip\":\"10.3.11.119\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":9006,\"response_frame\":9409,\"server_ip\":\"23.209.74.120\",\"status_code\":\"200\",\"tcp_stream\":210,\"url\":\"http://nebula.wsimg.com/3f2de843c79e006d37fb2ff42ab0d18c?AccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":262144,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":true}`; do not infer the destination without an exact transfer binding.\n- exported object `d0c5998dd42685ef31a2dbd195b7220e%3fAccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1`; SHA-256 `5c06f9a4898eae08a070b18d66d2162fd031833e993d1c0bf3bd9e7e83a6c526`; size 404229 bytes\n SHA-1: `4cc1af1da674f98cf1cb14962471b2e86c5f3c4d`; MD5: `087d57586210dacae99cf032af97473b`; completeness: unknown; transfers: `[{\"client_ip\":\"10.3.11.119\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":5452,\"response_frame\":6059,\"server_ip\":\"23.209.74.120\",\"status_code\":\"200\",\"tcp_stream\":210,\"url\":\"http://nebula.wsimg.com/d0c5998dd42685ef31a2dbd195b7220e?AccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":262144,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":true}`; do not infer the destination without an exact transfer binding.\n- exported object `18385e97e118628cd32e2d0c189f6eee%3fAccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1`; SHA-256 `f0f761f95b7d8b5f5b64d8c078bb7e9274a0d248d73094d7d16581213c3fb7ef`; size 385085 bytes\n SHA-1: `750f6327470d60e94b48476ebd116f3ab0064681`; MD5: `c2d4fdf72d8155f14a72f70584ebe202`; completeness: unknown; transfers: `[{\"client_ip\":\"10.3.11.119\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":6158,\"response_frame\":6945,\"server_ip\":\"23.209.74.120\",\"status_code\":\"200\",\"tcp_stream\":239,\"url\":\"http://nebula.wsimg.com/18385e97e118628cd32e2d0c189f6eee?AccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":262144,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":true}`; do not infer the destination without an exact transfer binding.\n- exported object `21eea24a60f7c8fb7ed4dcca63aca4f5%3fAccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1`; SHA-256 `626211f63483c4d5717e680816bc56119bcb9cdb3446c6d9241b119037ae724e`; size 380697 bytes\n SHA-1: `76f392e43b628627c67943b93b7ca459997056c1`; MD5: `8fc1f65e0cae75aa125570c0dcc6bb91`; completeness: unknown; transfers: `[{\"client_ip\":\"10.3.11.119\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":9419,\"response_frame\":9736,\"server_ip\":\"23.209.74.120\",\"status_code\":\"200\",\"tcp_stream\":210,\"url\":\"http://nebula.wsimg.com/21eea24a60f7c8fb7ed4dcca63aca4f5?AccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":262144,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":true}`; do not infer the destination without an exact transfer binding.\n- exported object `893e2501ed5504c59ddf5b5352855b87%3fAccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1`; SHA-256 `0e7a2be431ec48b8483bf126741dba1fc74260a35d944a1b8f0f6c2e0adfc9dd`; size 359935 bytes\n SHA-1: `f024ac7b6197c2e20d5d746ed8dee465ad25c2d4`; MD5: `9337d6089aff7102a378af7656d23bd0`; completeness: unknown; transfers: `[{\"client_ip\":\"10.3.11.119\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":8195,\"response_frame\":8538,\"server_ip\":\"23.209.74.120\",\"status_code\":\"200\",\"tcp_stream\":210,\"url\":\"http://nebula.wsimg.com/893e2501ed5504c59ddf5b5352855b87?AccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":262144,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":true}`; do not infer the destination without an exact transfer binding.\n- exported object `2b8f0431afda995f993087c8ec231ddf%3fAccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1`; SHA-256 `8c1c0d96e26bb0fe8578afd07244eae11bab36021b8484862ed81010b97a873d`; size 354536 bytes\n SHA-1: `c895f671f786fc500dcf7788a50f6421ff953843`; MD5: `8db3ba89a5dcd40bcd637ef795f8368b`; completeness: unknown; transfers: `[{\"client_ip\":\"10.3.11.119\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":9821,\"response_frame\":10146,\"server_ip\":\"23.209.74.120\",\"status_code\":\"200\",\"tcp_stream\":210,\"url\":\"http://nebula.wsimg.com/2b8f0431afda995f993087c8ec231ddf?AccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":262144,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":true}`; do not infer the destination without an exact transfer binding.\n- exported object `c92f917c785f8c03f78b627d46aa8dc2%3fAccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1`; SHA-256 `2458ec1dbcd980f7d484f0140f1d88e2088249eacf3411b2b2359afdf7774318`; size 338308 bytes\n SHA-1: `db33f2fe344b46b408aa5478a231f4e96d8e2367`; MD5: `09684b74d31477ea3ff8abd2ca334b91`; completeness: unknown; transfers: `[{\"client_ip\":\"10.3.11.119\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":7726,\"response_frame\":8022,\"server_ip\":\"23.209.74.120\",\"status_code\":\"200\",\"tcp_stream\":210,\"url\":\"http://nebula.wsimg.com/c92f917c785f8c03f78b627d46aa8dc2?AccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":262144,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":true}`; do not infer the destination without an exact transfer binding.\n- exported object `6843f2b90530e6ec9ea7f397b0375735%3fAccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1`; SHA-256 `c683bc3d52a2a1a0b299fe17e0ccddf7fdc01d8b246fb1652ea258904a8bff7f`; size 302749 bytes\n SHA-1: `a1e83e997a2fe00728169b1700e90807471d425f`; MD5: `9f847a7763b893615b0df694637234e4`; completeness: unknown; transfers: `[{\"client_ip\":\"10.3.11.119\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":6077,\"response_frame\":6900,\"server_ip\":\"23.209.74.120\",\"status_code\":\"200\",\"tcp_stream\":211,\"url\":\"http://nebula.wsimg.com/6843f2b90530e6ec9ea7f397b0375735?AccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":262144,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":true}`; do not infer the destination without an exact transfer binding.\n- exported object `6e2b4120ae0b4dbcac9541ce80c5dd24%3fAccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1`; SHA-256 `567b1b26bdc881dbbae6afca179ba2597c243a6a045984bb61c8138a00389792`; size 285252 bytes\n SHA-1: `06667787cfa017021b078941d9c866bde46a3911`; MD5: `03881e82f9ba8b00b7b251c070997227`; completeness: unknown; transfers: `[{\"client_ip\":\"10.3.11.119\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":6075,\"response_frame\":7107,\"server_ip\":\"23.209.74.120\",\"status_code\":\"200\",\"tcp_stream\":210,\"url\":\"http://nebula.wsimg.com/6e2b4120ae0b4dbcac9541ce80c5dd24?AccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":262144,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":true}`; do not infer the destination without an exact transfer binding.\n- exported object `bootstrap.css`; SHA-256 `c942686010e285633d77a24341c43850ccd6162fcc7e8281ae8a70c2921a9af5`; size 141622 bytes\n SHA-1: `f2183455571b19311a235bd5aa204e694ade8e94`; MD5: `2183d05f5a0a9a3b2e8cb0509ca363e3`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.3.11.218\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":13326,\"response_frame\":13643,\"server_ip\":\"65.254.227.240\",\"status_code\":\"200\",\"tcp_stream\":345,\"url\":\"http://notable-quotes.com/css/bootstrap.css\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":141622,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `widgets.js`; SHA-256 `95562c2db2cc4094800540ee79790996a5e1fab12a5a3a99432545af45eb2be8`; size 98387 bytes\n SHA-1: `cddab9612b8a4444948e236dc47a4072356a75e9`; MD5: `1274f782fe475e8540678e9cdf10fcdb`; completeness: unknown; transfers: `[{\"client_ip\":\"10.3.11.119\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":6154,\"response_frame\":6254,\"server_ip\":\"72.21.91.66\",\"status_code\":\"200\",\"tcp_stream\":237,\"url\":\"http://platform.twitter.com/widgets.js\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":98387,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `jquery.min.js`; SHA-256 `232066e3f6f1351afdaee1acb70c409766641fd5669e0b55ce7c77fac0a857ef`; size 91668 bytes\n SHA-1: `2b7996b01d90b7f424f2a2e6063947461db4b2b2`; MD5: `219073097031d9c1a95a1291d66f3a10`; completeness: unknown; transfers: `[{\"client_ip\":\"10.3.11.218\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":13836,\"response_frame\":13891,\"server_ip\":\"172.217.12.74\",\"status_code\":\"200\",\"tcp_stream\":358,\"url\":\"http://ajax.googleapis.com/ajax/libs/jquery/1.6.4/jquery.min.js\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":91668,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `sf.core.pkg.js`; SHA-256 `85c54a570e292f19e17fc817bdfdd11f501a95534b8e483629d91c605f38c896`; size 79901 bytes\n SHA-1: `7197008c00ccbd7feb1e20a06f72394be47e6c4d`; MD5: `4d7ee74246750024abf9e32c49497839`; completeness: unknown; transfers: `[{\"client_ip\":\"10.3.11.119\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":5551,\"response_frame\":5791,\"server_ip\":\"23.211.18.27\",\"status_code\":\"200\",\"tcp_stream\":231,\"url\":\"http://img4.wsimg.com/starfield/duel/v2.5.8/sf.core/sf.core.pkg.js\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":79901,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `app.css`; SHA-256 `fe4428ffba8707caf8541a0ca37cfc96234012a10d051e3362d9d05fbbd9e659`; size 77910 bytes\n SHA-1: `7b02847140dd432186ec1847c8ea2fed21cd78d6`; MD5: `36c1cfbb9d29f230e41b25fd66529dff`; completeness: unknown; transfers: `[{\"client_ip\":\"10.3.11.119\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":5856,\"response_frame\":5911,\"server_ip\":\"23.211.18.27\",\"status_code\":\"200\",\"tcp_stream\":232,\"url\":\"http://img2.wsimg.com/starfield/duel/v2.5.8/sf.core/app.css\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":77910,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `wedding_quote.jpg`; SHA-256 `4a0ba027a8859545d3caf300e4c8293248c6e878758cacb14f34e1cdc3d2e24d`; size 74590 bytes\n SHA-1: `e1146920b69851fc67077ba5556816958868a945`; MD5: `cda5b2e6ad0a8aeee53cc12917c95f0f`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.3.11.218\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":13477,\"response_frame\":13821,\"server_ip\":\"65.254.227.240\",\"status_code\":\"200\",\"tcp_stream\":354,\"url\":\"http://www.notable-quotes.com/w/wedding_quote.jpg\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":74590,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `wisdom_quote.jpg`; SHA-256 `be8eb05fd0a2321d069099b171050e5b03effc735dcb43da10d0751ca721a026`; size 69439 bytes\n SHA-1: `0dc02b7637208803f60c5ce19b61302a508a8280`; MD5: `afabb0267a2c56567118685daa8fa78d`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.3.11.218\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":13468,\"response_frame\":13774,\"server_ip\":\"65.254.227.240\",\"status_code\":\"200\",\"tcp_stream\":353,\"url\":\"http://www.notable-quotes.com/w/wisdom_quote.jpg\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":69439,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `apocalypse_quote_3.jpg`; SHA-256 `0e687e2d9d394d7247d63b61aa33895b436f347eb73d8d1d1f99c199d2a0486e`; size 68850 bytes\n SHA-1: `6e6b99d7eff3a7bbf7b81afaf5eb81074a2dee32`; MD5: `03da69d861702a33226567d659b3bbb4`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.3.11.218\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":13473,\"response_frame\":13749,\"server_ip\":\"65.254.227.240\",\"status_code\":\"200\",\"tcp_stream\":355,\"url\":\"http://www.notable-quotes.com/a/apocalypse_quote_3.jpg\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":68850,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `R70EjzUBlOqPeouhFDfR80-0FhOqJubN-BeL9Xxd.woff2`; SHA-256 `974ec9b1a263ff7658a88da7dc41e55989ff284562111577e0b1fd36144c8bd7`; size 68540 bytes\n SHA-1: `d08524c8c69a770212e263d1b4a60b86cd4b65b8`; MD5: `c589abad023039f1aa4491292317fed0`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.3.11.119\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":4956,\"response_frame\":5056,\"server_ip\":\"216.58.194.131\",\"status_code\":\"200\",\"tcp_stream\":220,\"url\":\"http://fonts.gstatic.com/s/loveyalikeasister/v10/R70EjzUBlOqPeouhFDfR80-0FhOqJubN-BeL9Xxd.woff2\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":68540,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `toolbar.cdn.min.js`; SHA-256 `d34dc64266e873c506a07bb00c46b2eef77d812e9c312bd12717fbb67b9740c2`; size 61214 bytes\n SHA-1: `675be7de72f142ca0f5ee09df5d4b536e49391bc`; MD5: `0d10cea6b04b6d0fc6b0c9278390cc32`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.3.11.218\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":13902,\"response_frame\":13981,\"server_ip\":\"172.217.6.144\",\"status_code\":\"200\",\"tcp_stream\":351,\"url\":\"http://files.markerly.com/toolbar.cdn.min.js\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":61214,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `america_quote_8.jpg`; SHA-256 `876adf01df542fb8b0f263b3c41b1bf5b0c928f5b8a1205f5cb116b650843906`; size 59314 bytes\n SHA-1: `112b6d2c93ef6e11874d29b866d77f2bf83f1a1f`; MD5: `484fbfa634fc00217f2f927907734eca`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.3.11.218\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":13467,\"response_frame\":13819,\"server_ip\":\"65.254.227.240\",\"status_code\":\"200\",\"tcp_stream\":352,\"url\":\"http://www.notable-quotes.com/a/america_quote_8.jpg\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":59314,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `%2f`; SHA-256 `088111ecdfb3a045b7d594f7c4632561d30b72e15bc771d79812c172ea77e0de`; size 45927 bytes\n SHA-1: `616371c53cdfc9cf2c2f569b75c99f3625412f0d`; MD5: `346c622eac644d3e223b452f85ff705d`; completeness: unknown; transfers: `[{\"client_ip\":\"10.3.11.119\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":4366,\"response_frame\":4381,\"server_ip\":\"72.167.191.69\",\"status_code\":\"200\",\"tcp_stream\":200,\"url\":\"http://www.tuscaloosabarnyard.com/\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":45927,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `site.css%3fv=`; SHA-256 `c4015f58592d68396095b177ad8dd20f7c3910e2e08c0c81b24a9efd0f40c0c8`; size 36818 bytes\n SHA-1: `7630b50217bd600f9195c2ea0fdcda350ba54766`; MD5: `c109622564ee23360f712ac2e17077bd`; completeness: unknown; transfers: `[{\"client_ip\":\"10.3.11.119\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":4398,\"response_frame\":4453,\"server_ip\":\"72.167.191.69\",\"status_code\":\"200\",\"tcp_stream\":200,\"url\":\"http://www.tuscaloosabarnyard.com/site.css?v=\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":36818,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `ga6XaxZG_G5OvCf_rt7FH3B6BHLMEdVOEoI.woff2`; SHA-256 `5adbad4e799ade940d96f6f293fc1ea535b504a6151555c879c5e183aeac1018`; size 36608 bytes\n SHA-1: `6ff0d81acd606849d3d8692a859ef0d4a77464fb`; MD5: `ff1115b75eb4a529cc005729359a9438`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.3.11.119\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":4958,\"response_frame\":5029,\"server_ip\":\"216.58.194.131\",\"status_code\":\"200\",\"tcp_stream\":222,\"url\":\"http://fonts.gstatic.com/s/averiasanslibre/v8/ga6XaxZG_G5OvCf_rt7FH3B6BHLMEdVOEoI.woff2\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":36608,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `bootstrap.min.js`; SHA-256 `d5fd173d00d9733900834e0e1083de86b532e048b15c0420ba5c2db0623644b8`; size 35951 bytes\n SHA-1: `253711c6d825de55a8360552573be950da180614`; MD5: `8c237312864d2e4c4f03544cd4f9b195`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.3.11.218\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":13453,\"response_frame\":13559,\"server_ip\":\"65.254.227.240\",\"status_code\":\"200\",\"tcp_stream\":344,\"url\":\"http://notable-quotes.com/js/bootstrap.min.js\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":35951,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `vm8vdRfvXFLG3OLnsO15WYS5DG74wNI.woff2`; SHA-256 `06cb95758d706e8359a137118c05fb38af14616f870a0448d327c3203ee69973`; size 34792 bytes\n SHA-1: `338258c45b90016ba5c691802b70c9dbbf0f9e90`; MD5: `e2ea67e80b95334da4768bffdf3d4f9d`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.3.11.119\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":5071,\"response_frame\":5161,\"server_ip\":\"216.58.194.131\",\"status_code\":\"200\",\"tcp_stream\":224,\"url\":\"http://fonts.gstatic.com/s/kaushanscript/v8/vm8vdRfvXFLG3OLnsO15WYS5DG74wNI.woff2\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":34792,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `%2f(1)`; SHA-256 `2e8b2448de2607edfbeba46bc40bdf5ff8a97afc21e36e0f2a8faaeb7802651d`; size 27226 bytes\n SHA-1: `3db8de3fbd01b55559c241393c8dc8b16ddc251e`; MD5: `0e8d79d5f32935808d7fcc0a460ce329`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.3.11.218\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":13309,\"response_frame\":13350,\"server_ip\":\"65.254.227.240\",\"status_code\":\"200\",\"tcp_stream\":344,\"url\":\"http://notable-quotes.com/\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":27226,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `TUZyzwprpvBS1izr_vOECuSf.woff2`; SHA-256 `7c41a77c81ad105a586ea655d38846277c13e59341f0d572b8f0eb5ce8af2000`; size 26984 bytes\n SHA-1: `007327747ae81767330a959824996afc10c8fe42`; MD5: `4f95a7d5181cecbd9d7ebf7aae5d7526`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.3.11.119\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":5066,\"response_frame\":5141,\"server_ip\":\"216.58.194.131\",\"status_code\":\"200\",\"tcp_stream\":220,\"url\":\"http://fonts.gstatic.com/s/amaticsc/v13/TUZyzwprpvBS1izr_vOECuSf.woff2\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":26984,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `nqlogo2.png`; SHA-256 `8c426b04cd3debee6a21646f14d72a09db7ad335d1cf348484a654a7905760f5`; size 21518 bytes\n SHA-1: `7e93ba4aea9995766187db5a61371b784c20818a`; MD5: `4975eacbe48a1a498b33e2c66f1568f1`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.3.11.218\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":13371,\"response_frame\":13528,\"server_ip\":\"65.254.227.240\",\"status_code\":\"200\",\"tcp_stream\":347,\"url\":\"http://notable-quotes.com/images/nqlogo2.png\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":21518,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `FeVQS0BTqb0h60ACH55Q2A.woff2`; SHA-256 `3fd2858003c32f1542e7f330cfd1ef2dcd578f20c39bfdd22d70c57a801502b0`; size 21160 bytes\n SHA-1: `d34e916a6628a81d176e6a2e1084c4582327e384`; MD5: `b3ba8a148967a46f73deb6a51da802af`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.3.11.119\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":5062,\"response_frame\":5088,\"server_ip\":\"216.58.194.131\",\"status_code\":\"200\",\"tcp_stream\":215,\"url\":\"http://fonts.gstatic.com/s/bangers/v12/FeVQS0BTqb0h60ACH55Q2A.woff2\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":21160,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `css%3ffamily=Fredericka+the+Great%7cAllura%7cAmatic+SC%7cArizonia%7cAveria+Sans+Libre%7cCabin+Sketch%7cFrancois+One%7cJacques+Francois+Shadow%7cJosefin+Slab%7cKaushan+Script%7cLove+Ya+Like+A+Sister%7cMerriweather%7cOffside%7cOpen+Sans%7cOpen+Sans+Condense`; SHA-256 `4b2f13582e24aa18d80a7efd5ca0862cbb68b414a3d9d37a9138c3873bdbbba8`; size 20209 bytes\n SHA-1: `40ec915794fc83e2acf01a047a5db5df9cc798c4`; MD5: `fcd2248d517dc2b4a8a7321f5944c74b`; completeness: unknown; transfers: `[{\"client_ip\":\"10.3.11.119\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":4433,\"response_frame\":4490,\"server_ip\":\"216.58.194.42\",\"status_code\":\"200\",\"tcp_stream\":205,\"url\":\"http://fonts.googleapis.com/css?family=Fredericka+the+Great|Allura|Amatic+SC|Arizonia|Averia+Sans+Libre|Cabin+Sketch|Francois+One|Jacques+Francois+Shadow|Josefin+Slab|Kaushan+Script|Love+Ya+Like+A+Sister|Merriweather|Offside|Open+Sans|Open+Sans+Condensed|Oswald|Over+the+Rainbow|Pacifico|Romanesco|Sacramento|Seaweed+Script|Special+Elite\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":20209,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `mem8YaGs126MiZpBA-UFVZ0b.woff2`; SHA-256 `9c50a96c859b9beea47b71740bd14e7f69a4df586d015f47434037f8def53b52`; size 14380 bytes\n SHA-1: `600db9374e47e4f73a59ccc0a99bcc42f4a3e02a`; MD5: `33543c5cc5d88f5695dd08c87d280dfd`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.3.11.119\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":4917,\"response_frame\":4962,\"server_ip\":\"216.58.194.131\",\"status_code\":\"200\",\"tcp_stream\":215,\"url\":\"http://fonts.gstatic.com/s/opensans/v17/mem8YaGs126MiZpBA-UFVZ0b.woff2\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":14380,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `1a4f5564116de9920433f700c2a9c20c%3fAccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1`; SHA-256 `c3bdfe5de3424f3d07872f6ecb6de79015e4301a4eb72803fbff251c41311f88`; size 13710 bytes\n SHA-1: `6aa998151cf7fd9bd2480c45d8a4fe467fbd4e93`; MD5: `8d42d80b17ef06dd7a6f33c6651ac43b`; completeness: unknown; transfers: `[{\"client_ip\":\"10.3.11.119\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":4640,\"response_frame\":4694,\"server_ip\":\"23.209.74.120\",\"status_code\":\"200\",\"tcp_stream\":211,\"url\":\"http://nebula.wsimg.com/1a4f5564116de9920433f700c2a9c20c?AccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":13710,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `CSR64z1Qlv-GDxkbKVQ_fOAKTQ.woff2`; SHA-256 `361c9f80feaefdda9eb1bb7ee61de56d922188898f69af4cf8a76c64fb0183ad`; size 13224 bytes\n SHA-1: `f1619ceb1204eb7606a385fdf869b4d918c8e422`; MD5: `040faae9f93b143eda18261d5d87e989`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.3.11.119\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":5065,\"response_frame\":5123,\"server_ip\":\"216.58.194.131\",\"status_code\":\"200\",\"tcp_stream\":222,\"url\":\"http://fonts.gstatic.com/s/newscycle/v16/CSR64z1Qlv-GDxkbKVQ_fOAKTQ.woff2\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":13224,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `main_toolbar_cdn.min.css`; SHA-256 `2ac97370caeb512780c9e407128aaa48e9ea92e34acfb427888e1a8027aa7723`; size 12418 bytes\n SHA-1: `4452ba80159e4f3bb8dfe03350631c4b436a1a6a`; MD5: `aedf40180b4bbdaedaf29e0270a5b01c`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.3.11.218\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":13984,\"response_frame\":13996,\"server_ip\":\"172.217.6.144\",\"status_code\":\"200\",\"tcp_stream\":351,\"url\":\"http://files.markerly.com/main_toolbar_cdn.min.css\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":12418,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `90d173a36db4dc5268be43fbed9cde77%3fAccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1`; SHA-256 `b6c573fcecf8b4204abd88d9076ae381da57f8969c241e9f08215d3016adc612`; size 12245 bytes\n SHA-1: `6ca1175f5bb50b30eb1664f61d200d22ca4a1c41`; MD5: `13fe078f3f8dc29e220f8bc71c7423e2`; completeness: unknown; transfers: `[{\"client_ip\":\"10.3.11.119\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":4481,\"response_frame\":4512,\"server_ip\":\"23.209.74.120\",\"status_code\":\"200\",\"tcp_stream\":210,\"url\":\"http://nebula.wsimg.com/90d173a36db4dc5268be43fbed9cde77?AccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":12245,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `25a1c16c05755eb2ec17846b91efa5fe%3fAccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1`; SHA-256 `9b7024bd4a97fed7a3823a6d98653f66ec959b8e5b73aa533f7e78d0900f9e6d`; size 8133 bytes\n SHA-1: `c9fc3b9a81a2bb7347650895168ef0924ff8affc`; MD5: `ef68c72350e7a86b9ff41ed45f35510c`; completeness: unknown; transfers: `[{\"client_ip\":\"10.3.11.119\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":4477,\"response_frame\":4522,\"server_ip\":\"23.209.74.120\",\"status_code\":\"200\",\"tcp_stream\":211,\"url\":\"http://nebula.wsimg.com/25a1c16c05755eb2ec17846b91efa5fe?AccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":8133,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `tcc_l.combined.1.0.5.min.js`; SHA-256 `d774beebaea68f3e3be399e441d6f5bf073ce036a8cce8a90b444c60d2985f04`; size 5969 bytes\n SHA-1: `11533d8047b5b6369783b09b96f429d8d911490b`; MD5: `578c37eeee1f4d1e9ce957a7133d166c`; completeness: unknown; transfers: `[{\"client_ip\":\"10.3.11.119\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":4638,\"response_frame\":4679,\"server_ip\":\"23.211.18.27\",\"status_code\":\"200\",\"tcp_stream\":207,\"url\":\"http://img1.wsimg.com/tcc/tcc_l.combined.1.0.5.min.js\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":5969,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `90`; SHA-256 `f1d535264c136ef79dcbc92b30a25b313ed312dc611c92cd70d6470a1609ee88`; size 5366 bytes\n SHA-1: `0b5a9d716bfe5f8167de567fbf319c536f838ae7`; MD5: `f09673ad745e39470708028f7431f6d6`; completeness: unknown; transfers: `[]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `googleplus.png`; SHA-256 `1e7a8021a029a0b1b97d9df2c059ad4fe80ff8d9db9564c593bdde97df48f5ff`; size 3869 bytes\n SHA-1: `fe08b0b0ae99731e513abf4ce61b174c5986ab75`; MD5: `8f4a2ba46a7ed3853ef2e946e3b4ec02`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.3.11.218\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":13384,\"response_frame\":13460,\"server_ip\":\"65.254.227.240\",\"status_code\":\"200\",\"tcp_stream\":349,\"url\":\"http://notable-quotes.com/images/googleplus.png\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":3869,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `twitter.png`; SHA-256 `49c45399074a6af07b176d55bb85b3de42b2c2889bf9efa37310b4e71cf14f43`; size 3644 bytes\n SHA-1: `7f0f25f951eb7eafb843ec053c60ec5375af3e57`; MD5: `c65574840a08aa38cee83459810dfdf0`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.3.11.218\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":13383,\"response_frame\":13457,\"server_ip\":\"65.254.227.240\",\"status_code\":\"200\",\"tcp_stream\":348,\"url\":\"http://notable-quotes.com/images/twitter.png\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":3644,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `wsb-slideshow-arrows.png`; SHA-256 `b42b0d8a915682fe8b49af799d072001ddc761191069bd18b2f2974c77a8cf65`; size 3427 bytes\n SHA-1: `aaa496420ac09bd3a0c6024d96560224f22c1a66`; MD5: `78b7f6751312da2e37f53ac07c419d16`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.3.11.119\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":5450,\"response_frame\":5506,\"server_ip\":\"23.211.18.27\",\"status_code\":\"200\",\"tcp_stream\":207,\"url\":\"http://img1.wsimg.com/wst/v7/WSB7_J_20200225_2323_DEP-18389_2679/v1/images/wsb-slideshow-arrows.png\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":3427,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `facebook.png`; SHA-256 `89c5625aa0ecfeaa47ae9da990cda5ab80fe8088ab1cd55ee7394e870de5eafa`; size 3394 bytes\n SHA-1: `b214cd510459f20a0a0146b287fef0f1f400126d`; MD5: `6a46d2278f751d882bee1ec883f568f9`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.3.11.218\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":13369,\"response_frame\":13436,\"server_ip\":\"65.254.227.240\",\"status_code\":\"200\",\"tcp_stream\":346,\"url\":\"http://notable-quotes.com/images/facebook.png\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":3394,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `css%3ffamily=News+Cycle%7cBangers%7cRaleway%3a200`; SHA-256 `00b3e28e084717e5fb9ba1f8a9cf7e9a854ded1b7b4721ed31110513013461dc`; size 2741 bytes\n SHA-1: `dfbb0e48be142df52ecd52c06856bbb4ccaad668`; MD5: `41d4d2bc37085e8368fc0237a9866b69`; completeness: unknown; transfers: `[{\"client_ip\":\"10.3.11.119\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":4439,\"response_frame\":4496,\"server_ip\":\"216.58.194.42\",\"status_code\":\"200\",\"tcp_stream\":206,\"url\":\"http://fonts.googleapis.com/css?family=News+Cycle|Bangers|Raleway:200\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":2741,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D`; SHA-256 `2aa0809ab9f586e743514b0ef60ece6f30dc7d5583d64c1d90cfb87c7019a2bf`; size 1507 bytes\n SHA-1: `40573ce89668a1fd1555d65afeb0c8af940f6e1d`; MD5: `249b96dd177b84862baccacb6a2f6ed6`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.3.11.194\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":10500,\"response_frame\":10503,\"server_ip\":\"72.21.91.29\",\"status_code\":\"200\",\"tcp_stream\":273,\"url\":\"http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":1507,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `markerly-cdn.js`; SHA-256 `a219ef1a0091feb8ab30c92f4a25833c4f431001bdec691af31878cdcaa1e43d`; size 1292 bytes\n SHA-1: `6fc5b32d6d283c647a138926594c3b8ae5f8af62`; MD5: `2dc4140f2e908bfb4dc98c48001ca2de`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.3.11.218\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":13377,\"response_frame\":13389,\"server_ip\":\"172.217.6.144\",\"status_code\":\"200\",\"tcp_stream\":351,\"url\":\"http://files.markerly.com/markerly-cdn.js\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":1292,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `eea2577ebdcc219fe1962915e163ee72%3fAccessKeyId=531592D248B589D87A56&disposition=0&alloworigin=1`; SHA-256 `5b0d6fc1a80187419cfcc2340e6bf1a3e7704e8d65b44bee45a1caaab91138d2`; size 1268 bytes\n SHA-1: `c7c6b9f0b16c45774ef458be845e17fb9844f4e8`; MD5: `6101bbce3c654be9fcb64d45763fbd9b`; completeness: unknown; transfers: `[{\"client_ip\":\"10.3.11.119\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":4642,\"response_frame\":4693,\"server_ip\":\"23.209.74.120\",\"status_code\":\"200\",\"tcp_stream\":210,\"url\":\"http://nebula.wsimg.com/eea2577ebdcc219fe1962915e163ee72?AccessKeyId=531592D248B589D87A56&disposition=0&alloworigin=1\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":1268,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `favicon.ico`; SHA-256 `c623c1144c540ad5f5ee378220c6237026df828fa5d63c95e072de454aa1113a`; size 964 bytes\n SHA-1: `653e8f27819259d835508c7b82365b4b9cef1ed2`; MD5: `3579895a66ea85424254005233f27531`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.3.11.119\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":7675,\"response_frame\":7679,\"server_ip\":\"72.167.191.69\",\"status_code\":\"404\",\"tcp_stream\":200,\"url\":\"http://www.tuscaloosabarnyard.com/favicon.ico\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":964,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `style.css`; SHA-256 `3ddb722a10d4664abeb93659beefa009255d6cda0975a47944665976ad9e64cd`; size 934 bytes\n SHA-1: `8e8b6a157030869630ed867d87f98a3459a2eb3a`; MD5: `130956569608d27fb7b7f000f708ac2e`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.3.11.218\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":13363,\"response_frame\":13433,\"server_ip\":\"65.254.227.240\",\"status_code\":\"200\",\"tcp_stream\":344,\"url\":\"http://notable-quotes.com/css/style.css\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":934,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `STCA.crl`; SHA-256 `34efd2a999616fb13ef5fadece4481e978c68f2f3416713a4364a21fe81d3243`; size 758 bytes\n SHA-1: `c1359b399f37d2bda962ae19ec39ff0a1e062359`; MD5: `cf4379c5eab6e8159bcb860f6e791faa`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.3.11.119\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":21909,\"response_frame\":21914,\"server_ip\":\"23.63.253.208\",\"status_code\":\"200\",\"tcp_stream\":491,\"url\":\"http://crl.securetrust.com/STCA.crl\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":758,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `5e2ea9aae9a1ca943046a6868cb3002b%3fAccessKeyId=531592D248B589D87A56&alloworigin=1`; SHA-256 `f1a04b0b791b515d66978d2f6d2980bec1455795486bb71b19e7ad8a84aab865`; size 617 bytes\n SHA-1: `58a3d1dab136e13dfe99c1a2c8b31a65349b55b6`; MD5: `82517b88972261be6dbc514854697234`; completeness: unknown; transfers: `[{\"client_ip\":\"10.3.11.119\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":4815,\"response_frame\":4819,\"server_ip\":\"23.209.74.120\",\"status_code\":\"200\",\"tcp_stream\":210,\"url\":\"http://nebula.wsimg.com/5e2ea9aae9a1ca943046a6868cb3002b?AccessKeyId=531592D248B589D87A56&alloworigin=1\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":617,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `81(2)`; SHA-256 `34fc3b82e17c69e3cefd908d8e85848f2cdfcb180ba5c05a84ccd2c65e943e09`; size 551 bytes\n SHA-1: `4b325c14e2ab53c90209d69aafcdff7cf4954f86`; MD5: `5baf5e34a2924d3ab654837f1badef89`; completeness: unknown; transfers: `[]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `81`; SHA-256 `01428897745e7b37849d922e35e28ad8585aca2a254d55f3b5adaecb0b3cb526`; size 274 bytes\n SHA-1: `27c6a0b9cc10890f73294dd86ff95802a236229d`; MD5: `82a12e8bf6b396c3c5c71286a41eebeb`; completeness: unknown; transfers: `[]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `81(4)`; SHA-256 `3291b96690178e55e4114c78a6241d3a6bd18aa7361626ff803b54064d178122`; size 219 bytes\n SHA-1: `418e1f29098e4162db2c7acd7ec34141cf94b907`; MD5: `b2bc7a9a1b086bf7b7ba6c121f11a534`; completeness: unknown; transfers: `[]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `81(6)`; SHA-256 `cf0d2bf5ac3284cc068e414be2a74d56bc5c1543413d3965aa96075114817a7a`; size 210 bytes\n SHA-1: `73dab20a7f19c74ba87ebf2bd805995b10516ac9`; MD5: `d8f7098175c9941069a9b4960e3ea2c6`; completeness: unknown; transfers: `[]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `addthis_widget.js`; SHA-256 `21bd143d38dbbae427615a7266a86a18dc95c417f3e510632d7a9180d98d3571`; size 171 bytes\n SHA-1: `00465aec6b8ec302eae8abb99678fc5c09c3f343`; MD5: `3c417e9efbcaeb3bf7e7df75cf3b22fd`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.3.11.119\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":4559,\"response_frame\":4568,\"server_ip\":\"72.246.84.150\",\"status_code\":\"308\",\"tcp_stream\":216,\"url\":\"http://s7.addthis.com/js/300/addthis_widget.js\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":171,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `%2f(2)`; SHA-256 `855a518348bdb64df2ac2fc743b2f2479d4b6fb69d9f87dcdc740ee5d5e03a40`; size 16 bytes\n SHA-1: `d5d01816258491ab74798f0407cbb3924a08a34c`; MD5: `bcb8cf3f858e5e33c319860f4b813e3b`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.3.11.194\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":14981,\"response_frame\":14988,\"server_ip\":\"18.235.112.207\",\"status_code\":\"200\",\"tcp_stream\":389,\"url\":\"http://checkip.amazonaws.com/\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":16,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `81(1)`; SHA-256 `c76ea8b0db60dcccfdc0217059e37eb5b10d10940e649f9bc1d07d4ddcc797d1`; size 3 bytes\n SHA-1: `ff0288c119791fc13a51965eb3a0e61be2c06338`; MD5: `fa06d89c65fb808240e37f4c9e128955`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.3.11.194\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":19116,\"response_frame\":19486,\"server_ip\":\"203.176.135.102\",\"status_code\":\"200\",\"tcp_stream\":448,\"url\":\"http://203.176.135.102:8082/yas20/LAPTOP-7XMV2SN_W10018363.CF3A0EAB425F1927835EF064A69CAED6/81/\"},{\"client_ip\":\"10.3.11.194\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":19547,\"response_frame\":19553,\"server_ip\":\"203.176.135.102\",\"status_code\":\"200\",\"tcp_stream\":449,\"url\":\"http://203.176.135.102:8082/yas20/LAPTOP-7XMV2SN_W10018363.CF3A0EAB425F1927835EF064A69CAED6/81/\"},{\"client_ip\":\"10.3.11.194\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":20660,\"response_frame\":20667,\"server_ip\":\"203.176.135.102\",\"status_code\":\"200\",\"tcp_stream\":459,\"url\":\"http://203.176.135.102:8082/yas20/LAPTOP-7XMV2SN_W10018363.CF3A0EAB425F1927835EF064A69CAED6/90\"},{\"client_ip\":\"10.3.11.194\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":21096,\"response_frame\":21101,\"server_ip\":\"203.176.135.102\",\"status_code\":\"200\",\"tcp_stream\":465,\"url\":\"http://203.176.135.102:8082/yas20/LAPTOP-7XMV2SN_W10018363.CF3A0EAB425F1927835EF064A69CAED6/81/\"},{\"client_ip\":\"10.3.11.194\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":26673,\"response_frame\":26675,\"server_ip\":\"203.176.135.102\",\"status_code\":\"200\",\"tcp_stream\":555,\"url\":\"http://203.176.135.102:8082/yas20/LAPTOP-7XMV2SN_W10018363.CF3A0EAB425F1927835EF064A69CAED6/81/\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":3,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n\n## Actor similarity leads\n\n- Volatile Cedar (G0123): 20% TTP overlap. This is an investigation lead, not attribution.\n- Winnti Group (G0044): 17% TTP overlap. This is an investigation lead, not attribution.\n- Ajax Security Team (G0130): 17% TTP overlap. This is an investigation lead, not attribution.\n- IndigoZebra (G0136): 14% TTP overlap. This is an investigation lead, not attribution.\n- Nomadic Octopus (G0133): 14% TTP overlap. This is an investigation lead, not attribution.\n- Metador (G1013): 11% TTP overlap. This is an investigation lead, not attribution.\n- Whitefly (G0107): 11% TTP overlap. This is an investigation lead, not attribution.\n- Elderwood (G0066): 11% TTP overlap. This is an investigation lead, not attribution.\n- Rancor (G0075): 11% TTP overlap. This is an investigation lead, not attribution.\n- Evilnum (G0120): 9% TTP overlap. This is an investigation lead, not attribution.\n\n## Local enrichment and correlations\n\nNo match means unknown in this corpus. Local CTI may postdate the capture. Matches and shared infrastructure require review; no automatic promotion or attribution.\nSnapshot: `49a1c4d42d02f7a98d3e8223de9c81c1d38d4198bf1402d947d0407feed5ef70`; recorded 2026-09-22T16:01:25.777364+00:00; mode: local-only.\nCoverage: `{\"matched_observables\":0,\"no_exact_match\":617,\"observable_limit\":5000,\"observables_checked\":617,\"observables_total\":617,\"prior_case_limit_reached\":true,\"prior_cases_checked\":50,\"truncated\":false}`\n\n- Catalog T1105: https://attack.mitre.org/techniques/T1105; detection strategies: [{\"attack_id\":\"DET0060\",\"name\":\"Detect Ingress Tool Transfers via Behavioral Chain\",\"stix_id\":\"x-mitre-detection-strategy--67677c4c-5778-49eb-ae74-1920645b8554\"}]\n- Prior analysis `c66676ab-7276-4989-8c27-65017a63c2ba` shares 98 observations. This does not establish a common campaign.\n- Prior analysis `476c88cb-8e1a-42e4-a8bd-e2ad2e63b0cd` shares 9 observations. This does not establish a common campaign.\n- Prior analysis `044c22d0-fd65-4c60-8644-c22ff5e1b31c` shares 23 observations. This does not establish a common campaign.\n- Prior analysis `73129515-519f-4544-905f-145c9d2de3d8` shares 18 observations. This does not establish a common campaign.\n- Prior analysis `5ddffc9a-7544-4749-b7bc-17ad98beaadb` shares 27 observations. This does not establish a common campaign.\n- Prior analysis `fc2de8b3-a6ce-4024-9d9b-5602034db53d` shares 23 observations. This does not establish a common campaign.\n- Prior analysis `b12014b8-9e64-4e70-bdb8-90620d23ac22` shares 28 observations. This does not establish a common campaign.\n- Prior analysis `ada03a66-9d3d-4c08-b448-f9758ac8bac5` shares 29 observations. This does not establish a common campaign.\n- Prior analysis `0b13588f-0835-4e15-9f97-8a9411ad7f7f` shares 43 observations. This does not establish a common campaign.\n- Prior analysis `92de15ed-01f0-4a43-8105-a56b60130430` shares 25 observations. This does not establish a common campaign.\n- Prior analysis `fdf1584a-1c2d-4a49-92b2-8dcb98436eb0` shares 39 observations. This does not establish a common campaign.\n- Prior analysis `fab22e38-ca53-4105-924e-f5722b5f53fe` shares 37 observations. This does not establish a common campaign.\n- Prior analysis `31f265dc-3055-4628-8df4-136d4058e842` shares 8 observations. This does not establish a common campaign.\n- Prior analysis `b60c4dbb-eb8f-46a7-89b9-24606fd43e46` shares 14 observations. This does not establish a common campaign.\n- Prior analysis `8174eaa7-e189-467f-b05e-fb7397bfcf16` shares 14 observations. This does not establish a common campaign.\n- Prior analysis `e37603cf-d241-45ee-95ec-bcf92a063147` shares 16 observations. This does not establish a common campaign.\n- Prior analysis `7c54479c-cce3-4570-80c9-69d03571a645` shares 29 observations. This does not establish a common campaign.\n- Prior analysis `21da2cda-3a07-4c03-b352-af8740c84bc0` shares 28 observations. This does not establish a common campaign.\n- Prior analysis `9923b3d5-8d06-4f6a-b1f1-810507712be3` shares 34 observations. This does not establish a common campaign.\n- Prior analysis `8f0da1cd-9998-4d41-9fc7-683302a6ee24` shares 41 observations. This does not establish a common campaign.\n- Prior analysis `96e0e828-93ae-49d5-8104-9f14cb584c3e` shares 14 observations. This does not establish a common campaign.\n- Prior analysis `6e50c68f-5552-400c-9835-15867ddb022d` shares 20 observations. This does not establish a common campaign.\n- Prior analysis `43bc93eb-d6db-4400-b983-b0dd404c8ca4` shares 32 observations. This does not establish a common campaign.\n- Prior analysis `6df36b51-4b44-4660-b534-2fa89705e807` shares 25 observations. This does not establish a common campaign.\n- Prior analysis `29aa3ef8-47c9-4c47-b4cc-1ff3e0708142` shares 12 observations. This does not establish a common campaign.\n- Prior analysis `b79032a8-d69e-4ac1-bdd4-542473fa8e3b` shares 20 observations. This does not establish a common campaign.\n- Prior analysis `faf041c3-70e0-4a01-8780-10917e5e187c` shares 12 observations. This does not establish a common campaign.\n- Prior analysis `08324647-35af-4af2-8d82-4387eec03918` shares 19 observations. This does not establish a common campaign.\n- External provider queries: 0. Not requested; no unknown indicator is classified as benign.\n\n## Coverage and limitations\n\n- Packet and protocol facts are deterministic for the recorded analyzer manifest.\n- Encrypted application payloads are not decrypted; only available metadata is reported.\n- ATT&CK mappings and actor overlaps are candidates until analyst review and promotion.\n- HTTP object inventory: `{\"compact_objects\":0,\"complete\":true,\"detailed_objects\":63,\"export_status\":\"completed\",\"exported_objects\":67,\"hashed_bytes\":6915057,\"hashed_objects\":67,\"omitted_unique_hashes\":0,\"returned_unique_hashes\":63,\"selection\":\"content-classified first, then size descending, SHA256 tie-break; deduplicated by full hash; overflow retains a compact hash index\",\"unhashed_objects\":0,\"unique_hashes\":63}`. Compact overflow hashes are retained in JSON coverage and observables.\n- A directory subject is not necessarily a logged-in user; consult identity bindings in the JSON evidence.\n- Rendered / available: findings 30/30, identities 15/15, observables 500/617, artifacts 63/63. Full returned inventory is in the JSON result.\n- Warning: Conflicting TCP overlap: fallback extraction rejected this direction\n\n## Evidence-backed IOC assessment\n\n598 typed observations; 3 evidence-backed IOC candidates for review, including 0 with direct malicious provider reports. No automatic confirmation or attribution.\n\nPolicy: `pcap-assessment-v3`; assessment SHA-256: `fb5331850ba125f73c605e4b158c4e295f9056cc73c5dcfe31a54ad66d8f1e30`.\n\n- sha256 `68798ccf8e2a5f9682a4e011bec288ad9b3f900244f82c6ae5e8ca538725f92e` — suspicious; evidence: `[{\"artifact_id\":\"artifact-f2042332405293c1a06baa7f\",\"features\":[\"pe-bytes-under-non-executable-url-extension\"],\"frames\":[19533],\"interpretation\":\"A transfer-bound PE is served under a non-executable URL extension. Investigate the exact recovered hash; this is not proof of execution or a transitive hosting-IP verdict.\",\"kind\":\"static-review\"}]`; provider signals: `[{\"actors\":[],\"basis\":\"No verdict: not_found\",\"cache_hit\":false,\"context_status\":\"provider-assertion-not-capture-behavior-or-attribution\",\"evidence\":{},\"queried_at\":\"2026-09-22T17:45:04.621124+00:00\",\"relationship_context\":[],\"source\":\"malwarebazaar\",\"status\":\"not_found\",\"technique_ids\":[],\"verdict\":\"unknown\"},{\"actors\":[],\"basis\":\"No verdict: not_found\",\"cache_hit\":false,\"context_status\":\"provider-assertion-not-capture-behavior-or-attribution\",\"evidence\":{},\"queried_at\":\"2026-09-22T17:45:04.258289+00:00\",\"relationship_context\":[],\"source\":\"threatfox\",\"status\":\"not_found\",\"technique_ids\":[],\"verdict\":\"unknown\"},{\"actors\":[],\"basis\":\"No verdict: deferred-rate-limit\",\"cache_hit\":false,\"context_status\":\"provider-assertion-not-capture-behavior-or-attribution\",\"cooldown_scope\":\"shared-redis\",\"error_category\":\"rate_limited\",\"evidence\":{},\"queried_at\":\"2026-09-22T17:45:04.248592+00:00\",\"relationship_context\":[],\"retry_at\":\"2026-09-22T17:49:29.781117+00:00\",\"source\":\"virustotal\",\"status\":\"deferred-rate-limit\",\"technique_ids\":[],\"verdict\":\"unknown\"}]`\n- sha256 `8aa9c596dd3eb7560bc7416ba181e858f1174fcbcb5432050f3f9a663ed1ffa2` — suspicious; evidence: `[{\"artifact_id\":\"artifact-533bfd4c90957b3cbb58a9e1\",\"features\":[\"pe-bytes-under-non-executable-url-extension\"],\"frames\":[18931],\"interpretation\":\"A transfer-bound PE is served under a non-executable URL extension. Investigate the exact recovered hash; this is not proof of execution or a transitive hosting-IP verdict.\",\"kind\":\"static-review\"}]`; provider signals: `[{\"actors\":[],\"basis\":\"No verdict: not_found\",\"cache_hit\":false,\"context_status\":\"provider-assertion-not-capture-behavior-or-attribution\",\"evidence\":{},\"queried_at\":\"2026-09-22T17:45:05.315083+00:00\",\"relationship_context\":[],\"source\":\"malwarebazaar\",\"status\":\"not_found\",\"technique_ids\":[],\"verdict\":\"unknown\"},{\"actors\":[],\"basis\":\"No verdict: not_found\",\"cache_hit\":false,\"context_status\":\"provider-assertion-not-capture-behavior-or-attribution\",\"evidence\":{},\"queried_at\":\"2026-09-22T17:45:04.954661+00:00\",\"relationship_context\":[],\"source\":\"threatfox\",\"status\":\"not_found\",\"technique_ids\":[],\"verdict\":\"unknown\"},{\"actors\":[],\"basis\":\"No verdict: deferred-rate-limit\",\"cache_hit\":false,\"context_status\":\"provider-assertion-not-capture-behavior-or-attribution\",\"cooldown_scope\":\"shared-redis\",\"error_category\":\"rate_limited\",\"evidence\":{},\"queried_at\":\"2026-09-22T17:45:04.952559+00:00\",\"relationship_context\":[],\"retry_at\":\"2026-09-22T17:49:29.781117+00:00\",\"source\":\"virustotal\",\"status\":\"deferred-rate-limit\",\"technique_ids\":[],\"verdict\":\"unknown\"}]`\n- sha256 `fef9b646dba5c7372fe92b6a9d227833c1d15d8cc3a73fd22be9d1869b21cd67` — suspicious; evidence: `[{\"artifact_id\":\"artifact-bdbd58f24a3993f922d9b197\",\"features\":[\"pe-bytes-under-non-executable-url-extension\"],\"frames\":[20107],\"interpretation\":\"A transfer-bound PE is served under a non-executable URL extension. Investigate the exact recovered hash; this is not proof of execution or a transitive hosting-IP verdict.\",\"kind\":\"static-review\"}]`; provider signals: `[{\"actors\":[],\"basis\":\"No verdict: not_found\",\"cache_hit\":false,\"context_status\":\"provider-assertion-not-capture-behavior-or-attribution\",\"evidence\":{},\"queried_at\":\"2026-09-22T17:45:05.918008+00:00\",\"relationship_context\":[],\"source\":\"malwarebazaar\",\"status\":\"not_found\",\"technique_ids\":[],\"verdict\":\"unknown\"},{\"actors\":[],\"basis\":\"No verdict: not_found\",\"cache_hit\":false,\"context_status\":\"provider-assertion-not-capture-behavior-or-attribution\",\"evidence\":{},\"queried_at\":\"2026-09-22T17:45:05.672459+00:00\",\"relationship_context\":[],\"source\":\"threatfox\",\"status\":\"not_found\",\"technique_ids\":[],\"verdict\":\"unknown\"},{\"actors\":[],\"basis\":\"No verdict: deferred-rate-limit\",\"cache_hit\":false,\"context_status\":\"provider-assertion-not-capture-behavior-or-attribution\",\"cooldown_scope\":\"shared-redis\",\"error_category\":\"rate_limited\",\"evidence\":{},\"queried_at\":\"2026-09-22T17:45:05.667874+00:00\",\"relationship_context\":[],\"retry_at\":\"2026-09-22T17:49:29.781117+00:00\",\"source\":\"virustotal\",\"status\":\"deferred-rate-limit\",\"technique_ids\":[],\"verdict\":\"unknown\"}]`\n\nOrdinary observations remain in the capture inventory; they are not declared malicious IOCs.\n\nReputation snapshot: `f349b66db87b263bf2ac7d57fba881f2084dc5b2a31c74b953ae3fc20b7cc39a`; updated 2026-09-22T17:45:22.702373+00:00. Each target retains its query time. Coverage: `{\"active_scans\":0,\"batch_results\":[{\"observable_id\":\"observable-0e8573cd0b6b47b4aece50cf\",\"provider\":\"virustotal\",\"status\":\"deferred-rate-limit\"},{\"observable_id\":\"observable-0e8573cd0b6b47b4aece50cf\",\"provider\":\"threatfox\",\"status\":\"not_found\"},{\"observable_id\":\"observable-92abde5cd08edeadc2f99562\",\"provider\":\"virustotal\",\"status\":\"deferred-rate-limit\"},{\"observable_id\":\"observable-92abde5cd08edeadc2f99562\",\"provider\":\"threatfox\",\"status\":\"not_found\"},{\"observable_id\":\"observable-522ef96dc30c20264516468e\",\"provider\":\"virustotal\",\"status\":\"deferred-rate-limit\"},{\"observable_id\":\"observable-522ef96dc30c20264516468e\",\"provider\":\"threatfox\",\"status\":\"not_found\"},{\"observable_id\":\"observable-f7617f8cef59730032c2c46c\",\"provider\":\"virustotal\",\"status\":\"deferred-rate-limit\"},{\"observable_id\":\"observable-f7617f8cef59730032c2c46c\",\"provider\":\"threatfox\",\"status\":\"not_found\"},{\"observable_id\":\"observable-1fd8e066886a6c8af4164897\",\"provider\":\"virustotal\",\"status\":\"deferred-rate-limit\"},{\"observable_id\":\"observable-1fd8e066886a6c8af4164897\",\"provider\":\"threatfox\",\"status\":\"not_found\"}],\"batch_targets\":5,\"cache_hits\":0,\"full_urls_disclosed\":0,\"payload_uploads\":0,\"provider_lookups_started\":5,\"retained_targets\":75,\"targets_omitted\":0}`.\n- No detections, no record, missing credentials and provider errors do not mean benign.\n- Current reputation may postdate the capture. Shared hosting, DNS resolution and graph overlap do not transfer maliciousness.\n- A recovered file is not proof of execution; hashes identify exported bytes, including partial objects.\n- Public-looking enterprise domains may still be sensitive: review selected targets before external disclosure.\n", "result": { "flows": [ { "bytes": 1320, "stream": 0, "flow_id": "flow-6ff038da9522f38e611e254c", "packets": 12, "transport": "udp", "last_frame": 537, "first_frame": 1, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.255", "initiator_port": 137, "responder_port": 137, "initiator_bytes": 1320, "last_seen_epoch": "1583961758.227379", "responder_bytes": 0, "first_seen_epoch": "1583961754.987241" }, { "bytes": 316, "stream": 1, "flow_id": "flow-e1807927572ff233e4448e9a", "packets": 2, "transport": "udp", "last_frame": 4, "first_frame": 3, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 53532, "responder_port": 53, "initiator_bytes": 126, "last_seen_epoch": "1583961755.129096", "responder_bytes": 190, "first_seen_epoch": "1583961755.128744" }, { "bytes": 494, "stream": 2, "flow_id": "flow-e0642ad481322d7bf5d8ce9e", "packets": 2, "transport": "udp", "last_frame": 6, "first_frame": 5, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 53534, "responder_port": 389, "initiator_bytes": 262, "last_seen_epoch": "1583961755.1625", "responder_bytes": 232, "first_seen_epoch": "1583961755.162164" }, { "bytes": 560, "stream": 3, "flow_id": "flow-1c70bd79ecec10ed7829f566", "packets": 2, "transport": "udp", "last_frame": 8, "first_frame": 7, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 53536, "responder_port": 389, "initiator_bytes": 308, "last_seen_epoch": "1583961755.175136", "responder_bytes": 252, "first_seen_epoch": "1583961755.174779" }, { "bytes": 538, "stream": 4, "flow_id": "flow-906c411c1e16b897d4ac3d05", "packets": 2, "transport": "udp", "last_frame": 10, "first_frame": 9, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 53537, "responder_port": 389, "initiator_bytes": 306, "last_seen_epoch": "1583961755.194851", "responder_bytes": 232, "first_seen_epoch": "1583961755.194448" }, { "bytes": 495, "stream": 5, "flow_id": "flow-99609c3ca8527f2e3a5c8434", "packets": 2, "transport": "udp", "last_frame": 12, "first_frame": 11, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 53538, "responder_port": 389, "initiator_bytes": 263, "last_seen_epoch": "1583961755.299866", "responder_bytes": 232, "first_seen_epoch": "1583961755.299481" }, { "bytes": 3444, "stream": 0, "flow_id": "flow-afe0f5d1f9af2f3b3dc219c7", "packets": 24, "transport": "tcp", "last_frame": 1399, "first_frame": 13, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 49671, "responder_port": 135, "initiator_bytes": 1882, "last_seen_epoch": "1583961782.246009", "responder_bytes": 1562, "first_seen_epoch": "1583961755.308742" }, { "bytes": 4488, "stream": 1, "flow_id": "flow-0e93ad89391cd4bc7b5cff1a", "packets": 20, "transport": "tcp", "last_frame": 1398, "first_frame": 20, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 49672, "responder_port": 49671, "initiator_bytes": 2606, "last_seen_epoch": "1583961782.245775", "responder_bytes": 1882, "first_seen_epoch": "1583961755.317059" }, { "bytes": 22516, "stream": 2, "flow_id": "flow-9cc7bfb09ac5f2593ce695d8", "packets": 72, "transport": "tcp", "last_frame": 8170, "first_frame": 38, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 49673, "responder_port": 49667, "initiator_bytes": 14806, "last_seen_epoch": "1583961872.247305", "responder_bytes": 7710, "first_seen_epoch": "1583961755.350415" }, { "bytes": 9818, "stream": 3, "flow_id": "flow-9af88b6011d52ad4825aeeeb", "packets": 32, "transport": "tcp", "last_frame": 300, "first_frame": 45, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 49674, "responder_port": 389, "initiator_bytes": 4717, "last_seen_epoch": "1583961755.99769", "responder_bytes": 5101, "first_seen_epoch": "1583961755.354454" }, { "bytes": 922, "stream": 4, "flow_id": "flow-2c716976a504eb30974e3a22", "packets": 8, "transport": "tcp", "last_frame": 65, "first_frame": 58, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 49675, "responder_port": 88, "initiator_bytes": 471, "last_seen_epoch": "1583961755.454149", "responder_bytes": 451, "first_seen_epoch": "1583961755.452361" }, { "bytes": 2511, "stream": 5, "flow_id": "flow-3be66b1a047a8b0bf77e023a", "packets": 10, "transport": "tcp", "last_frame": 75, "first_frame": 66, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 49676, "responder_port": 88, "initiator_bytes": 605, "last_seen_epoch": "1583961755.471459", "responder_bytes": 1906, "first_seen_epoch": "1583961755.469844" }, { "bytes": 4019, "stream": 6, "flow_id": "flow-166b84f46d8cdc8ac056df6b", "packets": 12, "transport": "tcp", "last_frame": 87, "first_frame": 76, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 49677, "responder_port": 88, "initiator_bytes": 2020, "last_seen_epoch": "1583961755.489116", "responder_bytes": 1999, "first_seen_epoch": "1583961755.486769" }, { "bytes": 326, "stream": 6, "flow_id": "flow-ddd81517c672579bf12348fa", "packets": 2, "transport": "udp", "last_frame": 97, "first_frame": 96, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 60287, "responder_port": 53, "initiator_bytes": 131, "last_seen_epoch": "1583961755.51727", "responder_bytes": 195, "first_seen_epoch": "1583961755.516919" }, { "bytes": 477, "stream": 7, "flow_id": "flow-f6df3ef2c683e30f82ac6d4d", "packets": 2, "transport": "udp", "last_frame": 99, "first_frame": 98, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 60288, "responder_port": 389, "initiator_bytes": 241, "last_seen_epoch": "1583961755.518119", "responder_bytes": 236, "first_seen_epoch": "1583961755.517828" }, { "bytes": 922, "stream": 7, "flow_id": "flow-32439c12b561f3e93acc2aca", "packets": 8, "transport": "tcp", "last_frame": 107, "first_frame": 100, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 49678, "responder_port": 88, "initiator_bytes": 471, "last_seen_epoch": "1583961755.530858", "responder_bytes": 451, "first_seen_epoch": "1583961755.529272" }, { "bytes": 2512, "stream": 8, "flow_id": "flow-d3b1f821c1492003a0ef43c1", "packets": 10, "transport": "tcp", "last_frame": 117, "first_frame": 108, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 49679, "responder_port": 88, "initiator_bytes": 606, "last_seen_epoch": "1583961755.532998", "responder_bytes": 1906, "first_seen_epoch": "1583961755.53119" }, { "bytes": 44319, "stream": 9, "flow_id": "flow-b8ac796ff6715e692b786d2b", "packets": 172, "transport": "tcp", "last_frame": 10389, "first_frame": 132, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 49680, "responder_port": 445, "initiator_bytes": 23022, "last_seen_epoch": "1583961939.077864", "responder_bytes": 21297, "first_seen_epoch": "1583961755.538256" }, { "bytes": 348, "stream": 10, "flow_id": "flow-903248cb3daa932e4ec562ac", "packets": 6, "transport": "tcp", "last_frame": 161, "first_frame": 154, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 49681, "responder_port": 389, "initiator_bytes": 174, "last_seen_epoch": "1583961755.635444", "responder_bytes": 174, "first_seen_epoch": "1583961755.634316" }, { "bytes": 921, "stream": 11, "flow_id": "flow-7981b2f6d1e5ea6897e2b308", "packets": 8, "transport": "tcp", "last_frame": 171, "first_frame": 164, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 49682, "responder_port": 88, "initiator_bytes": 471, "last_seen_epoch": "1583961755.684844", "responder_bytes": 450, "first_seen_epoch": "1583961755.683487" }, { "bytes": 2511, "stream": 12, "flow_id": "flow-c7c1db98110ca7c075344944", "packets": 10, "transport": "tcp", "last_frame": 181, "first_frame": 172, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 49683, "responder_port": 88, "initiator_bytes": 605, "last_seen_epoch": "1583961755.69521", "responder_bytes": 1906, "first_seen_epoch": "1583961755.692821" }, { "bytes": 3987, "stream": 13, "flow_id": "flow-1166b5ab7d1b4927ab635243", "packets": 12, "transport": "tcp", "last_frame": 193, "first_frame": 182, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 49684, "responder_port": 88, "initiator_bytes": 2004, "last_seen_epoch": "1583961755.701265", "responder_bytes": 1983, "first_seen_epoch": "1583961755.699676" }, { "bytes": 3627, "stream": 14, "flow_id": "flow-9cd47b824a655dddcd7de94f", "packets": 12, "transport": "tcp", "last_frame": 205, "first_frame": 194, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 49685, "responder_port": 88, "initiator_bytes": 1799, "last_seen_epoch": "1583961755.702746", "responder_bytes": 1828, "first_seen_epoch": "1583961755.70148" }, { "bytes": 326, "stream": 8, "flow_id": "flow-74e4371af0059c6c8ebe314b", "packets": 2, "transport": "udp", "last_frame": 216, "first_frame": 215, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 55384, "responder_port": 53, "initiator_bytes": 131, "last_seen_epoch": "1583961755.709448", "responder_bytes": 195, "first_seen_epoch": "1583961755.709176" }, { "bytes": 477, "stream": 9, "flow_id": "flow-cb922853ebed78d6a45e72e3", "packets": 2, "transport": "udp", "last_frame": 223, "first_frame": 222, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 55385, "responder_port": 389, "initiator_bytes": 241, "last_seen_epoch": "1583961755.768995", "responder_bytes": 236, "first_seen_epoch": "1583961755.768709" }, { "bytes": 922, "stream": 15, "flow_id": "flow-60effd64837e602a0b91c87a", "packets": 8, "transport": "tcp", "last_frame": 231, "first_frame": 224, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 49686, "responder_port": 88, "initiator_bytes": 471, "last_seen_epoch": "1583961755.853686", "responder_bytes": 451, "first_seen_epoch": "1583961755.852258" }, { "bytes": 2512, "stream": 16, "flow_id": "flow-5a795aea36e7b27db017acfc", "packets": 10, "transport": "tcp", "last_frame": 241, "first_frame": 232, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 49687, "responder_port": 88, "initiator_bytes": 606, "last_seen_epoch": "1583961755.856802", "responder_bytes": 1906, "first_seen_epoch": "1583961755.85379" }, { "bytes": 4019, "stream": 17, "flow_id": "flow-b7a9a2ce67555f8aaa598035", "packets": 12, "transport": "tcp", "last_frame": 253, "first_frame": 242, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 49688, "responder_port": 88, "initiator_bytes": 2020, "last_seen_epoch": "1583961755.86", "responder_bytes": 1999, "first_seen_epoch": "1583961755.857145" }, { "bytes": 2488, "stream": 18, "flow_id": "flow-a3fc342e5c0ea24c720d373a", "packets": 6, "transport": "tcp", "last_frame": 259, "first_frame": 254, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 49668, "responder_port": 389, "initiator_bytes": 2116, "last_seen_epoch": "1583961755.865915", "responder_bytes": 372, "first_seen_epoch": "1583961755.860423" }, { "bytes": 348, "stream": 19, "flow_id": "flow-4504f81202b584005594f220", "packets": 6, "transport": "tcp", "last_frame": 266, "first_frame": 260, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 49689, "responder_port": 389, "initiator_bytes": 174, "last_seen_epoch": "1583961755.886729", "responder_bytes": 174, "first_seen_epoch": "1583961755.885247" }, { "bytes": 296, "stream": 10, "flow_id": "flow-4632653a9d41072fa238ea39", "packets": 2, "transport": "udp", "last_frame": 269, "first_frame": 268, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 58212, "responder_port": 53, "initiator_bytes": 116, "last_seen_epoch": "1583961755.887604", "responder_bytes": 180, "first_seen_epoch": "1583961755.887376" }, { "bytes": 494, "stream": 11, "flow_id": "flow-d0c77ecade65676776dbd39b", "packets": 2, "transport": "udp", "last_frame": 271, "first_frame": 270, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 58213, "responder_port": 389, "initiator_bytes": 262, "last_seen_epoch": "1583961755.888612", "responder_bytes": 232, "first_seen_epoch": "1583961755.888265" }, { "bytes": 245, "stream": 12, "flow_id": "flow-2dc7ff19bc28577b14252f37", "packets": 2, "transport": "udp", "last_frame": 276, "first_frame": 275, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 57365, "responder_port": 53, "initiator_bytes": 85, "last_seen_epoch": "1583961755.962554", "responder_bytes": 160, "first_seen_epoch": "1583961755.962222" }, { "bytes": 348, "stream": 20, "flow_id": "flow-4836e47e3ea962ef682633a2", "packets": 6, "transport": "tcp", "last_frame": 285, "first_frame": 279, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 49690, "responder_port": 389, "initiator_bytes": 174, "last_seen_epoch": "1583961755.994361", "responder_bytes": 174, "first_seen_epoch": "1583961755.993395" }, { "bytes": 348, "stream": 21, "flow_id": "flow-782755e98b2333095c9e4e34", "packets": 6, "transport": "tcp", "last_frame": 293, "first_frame": 287, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 49691, "responder_port": 389, "initiator_bytes": 174, "last_seen_epoch": "1583961755.99641", "responder_bytes": 174, "first_seen_epoch": "1583961755.99533" }, { "bytes": 192, "stream": 13, "flow_id": "flow-10136dca02b1a882f7e9132d", "packets": 2, "transport": "udp", "last_frame": 320, "first_frame": 319, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 62697, "responder_port": 53, "initiator_bytes": 88, "last_seen_epoch": "1583961756.220052", "responder_bytes": 104, "first_seen_epoch": "1583961756.21978" }, { "bytes": 8923, "stream": 22, "flow_id": "flow-eefabda3b7179b185fe49513", "packets": 21, "transport": "tcp", "last_frame": 514, "first_frame": 323, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 49693, "responder_port": 389, "initiator_bytes": 3730, "last_seen_epoch": "1583961756.982264", "responder_bytes": 5193, "first_seen_epoch": "1583961756.516586" }, { "bytes": 3930, "stream": 23, "flow_id": "flow-9aa6c6879a4abc2e0d4d10a0", "packets": 12, "transport": "tcp", "last_frame": 346, "first_frame": 335, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 49694, "responder_port": 88, "initiator_bytes": 1985, "last_seen_epoch": "1583961756.580874", "responder_bytes": 1945, "first_seen_epoch": "1583961756.578835" }, { "bytes": 3710, "stream": 24, "flow_id": "flow-b8e1b5f91369fb2e6723bd42", "packets": 16, "transport": "tcp", "last_frame": 509, "first_frame": 349, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 49695, "responder_port": 389, "initiator_bytes": 2804, "last_seen_epoch": "1583961756.943334", "responder_bytes": 906, "first_seen_epoch": "1583961756.591965" }, { "bytes": 4019, "stream": 25, "flow_id": "flow-b42ae349612c5f7a8b188d04", "packets": 12, "transport": "tcp", "last_frame": 376, "first_frame": 365, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 49696, "responder_port": 88, "initiator_bytes": 2020, "last_seen_epoch": "1583961756.724558", "responder_bytes": 1999, "first_seen_epoch": "1583961756.722447" }, { "bytes": 3627, "stream": 26, "flow_id": "flow-b986099ad676b381a15c020f", "packets": 12, "transport": "tcp", "last_frame": 388, "first_frame": 377, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 49697, "responder_port": 88, "initiator_bytes": 1799, "last_seen_epoch": "1583961756.726507", "responder_bytes": 1828, "first_seen_epoch": "1583961756.724964" }, { "bytes": 4962, "stream": 14, "flow_id": "flow-92a51f8e2e1c9a89411778f9", "packets": 28, "transport": "udp", "last_frame": 15895, "first_frame": 516, "initiator_ip": "10.3.11.218", "responder_ip": "239.255.255.250", "initiator_port": 62700, "responder_port": 1900, "initiator_bytes": 4962, "last_seen_epoch": "1583962401.724097", "responder_bytes": 0, "first_seen_epoch": "1583961757.053472" }, { "bytes": 306, "stream": 15, "flow_id": "flow-c4ba97e48601fa604342ce9d", "packets": 2, "transport": "udp", "last_frame": 526, "first_frame": 525, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 63408, "responder_port": 53, "initiator_bytes": 92, "last_seen_epoch": "1583961757.840619", "responder_bytes": 214, "first_seen_epoch": "1583961757.819997" }, { "bytes": 5010, "stream": 27, "flow_id": "flow-ae7b86958043431cf35d37a1", "packets": 24, "transport": "tcp", "last_frame": 643, "first_frame": 527, "initiator_ip": "10.3.11.218", "responder_ip": "40.69.218.62", "initiator_port": 49699, "responder_port": 443, "initiator_bytes": 1214, "last_seen_epoch": "1583961758.764515", "responder_bytes": 3796, "first_seen_epoch": "1583961757.846735" }, { "bytes": 255, "stream": 16, "flow_id": "flow-ca32bd0d843b27f195166798", "packets": 2, "transport": "udp", "last_frame": 546, "first_frame": 545, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 53951, "responder_port": 53, "initiator_bytes": 89, "last_seen_epoch": "1583961758.338153", "responder_bytes": 166, "first_seen_epoch": "1583961758.337798" }, { "bytes": 310, "stream": 17, "flow_id": "flow-227637d3092929db66b983b9", "packets": 2, "transport": "udp", "last_frame": 548, "first_frame": 547, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 63258, "responder_port": 53, "initiator_bytes": 155, "last_seen_epoch": "1583961758.341657", "responder_bytes": 155, "first_seen_epoch": "1583961758.340596" }, { "bytes": 316, "stream": 18, "flow_id": "flow-2d64871e89c67f35fbc29456", "packets": 2, "transport": "udp", "last_frame": 550, "first_frame": 549, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 51011, "responder_port": 53, "initiator_bytes": 126, "last_seen_epoch": "1583961758.356527", "responder_bytes": 190, "first_seen_epoch": "1583961758.356275" }, { "bytes": 495, "stream": 19, "flow_id": "flow-0736700c9dd703578368dafe", "packets": 2, "transport": "udp", "last_frame": 552, "first_frame": 551, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 51012, "responder_port": 389, "initiator_bytes": 263, "last_seen_epoch": "1583961758.357372", "responder_bytes": 232, "first_seen_epoch": "1583961758.357128" }, { "bytes": 1578, "stream": 28, "flow_id": "flow-af43e96277345e99ca3b00cc", "packets": 11, "transport": "tcp", "last_frame": 632, "first_frame": 554, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 49700, "responder_port": 135, "initiator_bytes": 898, "last_seen_epoch": "1583961758.660083", "responder_bytes": 680, "first_seen_epoch": "1583961758.477644" }, { "bytes": 6655, "stream": 29, "flow_id": "flow-243cfa41d6c7a93b7a48aae8", "packets": 23, "transport": "tcp", "last_frame": 633, "first_frame": 561, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 49701, "responder_port": 49667, "initiator_bytes": 4266, "last_seen_epoch": "1583961758.6603", "responder_bytes": 2389, "first_seen_epoch": "1583961758.48313" }, { "bytes": 495, "stream": 20, "flow_id": "flow-4eb14507be666f37263c5ed8", "packets": 2, "transport": "udp", "last_frame": 586, "first_frame": 585, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 51014, "responder_port": 389, "initiator_bytes": 263, "last_seen_epoch": "1583961758.493534", "responder_bytes": 232, "first_seen_epoch": "1583961758.493259" }, { "bytes": 352, "stream": 21, "flow_id": "flow-d37837d2d22d6d5df604e11a", "packets": 2, "transport": "udp", "last_frame": 604, "first_frame": 592, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 55478, "responder_port": 53, "initiator_bytes": 94, "last_seen_epoch": "1583961758.615654", "responder_bytes": 258, "first_seen_epoch": "1583961758.579463" }, { "bytes": 7270, "stream": 30, "flow_id": "flow-65ebaf9f1468a4e4d4c4dd7d", "packets": 19, "transport": "tcp", "last_frame": 631, "first_frame": 593, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 49702, "responder_port": 389, "initiator_bytes": 3310, "last_seen_epoch": "1583961758.637645", "responder_bytes": 3960, "first_seen_epoch": "1583961758.611294" }, { "bytes": 9401, "stream": 31, "flow_id": "flow-453db3a15c9fae5f9b5e3ea5", "packets": 21, "transport": "tcp", "last_frame": 656, "first_frame": 605, "initiator_ip": "10.3.11.218", "responder_ip": "23.4.97.247", "initiator_port": 49703, "responder_port": 443, "initiator_bytes": 1116, "last_seen_epoch": "1583961759.008477", "responder_bytes": 8285, "first_seen_epoch": "1583961758.616386" }, { "bytes": 6802, "stream": 32, "flow_id": "flow-c571f08c71e808edbd69903c", "packets": 18, "transport": "tcp", "last_frame": 629, "first_frame": 612, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 49704, "responder_port": 389, "initiator_bytes": 2769, "last_seen_epoch": "1583961758.634181", "responder_bytes": 4033, "first_seen_epoch": "1583961758.624812" }, { "bytes": 352, "stream": 22, "flow_id": "flow-ea906075503af044b0989771", "packets": 2, "transport": "udp", "last_frame": 657, "first_frame": 654, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 59815, "responder_port": 53, "initiator_bytes": 94, "last_seen_epoch": "1583961759.040026", "responder_bytes": 258, "first_seen_epoch": "1583961758.998718" }, { "bytes": 9333, "stream": 33, "flow_id": "flow-60dc93c89e972677de43840d", "packets": 22, "transport": "tcp", "last_frame": 682, "first_frame": 658, "initiator_ip": "10.3.11.218", "responder_ip": "23.4.97.247", "initiator_port": 49705, "responder_port": 443, "initiator_bytes": 1376, "last_seen_epoch": "1583961759.299885", "responder_bytes": 7957, "first_seen_epoch": "1583961759.042628" }, { "bytes": 1215, "stream": 23, "flow_id": "flow-85b9c59439e107d1ab1db0bc", "packets": 5, "transport": "udp", "last_frame": 30098, "first_frame": 659, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.255", "initiator_port": 138, "responder_port": 138, "initiator_bytes": 1215, "last_seen_epoch": "1583963914.37971", "responder_bytes": 0, "first_seen_epoch": "1583961759.046463" }, { "bytes": 360, "stream": 24, "flow_id": "flow-a0a750c89fc20b335ce8e1da", "packets": 2, "transport": "udp", "last_frame": 683, "first_frame": 679, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 62899, "responder_port": 53, "initiator_bytes": 96, "last_seen_epoch": "1583961759.326791", "responder_bytes": 264, "first_seen_epoch": "1583961759.292702" }, { "bytes": 9324, "stream": 34, "flow_id": "flow-e2a3e144acaaf5cb93ae96d9", "packets": 22, "transport": "tcp", "last_frame": 721, "first_frame": 680, "initiator_ip": "10.3.11.218", "responder_ip": "23.4.97.247", "initiator_port": 49706, "responder_port": 443, "initiator_bytes": 1376, "last_seen_epoch": "1583961759.629751", "responder_bytes": 7948, "first_seen_epoch": "1583961759.299111" }, { "bytes": 9045, "stream": 35, "flow_id": "flow-e75e64b8942f05752c3fb172", "packets": 22, "transport": "tcp", "last_frame": 759, "first_frame": 684, "initiator_ip": "10.3.11.218", "responder_ip": "23.4.97.247", "initiator_port": 49707, "responder_port": 443, "initiator_bytes": 1368, "last_seen_epoch": "1583961759.81818", "responder_bytes": 7677, "first_seen_epoch": "1583961759.3276" }, { "bytes": 9044, "stream": 36, "flow_id": "flow-8836eb08942f16710d583b65", "packets": 22, "transport": "tcp", "last_frame": 788, "first_frame": 717, "initiator_ip": "10.3.11.218", "responder_ip": "23.4.97.247", "initiator_port": 49708, "responder_port": 443, "initiator_bytes": 1368, "last_seen_epoch": "1583961760.02129", "responder_bytes": 7676, "first_seen_epoch": "1583961759.590147" }, { "bytes": 9233, "stream": 37, "flow_id": "flow-23c9f06da7da29a13cb26860", "packets": 21, "transport": "tcp", "last_frame": 787, "first_frame": 718, "initiator_ip": "10.3.11.218", "responder_ip": "23.4.97.247", "initiator_port": 49709, "responder_port": 443, "initiator_bytes": 1323, "last_seen_epoch": "1583961760.021229", "responder_bytes": 7910, "first_seen_epoch": "1583961759.593328" }, { "bytes": 210, "stream": 25, "flow_id": "flow-09cb31f482fa0240daab563d", "packets": 2, "transport": "udp", "last_frame": 753, "first_frame": 752, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 55249, "responder_port": 53, "initiator_bytes": 97, "last_seen_epoch": "1583961759.735456", "responder_bytes": 113, "first_seen_epoch": "1583961759.710732" }, { "bytes": 5799, "stream": 38, "flow_id": "flow-d1e8256a4acfd19857457451", "packets": 28, "transport": "tcp", "last_frame": 8061, "first_frame": 754, "initiator_ip": "10.3.11.218", "responder_ip": "52.161.15.246", "initiator_port": 49710, "responder_port": 443, "initiator_bytes": 1949, "last_seen_epoch": "1583961869.750176", "responder_bytes": 3850, "first_seen_epoch": "1583961759.736052" }, { "bytes": 5689, "stream": 39, "flow_id": "flow-351de5e212995f7568e08133", "packets": 26, "transport": "tcp", "last_frame": 8065, "first_frame": 778, "initiator_ip": "10.3.11.218", "responder_ip": "52.161.15.246", "initiator_port": 49711, "responder_port": 443, "initiator_bytes": 1893, "last_seen_epoch": "1583961870.016911", "responder_bytes": 3796, "first_seen_epoch": "1583961759.924876" }, { "bytes": 8991, "stream": 40, "flow_id": "flow-f2d5057e8984a276a32e1d28", "packets": 21, "transport": "tcp", "last_frame": 872, "first_frame": 779, "initiator_ip": "10.3.11.218", "responder_ip": "23.4.97.247", "initiator_port": 49712, "responder_port": 443, "initiator_bytes": 1315, "last_seen_epoch": "1583961760.486952", "responder_bytes": 7676, "first_seen_epoch": "1583961759.935359" }, { "bytes": 9291, "stream": 41, "flow_id": "flow-7b81be174c5a1f667028f8d7", "packets": 22, "transport": "tcp", "last_frame": 859, "first_frame": 780, "initiator_ip": "10.3.11.218", "responder_ip": "23.4.97.247", "initiator_port": 49713, "responder_port": 443, "initiator_bytes": 1376, "last_seen_epoch": "1583961760.429528", "responder_bytes": 7915, "first_seen_epoch": "1583961759.935612" }, { "bytes": 9044, "stream": 42, "flow_id": "flow-9bcb5efcc200385c578143ce", "packets": 22, "transport": "tcp", "last_frame": 900, "first_frame": 855, "initiator_ip": "10.3.11.218", "responder_ip": "23.4.97.247", "initiator_port": 49714, "responder_port": 443, "initiator_bytes": 1368, "last_seen_epoch": "1583961760.823755", "responder_bytes": 7676, "first_seen_epoch": "1583961760.419237" }, { "bytes": 210, "stream": 26, "flow_id": "flow-dd7366848bfb276973d1b18d", "packets": 2, "transport": "udp", "last_frame": 863, "first_frame": 862, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 52452, "responder_port": 53, "initiator_bytes": 97, "last_seen_epoch": "1583961760.453103", "responder_bytes": 113, "first_seen_epoch": "1583961760.436616" }, { "bytes": 5793, "stream": 43, "flow_id": "flow-1345c698ff2def72bad16aff", "packets": 28, "transport": "tcp", "last_frame": 8139, "first_frame": 864, "initiator_ip": "10.3.11.218", "responder_ip": "13.78.177.144", "initiator_port": 49715, "responder_port": 443, "initiator_bytes": 1943, "last_seen_epoch": "1583961870.510389", "responder_bytes": 3850, "first_seen_epoch": "1583961760.453887" }, { "bytes": 5686, "stream": 44, "flow_id": "flow-7ea639ea42944c4d7bee42a5", "packets": 26, "transport": "tcp", "last_frame": 8164, "first_frame": 898, "initiator_ip": "10.3.11.218", "responder_ip": "52.161.15.246", "initiator_port": 49716, "responder_port": 443, "initiator_bytes": 1890, "last_seen_epoch": "1583961870.888242", "responder_bytes": 3796, "first_seen_epoch": "1583961760.811644" }, { "bytes": 8279, "stream": 45, "flow_id": "flow-a25111fddd61f0a1f980f034", "packets": 26, "transport": "tcp", "last_frame": 1009, "first_frame": 939, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 49717, "responder_port": 389, "initiator_bytes": 3909, "last_seen_epoch": "1583961764.322996", "responder_bytes": 4370, "first_seen_epoch": "1583961764.275573" }, { "bytes": 4429, "stream": 46, "flow_id": "flow-1ab13aafd2c7eb1eb4d3ff66", "packets": 15, "transport": "tcp", "last_frame": 1005, "first_frame": 960, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 49718, "responder_port": 389, "initiator_bytes": 3563, "last_seen_epoch": "1583961764.321872", "responder_bytes": 866, "first_seen_epoch": "1583961764.299696" }, { "bytes": 940, "stream": 47, "flow_id": "flow-a36a2fa7a5d512d26d20fa5a", "packets": 8, "transport": "tcp", "last_frame": 978, "first_frame": 970, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 49719, "responder_port": 88, "initiator_bytes": 472, "last_seen_epoch": "1583961764.313994", "responder_bytes": 468, "first_seen_epoch": "1583961764.312583" }, { "bytes": 2512, "stream": 48, "flow_id": "flow-50c23c3fff86b8c7aa9652b4", "packets": 10, "transport": "tcp", "last_frame": 987, "first_frame": 977, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 49720, "responder_port": 88, "initiator_bytes": 606, "last_seen_epoch": "1583961764.315659", "responder_bytes": 1906, "first_seen_epoch": "1583961764.313981" }, { "bytes": 3868, "stream": 49, "flow_id": "flow-2e054dae0c1c211210304ded", "packets": 12, "transport": "tcp", "last_frame": 999, "first_frame": 988, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 49721, "responder_port": 88, "initiator_bytes": 1951, "last_seen_epoch": "1583961764.317758", "responder_bytes": 1917, "first_seen_epoch": "1583961764.315952" }, { "bytes": 972, "stream": 27, "flow_id": "flow-5b406721bed037ddefc28b30", "packets": 6, "transport": "udp", "last_frame": 30066, "first_frame": 1010, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 123, "responder_port": 123, "initiator_bytes": 486, "last_seen_epoch": "1583963813.433596", "responder_bytes": 486, "first_seen_epoch": "1583961764.526604" }, { "bytes": 298, "stream": 28, "flow_id": "flow-c042c0feb0b81c351b9a8077", "packets": 2, "transport": "udp", "last_frame": 1019, "first_frame": 1016, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 57241, "responder_port": 53, "initiator_bytes": 90, "last_seen_epoch": "1583961766.602814", "responder_bytes": 208, "first_seen_epoch": "1583961766.480352" }, { "bytes": 10748, "stream": 50, "flow_id": "flow-a72327ba7b0049cc777acfae", "packets": 29, "transport": "tcp", "last_frame": 8609, "first_frame": 1020, "initiator_ip": "10.3.11.218", "responder_ip": "52.114.77.34", "initiator_port": 49722, "responder_port": 443, "initiator_bytes": 3372, "last_seen_epoch": "1583961876.103552", "responder_bytes": 7376, "first_seen_epoch": "1583961766.606521" }, { "bytes": 233, "stream": 29, "flow_id": "flow-1342de2afcba5126be830720", "packets": 2, "transport": "udp", "last_frame": 1046, "first_frame": 1045, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 65203, "responder_port": 53, "initiator_bytes": 79, "last_seen_epoch": "1583961769.280053", "responder_bytes": 154, "first_seen_epoch": "1583961769.278542" }, { "bytes": 219, "stream": 51, "flow_id": "flow-37f6b31b150dbff74c88e2e9", "packets": 4, "transport": "tcp", "last_frame": 1065, "first_frame": 1049, "initiator_ip": "10.3.11.3", "responder_ip": "10.3.11.194", "initiator_port": 445, "responder_port": 49714, "initiator_bytes": 165, "last_seen_epoch": "1583961779.44951", "responder_bytes": 54, "first_seen_epoch": "1583961775.448389" }, { "bytes": 960, "stream": 30, "flow_id": "flow-1798a5c3a5e0d5161e8aed83", "packets": 12, "transport": "udp", "last_frame": 16350, "first_frame": 1055, "initiator_ip": "10.3.11.194", "responder_ip": "224.0.0.251", "initiator_port": 5353, "responder_port": 5353, "initiator_bytes": 960, "last_seen_epoch": "1583962544.990373", "responder_bytes": 0, "first_seen_epoch": "1583961778.958984" }, { "bytes": 74, "stream": 31, "flow_id": "flow-b33d209ee6913a3d21ac17b6", "packets": 1, "transport": "udp", "last_frame": 1056, "first_frame": 1056, "initiator_ip": "10.3.11.194", "responder_ip": "224.0.0.252", "initiator_port": 65224, "responder_port": 5355, "initiator_bytes": 74, "last_seen_epoch": "1583961778.962152", "responder_bytes": 0, "first_seen_epoch": "1583961778.962152" }, { "bytes": 74, "stream": 32, "flow_id": "flow-b3e64c5103ff99d2e48b38bf", "packets": 1, "transport": "udp", "last_frame": 1062, "first_frame": 1062, "initiator_ip": "10.3.11.194", "responder_ip": "224.0.0.252", "initiator_port": 50759, "responder_port": 5355, "initiator_bytes": 74, "last_seen_epoch": "1583961778.991213", "responder_bytes": 0, "first_seen_epoch": "1583961778.991213" }, { "bytes": 254, "stream": 33, "flow_id": "flow-9b8513d5ba1ca84a23bc04a5", "packets": 2, "transport": "udp", "last_frame": 1067, "first_frame": 1066, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 52822, "responder_port": 53, "initiator_bytes": 95, "last_seen_epoch": "1583961779.625644", "responder_bytes": 159, "first_seen_epoch": "1583961779.625226" }, { "bytes": 192, "stream": 34, "flow_id": "flow-16d1745789e5ae0eb6d12e77", "packets": 2, "transport": "udp", "last_frame": 1069, "first_frame": 1068, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 52164, "responder_port": 53, "initiator_bytes": 88, "last_seen_epoch": "1583961779.658607", "responder_bytes": 104, "first_seen_epoch": "1583961779.658177" }, { "bytes": 494, "stream": 35, "flow_id": "flow-51d5d2e04b7c712cd71fdae9", "packets": 2, "transport": "udp", "last_frame": 1071, "first_frame": 1070, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 52166, "responder_port": 389, "initiator_bytes": 262, "last_seen_epoch": "1583961779.675864", "responder_bytes": 232, "first_seen_epoch": "1583961779.675479" }, { "bytes": 6013, "stream": 52, "flow_id": "flow-21ff2bf756b41ecb39e09e95", "packets": 13, "transport": "tcp", "last_frame": 1179, "first_frame": 1072, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 49668, "responder_port": 389, "initiator_bytes": 2694, "last_seen_epoch": "1583961781.238975", "responder_bytes": 3319, "first_seen_epoch": "1583961779.868853" }, { "bytes": 168, "stream": 36, "flow_id": "flow-ac6572dace65f0ac59cf239a", "packets": 2, "transport": "udp", "last_frame": 1080, "first_frame": 1079, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 60382, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1583961779.95082", "responder_bytes": 92, "first_seen_epoch": "1583961779.925743" }, { "bytes": 233, "stream": 37, "flow_id": "flow-df6ce926f25fcf8aecf1a243", "packets": 2, "transport": "udp", "last_frame": 1082, "first_frame": 1081, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 54129, "responder_port": 53, "initiator_bytes": 79, "last_seen_epoch": "1583961780.297613", "responder_bytes": 154, "first_seen_epoch": "1583961780.297336" }, { "bytes": 3620, "stream": 38, "flow_id": "flow-c30960ad8cd6640475b9c86a", "packets": 37, "transport": "udp", "last_frame": 21106, "first_frame": 1083, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.255", "initiator_port": 137, "responder_port": 137, "initiator_bytes": 3620, "last_seen_epoch": "1583962641.704786", "responder_bytes": 0, "first_seen_epoch": "1583961780.312982" }, { "bytes": 128, "stream": 39, "flow_id": "flow-4e09dac1fa3239e5a12cda08", "packets": 2, "transport": "udp", "last_frame": 1089, "first_frame": 1086, "initiator_ip": "10.3.11.194", "responder_ip": "224.0.0.252", "initiator_port": 51166, "responder_port": 5355, "initiator_bytes": 128, "last_seen_epoch": "1583961780.723011", "responder_bytes": 0, "first_seen_epoch": "1583961780.314297" }, { "bytes": 128, "stream": 40, "flow_id": "flow-678f6ea3331fcf61aa8db817", "packets": 2, "transport": "udp", "last_frame": 1088, "first_frame": 1087, "initiator_ip": "10.3.11.194", "responder_ip": "224.0.0.252", "initiator_port": 51577, "responder_port": 5355, "initiator_bytes": 128, "last_seen_epoch": "1583961780.722736", "responder_bytes": 0, "first_seen_epoch": "1583961780.314594" }, { "bytes": 316, "stream": 41, "flow_id": "flow-c82c534acff0f3564cee6c06", "packets": 2, "transport": "udp", "last_frame": 1093, "first_frame": 1092, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 56441, "responder_port": 53, "initiator_bytes": 126, "last_seen_epoch": "1583961780.815765", "responder_bytes": 190, "first_seen_epoch": "1583961780.815447" }, { "bytes": 495, "stream": 42, "flow_id": "flow-63d19474b78e33c34835a09d", "packets": 2, "transport": "udp", "last_frame": 1095, "first_frame": 1094, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 56443, "responder_port": 389, "initiator_bytes": 263, "last_seen_epoch": "1583961780.955807", "responder_bytes": 232, "first_seen_epoch": "1583961780.955471" }, { "bytes": 560, "stream": 43, "flow_id": "flow-93c2d1e5e23edfac80d3b497", "packets": 2, "transport": "udp", "last_frame": 1100, "first_frame": 1096, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 56444, "responder_port": 389, "initiator_bytes": 308, "last_seen_epoch": "1583961781.054131", "responder_bytes": 252, "first_seen_epoch": "1583961781.053641" }, { "bytes": 538, "stream": 44, "flow_id": "flow-30e49a2c0f671bef22a3a589", "packets": 2, "transport": "udp", "last_frame": 1098, "first_frame": 1097, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 56445, "responder_port": 389, "initiator_bytes": 306, "last_seen_epoch": "1583961781.05407", "responder_bytes": 232, "first_seen_epoch": "1583961781.05374" }, { "bytes": 324, "stream": 45, "flow_id": "flow-6b42cda5c6da2e2477e879b0", "packets": 2, "transport": "udp", "last_frame": 1101, "first_frame": 1099, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 50240, "responder_port": 53, "initiator_bytes": 130, "last_seen_epoch": "1583961781.054298", "responder_bytes": 194, "first_seen_epoch": "1583961781.054072" }, { "bytes": 494, "stream": 46, "flow_id": "flow-c12be1f179ce0dd282309347", "packets": 2, "transport": "udp", "last_frame": 1104, "first_frame": 1103, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 50241, "responder_port": 389, "initiator_bytes": 262, "last_seen_epoch": "1583961781.083727", "responder_bytes": 232, "first_seen_epoch": "1583961781.083215" }, { "bytes": 3778, "stream": 53, "flow_id": "flow-1a23088c454549bfcd6170cc", "packets": 25, "transport": "tcp", "last_frame": 4154, "first_frame": 1105, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 49671, "responder_port": 135, "initiator_bytes": 1990, "last_seen_epoch": "1583961837.983916", "responder_bytes": 1788, "first_seen_epoch": "1583961781.173527" }, { "bytes": 4554, "stream": 54, "flow_id": "flow-67b3c3b72839e125b30288ee", "packets": 21, "transport": "tcp", "last_frame": 2465, "first_frame": 1112, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 49672, "responder_port": 49671, "initiator_bytes": 2672, "last_seen_epoch": "1583961807.982662", "responder_bytes": 1882, "first_seen_epoch": "1583961781.176289" }, { "bytes": 922, "stream": 55, "flow_id": "flow-27d76336eb2ac68c20af2e3a", "packets": 8, "transport": "tcp", "last_frame": 1134, "first_frame": 1127, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 49673, "responder_port": 88, "initiator_bytes": 471, "last_seen_epoch": "1583961781.186019", "responder_bytes": 451, "first_seen_epoch": "1583961781.184963" }, { "bytes": 2511, "stream": 56, "flow_id": "flow-30f03a10315485a92b72309e", "packets": 10, "transport": "tcp", "last_frame": 1145, "first_frame": 1136, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 49674, "responder_port": 88, "initiator_bytes": 605, "last_seen_epoch": "1583961781.202131", "responder_bytes": 1906, "first_seen_epoch": "1583961781.199689" }, { "bytes": 4019, "stream": 57, "flow_id": "flow-1f8ea1399f3b2ff5359ed453", "packets": 12, "transport": "tcp", "last_frame": 1162, "first_frame": 1150, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 49675, "responder_port": 88, "initiator_bytes": 2020, "last_seen_epoch": "1583961781.227378", "responder_bytes": 1999, "first_seen_epoch": "1583961781.224745" }, { "bytes": 19986, "stream": 58, "flow_id": "flow-d2b0966a42b73cb7ca487f31", "packets": 62, "transport": "tcp", "last_frame": 4153, "first_frame": 1161, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 49676, "responder_port": 49667, "initiator_bytes": 13680, "last_seen_epoch": "1583961837.983741", "responder_bytes": 6306, "first_seen_epoch": "1583961781.227329" }, { "bytes": 922, "stream": 59, "flow_id": "flow-59795c658bcd1866426bcadb", "packets": 8, "transport": "tcp", "last_frame": 1176, "first_frame": 1165, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 49677, "responder_port": 88, "initiator_bytes": 471, "last_seen_epoch": "1583961781.231302", "responder_bytes": 451, "first_seen_epoch": "1583961781.229449" }, { "bytes": 2511, "stream": 60, "flow_id": "flow-2b77f7c4c1c4ec97ea320a64", "packets": 10, "transport": "tcp", "last_frame": 1189, "first_frame": 1180, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 49678, "responder_port": 88, "initiator_bytes": 605, "last_seen_epoch": "1583961781.244101", "responder_bytes": 1906, "first_seen_epoch": "1583961781.242244" }, { "bytes": 1654, "stream": 61, "flow_id": "flow-c0ae29768591ecd0d9d94d3a", "packets": 12, "transport": "tcp", "last_frame": 2464, "first_frame": 1190, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 49679, "responder_port": 49667, "initiator_bytes": 884, "last_seen_epoch": "1583961807.982552", "responder_bytes": 770, "first_seen_epoch": "1583961781.246234" }, { "bytes": 4019, "stream": 62, "flow_id": "flow-075bac6bad4f1e9ee7f4557c", "packets": 12, "transport": "tcp", "last_frame": 1209, "first_frame": 1198, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 49680, "responder_port": 88, "initiator_bytes": 2020, "last_seen_epoch": "1583961781.251348", "responder_bytes": 1999, "first_seen_epoch": "1583961781.248962" }, { "bytes": 9854, "stream": 63, "flow_id": "flow-6dadf7f81cf3753a063a4f2b", "packets": 32, "transport": "tcp", "last_frame": 1358, "first_frame": 1236, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 49681, "responder_port": 389, "initiator_bytes": 4753, "last_seen_epoch": "1583961781.706875", "responder_bytes": 5101, "first_seen_epoch": "1583961781.263023" }, { "bytes": 326, "stream": 47, "flow_id": "flow-ff31bc4ead989c9b99fe9852", "packets": 2, "transport": "udp", "last_frame": 1252, "first_frame": 1251, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 60748, "responder_port": 53, "initiator_bytes": 131, "last_seen_epoch": "1583961781.271226", "responder_bytes": 195, "first_seen_epoch": "1583961781.270958" }, { "bytes": 477, "stream": 48, "flow_id": "flow-e878f860a802b96f2134eb31", "packets": 2, "transport": "udp", "last_frame": 1254, "first_frame": 1253, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 60749, "responder_port": 389, "initiator_bytes": 241, "last_seen_epoch": "1583961781.272378", "responder_bytes": 236, "first_seen_epoch": "1583961781.272092" }, { "bytes": 348, "stream": 64, "flow_id": "flow-27ea38b9388a423bc705bd19", "packets": 6, "transport": "tcp", "last_frame": 1267, "first_frame": 1259, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 49682, "responder_port": 389, "initiator_bytes": 174, "last_seen_epoch": "1583961781.396908", "responder_bytes": 174, "first_seen_epoch": "1583961781.38935" }, { "bytes": 326, "stream": 49, "flow_id": "flow-5e043037833d06da4124da24", "packets": 2, "transport": "udp", "last_frame": 1271, "first_frame": 1270, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 65008, "responder_port": 53, "initiator_bytes": 131, "last_seen_epoch": "1583961781.422599", "responder_bytes": 195, "first_seen_epoch": "1583961781.42237" }, { "bytes": 255, "stream": 50, "flow_id": "flow-777418835e5f7f7337ed7180", "packets": 2, "transport": "udp", "last_frame": 1273, "first_frame": 1272, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 64541, "responder_port": 53, "initiator_bytes": 90, "last_seen_epoch": "1583961781.432752", "responder_bytes": 165, "first_seen_epoch": "1583961781.432375" }, { "bytes": 44145, "stream": 65, "flow_id": "flow-c408c739927590f910e77599", "packets": 169, "transport": "tcp", "last_frame": 11188, "first_frame": 1274, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 49683, "responder_port": 445, "initiator_bytes": 22848, "last_seen_epoch": "1583961964.409726", "responder_bytes": 21297, "first_seen_epoch": "1583961781.437116" }, { "bytes": 3987, "stream": 66, "flow_id": "flow-b66ce3f9968a711f47538c04", "packets": 12, "transport": "tcp", "last_frame": 1292, "first_frame": 1281, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 49684, "responder_port": 88, "initiator_bytes": 2004, "last_seen_epoch": "1583961781.47116", "responder_bytes": 1983, "first_seen_epoch": "1583961781.468892" }, { "bytes": 3627, "stream": 67, "flow_id": "flow-0f0b996f1c7d9baa06f7c73f", "packets": 12, "transport": "tcp", "last_frame": 1304, "first_frame": 1293, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 49685, "responder_port": 88, "initiator_bytes": 1799, "last_seen_epoch": "1583961781.472677", "responder_bytes": 1828, "first_seen_epoch": "1583961781.471277" }, { "bytes": 477, "stream": 51, "flow_id": "flow-5614ee0314710e86e53ea265", "packets": 2, "transport": "udp", "last_frame": 1315, "first_frame": 1314, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 64542, "responder_port": 389, "initiator_bytes": 241, "last_seen_epoch": "1583961781.482494", "responder_bytes": 236, "first_seen_epoch": "1583961781.482016" }, { "bytes": 348, "stream": 68, "flow_id": "flow-c79c066fe12f2cd1cc218bc9", "packets": 6, "transport": "tcp", "last_frame": 1330, "first_frame": 1324, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 49686, "responder_port": 389, "initiator_bytes": 174, "last_seen_epoch": "1583961781.592", "responder_bytes": 174, "first_seen_epoch": "1583961781.590847" }, { "bytes": 296, "stream": 52, "flow_id": "flow-f96952187ae3562bf7f6fae8", "packets": 2, "transport": "udp", "last_frame": 1333, "first_frame": 1332, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 52588, "responder_port": 53, "initiator_bytes": 116, "last_seen_epoch": "1583961781.592936", "responder_bytes": 180, "first_seen_epoch": "1583961781.592695" }, { "bytes": 494, "stream": 53, "flow_id": "flow-ee11b7dc0ef9c1af08339fe9", "packets": 2, "transport": "udp", "last_frame": 1335, "first_frame": 1334, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 52589, "responder_port": 389, "initiator_bytes": 262, "last_seen_epoch": "1583961781.593867", "responder_bytes": 232, "first_seen_epoch": "1583961781.593554" }, { "bytes": 348, "stream": 69, "flow_id": "flow-1734abbcb68a069716014274", "packets": 6, "transport": "tcp", "last_frame": 1343, "first_frame": 1337, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 49687, "responder_port": 389, "initiator_bytes": 174, "last_seen_epoch": "1583961781.701872", "responder_bytes": 174, "first_seen_epoch": "1583961781.700541" }, { "bytes": 348, "stream": 70, "flow_id": "flow-19e0c6c21871c6fbbf88f0c3", "packets": 6, "transport": "tcp", "last_frame": 1350, "first_frame": 1345, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 49688, "responder_port": 389, "initiator_bytes": 174, "last_seen_epoch": "1583961781.704059", "responder_bytes": 174, "first_seen_epoch": "1583961781.703044" }, { "bytes": 192, "stream": 54, "flow_id": "flow-9e9a042f6c56fc3e41f461da", "packets": 2, "transport": "udp", "last_frame": 1379, "first_frame": 1378, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 53850, "responder_port": 53, "initiator_bytes": 88, "last_seen_epoch": "1583961781.878882", "responder_bytes": 104, "first_seen_epoch": "1583961781.878568" }, { "bytes": 8923, "stream": 71, "flow_id": "flow-f303bc01571f6cdb728dab47", "packets": 21, "transport": "tcp", "last_frame": 1578, "first_frame": 1381, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 49690, "responder_port": 389, "initiator_bytes": 3730, "last_seen_epoch": "1583961782.5212", "responder_bytes": 5193, "first_seen_epoch": "1583961782.227981" }, { "bytes": 3930, "stream": 72, "flow_id": "flow-5f59ef43e389d908550d7ebb", "packets": 12, "transport": "tcp", "last_frame": 1411, "first_frame": 1400, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 49691, "responder_port": 88, "initiator_bytes": 1985, "last_seen_epoch": "1583961782.254146", "responder_bytes": 1945, "first_seen_epoch": "1583961782.250788" }, { "bytes": 3710, "stream": 73, "flow_id": "flow-865c0f9b3e4cc1dbcc843d84", "packets": 16, "transport": "tcp", "last_frame": 1574, "first_frame": 1415, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 49692, "responder_port": 389, "initiator_bytes": 2804, "last_seen_epoch": "1583961782.505166", "responder_bytes": 906, "first_seen_epoch": "1583961782.263836" }, { "bytes": 4019, "stream": 74, "flow_id": "flow-10a950e840d9a37db2daac7d", "packets": 12, "transport": "tcp", "last_frame": 1443, "first_frame": 1432, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 49693, "responder_port": 88, "initiator_bytes": 2020, "last_seen_epoch": "1583961782.407328", "responder_bytes": 1999, "first_seen_epoch": "1583961782.405134" }, { "bytes": 3627, "stream": 75, "flow_id": "flow-bb9b52a3c415ddfd719b0a22", "packets": 12, "transport": "tcp", "last_frame": 1455, "first_frame": 1444, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 49694, "responder_port": 88, "initiator_bytes": 1799, "last_seen_epoch": "1583961782.408857", "responder_bytes": 1828, "first_seen_epoch": "1583961782.407452" }, { "bytes": 890, "stream": 76, "flow_id": "flow-e493ca90d324159a655f4956", "packets": 8, "transport": "tcp", "last_frame": 1590, "first_frame": 1583, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 49723, "responder_port": 88, "initiator_bytes": 464, "last_seen_epoch": "1583961783.083245", "responder_bytes": 426, "first_seen_epoch": "1583961783.075944" }, { "bytes": 2529, "stream": 77, "flow_id": "flow-f54b2157fc54e0fbc8a68516", "packets": 10, "transport": "tcp", "last_frame": 1600, "first_frame": 1591, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 49724, "responder_port": 88, "initiator_bytes": 598, "last_seen_epoch": "1583961783.091851", "responder_bytes": 1931, "first_seen_epoch": "1583961783.090017" }, { "bytes": 3811, "stream": 78, "flow_id": "flow-339da235953eda09ebfb536d", "packets": 12, "transport": "tcp", "last_frame": 1612, "first_frame": 1601, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 49725, "responder_port": 88, "initiator_bytes": 1890, "last_seen_epoch": "1583961783.095281", "responder_bytes": 1921, "first_seen_epoch": "1583961783.092574" }, { "bytes": 1292, "stream": 79, "flow_id": "flow-55d30f91b5a6e93ae996b05d", "packets": 12, "transport": "tcp", "last_frame": 2511, "first_frame": 1613, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 49726, "responder_port": 135, "initiator_bytes": 730, "last_seen_epoch": "1583961812.245274", "responder_bytes": 562, "first_seen_epoch": "1583961783.458067" }, { "bytes": 164, "stream": 55, "flow_id": "flow-3c729f2c000f5e389f111cd4", "packets": 2, "transport": "udp", "last_frame": 1621, "first_frame": 1620, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 64680, "responder_port": 53, "initiator_bytes": 74, "last_seen_epoch": "1583961783.464014", "responder_bytes": 90, "first_seen_epoch": "1583961783.463628" }, { "bytes": 4103, "stream": 80, "flow_id": "flow-0f75f5028f90961dd8af9034", "packets": 12, "transport": "tcp", "last_frame": 1634, "first_frame": 1622, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 49727, "responder_port": 88, "initiator_bytes": 2062, "last_seen_epoch": "1583961783.48191", "responder_bytes": 2041, "first_seen_epoch": "1583961783.479648" }, { "bytes": 14179, "stream": 81, "flow_id": "flow-d6ec5692a7680a0dffb68816", "packets": 61, "transport": "tcp", "last_frame": 2068, "first_frame": 1649, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 49728, "responder_port": 445, "initiator_bytes": 6987, "last_seen_epoch": "1583961798.761697", "responder_bytes": 7192, "first_seen_epoch": "1583961783.490361" }, { "bytes": 2362, "stream": 82, "flow_id": "flow-b66ac20b3ec4d5a1860c4ef9", "packets": 10, "transport": "tcp", "last_frame": 1665, "first_frame": 1656, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 49729, "responder_port": 88, "initiator_bytes": 1978, "last_seen_epoch": "1583961783.501961", "responder_bytes": 384, "first_seen_epoch": "1583961783.499935" }, { "bytes": 12859, "stream": 83, "flow_id": "flow-956f717bc6cd62e29d896cdb", "packets": 82, "transport": "tcp", "last_frame": 29754, "first_frame": 1717, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 49730, "responder_port": 445, "initiator_bytes": 8121, "last_seen_epoch": "1583963199.543184", "responder_bytes": 4738, "first_seen_epoch": "1583961783.69844" }, { "bytes": 4026, "stream": 84, "flow_id": "flow-262c8a6a84b9318e93708c73", "packets": 12, "transport": "tcp", "last_frame": 1735, "first_frame": 1724, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 49731, "responder_port": 88, "initiator_bytes": 2031, "last_seen_epoch": "1583961783.706536", "responder_bytes": 1995, "first_seen_epoch": "1583961783.704176" }, { "bytes": 3711, "stream": 85, "flow_id": "flow-6f3ffbb73a9e6716f74a3885", "packets": 12, "transport": "tcp", "last_frame": 1747, "first_frame": 1736, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 49732, "responder_port": 88, "initiator_bytes": 1841, "last_seen_epoch": "1583961783.708294", "responder_bytes": 1870, "first_seen_epoch": "1583961783.706701" }, { "bytes": 4211, "stream": 86, "flow_id": "flow-129dfdf580bc8ed3dcccf3f3", "packets": 14, "transport": "tcp", "last_frame": 1798, "first_frame": 1761, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 49733, "responder_port": 389, "initiator_bytes": 3137, "last_seen_epoch": "1583961784.21592", "responder_bytes": 1074, "first_seen_epoch": "1583961783.841609" }, { "bytes": 3776, "stream": 87, "flow_id": "flow-5264bae5b99772f73d20b60e", "packets": 16, "transport": "tcp", "last_frame": 1796, "first_frame": 1770, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 49734, "responder_port": 389, "initiator_bytes": 2870, "last_seen_epoch": "1583961784.208371", "responder_bytes": 906, "first_seen_epoch": "1583961783.85347" }, { "bytes": 255, "stream": 56, "flow_id": "flow-a355da9627852ebe180accf8", "packets": 2, "transport": "udp", "last_frame": 1789, "first_frame": 1788, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 56522, "responder_port": 53, "initiator_bytes": 89, "last_seen_epoch": "1583961783.982972", "responder_bytes": 166, "first_seen_epoch": "1583961783.982644" }, { "bytes": 310, "stream": 57, "flow_id": "flow-c3add973257fba0f0c4dccf6", "packets": 2, "transport": "udp", "last_frame": 1791, "first_frame": 1790, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 59179, "responder_port": 53, "initiator_bytes": 155, "last_seen_epoch": "1583961783.986755", "responder_bytes": 155, "first_seen_epoch": "1583961783.985573" }, { "bytes": 5751, "stream": 58, "flow_id": "flow-e5860235fb1b1d8101c1fc6e", "packets": 26, "transport": "udp", "last_frame": 30099, "first_frame": 1800, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.255", "initiator_port": 138, "responder_port": 138, "initiator_bytes": 5751, "last_seen_epoch": "1583963944.745383", "responder_bytes": 0, "first_seen_epoch": "1583961785.15029" }, { "bytes": 265, "stream": 59, "flow_id": "flow-1b758de839227af564dc0462", "packets": 2, "transport": "udp", "last_frame": 1802, "first_frame": 1801, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 56564, "responder_port": 53, "initiator_bytes": 72, "last_seen_epoch": "1583961788.662452", "responder_bytes": 193, "first_seen_epoch": "1583961788.617428" }, { "bytes": 495, "stream": 60, "flow_id": "flow-0991b48f016895d8e748a346", "packets": 2, "transport": "udp", "last_frame": 1804, "first_frame": 1803, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 59180, "responder_port": 389, "initiator_bytes": 263, "last_seen_epoch": "1583961788.729286", "responder_bytes": 232, "first_seen_epoch": "1583961788.72894" }, { "bytes": 15318, "stream": 88, "flow_id": "flow-3406ef64d285a70f0c65d04b", "packets": 45, "transport": "tcp", "last_frame": 10337, "first_frame": 1805, "initiator_ip": "10.3.11.218", "responder_ip": "204.79.197.200", "initiator_port": 49735, "responder_port": 443, "initiator_bytes": 7753, "last_seen_epoch": "1583961934.952564", "responder_bytes": 7565, "first_seen_epoch": "1583961788.786049" }, { "bytes": 288, "stream": 61, "flow_id": "flow-c399fee0f0a8eb5c23ce861f", "packets": 2, "transport": "udp", "last_frame": 1820, "first_frame": 1819, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 62694, "responder_port": 53, "initiator_bytes": 79, "last_seen_epoch": "1583961789.088257", "responder_bytes": 209, "first_seen_epoch": "1583961789.054029" }, { "bytes": 6468, "stream": 89, "flow_id": "flow-dc672b972e117e005202df1c", "packets": 24, "transport": "tcp", "last_frame": 3976, "first_frame": 1825, "initiator_ip": "10.3.11.218", "responder_ip": "23.46.28.16", "initiator_port": 49736, "responder_port": 443, "initiator_bytes": 1110, "last_seen_epoch": "1583961832.734922", "responder_bytes": 5358, "first_seen_epoch": "1583961789.116252" }, { "bytes": 221, "stream": 62, "flow_id": "flow-cc06da8e136c34b65af8492b", "packets": 2, "transport": "udp", "last_frame": 1838, "first_frame": 1832, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 51624, "responder_port": 53, "initiator_bytes": 77, "last_seen_epoch": "1583961789.154954", "responder_bytes": 144, "first_seen_epoch": "1583961789.14091" }, { "bytes": 6554, "stream": 90, "flow_id": "flow-1a97863531eb02d4f0d68d76", "packets": 21, "transport": "tcp", "last_frame": 10249, "first_frame": 1839, "initiator_ip": "10.3.11.218", "responder_ip": "204.79.197.254", "initiator_port": 49737, "responder_port": 443, "initiator_bytes": 978, "last_seen_epoch": "1583961915.693876", "responder_bytes": 5576, "first_seen_epoch": "1583961789.156001" }, { "bytes": 221, "stream": 63, "flow_id": "flow-41d63cefad41d5824e9ac211", "packets": 2, "transport": "udp", "last_frame": 1860, "first_frame": 1850, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 53199, "responder_port": 53, "initiator_bytes": 77, "last_seen_epoch": "1583961789.191783", "responder_bytes": 144, "first_seen_epoch": "1583961789.179554" }, { "bytes": 6554, "stream": 91, "flow_id": "flow-6cc95e0b452fd15d97602a63", "packets": 21, "transport": "tcp", "last_frame": 10252, "first_frame": 1861, "initiator_ip": "10.3.11.218", "responder_ip": "13.107.18.254", "initiator_port": 49738, "responder_port": 443, "initiator_bytes": 978, "last_seen_epoch": "1583961916.7828", "responder_bytes": 5576, "first_seen_epoch": "1583961789.192896" }, { "bytes": 307, "stream": 64, "flow_id": "flow-ce3ea9d0fabac26416960f93", "packets": 2, "transport": "udp", "last_frame": 1867, "first_frame": 1862, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 58349, "responder_port": 53, "initiator_bytes": 80, "last_seen_epoch": "1583961789.224967", "responder_bytes": 227, "first_seen_epoch": "1583961789.198151" }, { "bytes": 303, "stream": 65, "flow_id": "flow-8e5fcb6bf2c41a1996b5a69b", "packets": 2, "transport": "udp", "last_frame": 1888, "first_frame": 1868, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 53241, "responder_port": 53, "initiator_bytes": 113, "last_seen_epoch": "1583961789.266116", "responder_bytes": 190, "first_seen_epoch": "1583961789.225566" }, { "bytes": 6289, "stream": 92, "flow_id": "flow-739662948da6c80a611a23de", "packets": 20, "transport": "tcp", "last_frame": 10253, "first_frame": 1869, "initiator_ip": "10.3.11.218", "responder_ip": "13.107.246.10", "initiator_port": 49739, "responder_port": 443, "initiator_bytes": 981, "last_seen_epoch": "1583961917.938538", "responder_bytes": 5308, "first_seen_epoch": "1583961789.226472" }, { "bytes": 431, "stream": 66, "flow_id": "flow-7410de0331bce3739ede5acf", "packets": 2, "transport": "udp", "last_frame": 1898, "first_frame": 1876, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 56313, "responder_port": 53, "initiator_bytes": 113, "last_seen_epoch": "1583961789.286717", "responder_bytes": 318, "first_seen_epoch": "1583961789.240565" }, { "bytes": 6365, "stream": 93, "flow_id": "flow-1b100ae4aae5ca98ba753303", "packets": 22, "transport": "tcp", "last_frame": 10245, "first_frame": 1889, "initiator_ip": "10.3.11.218", "responder_ip": "204.79.197.222", "initiator_port": 49740, "responder_port": 443, "initiator_bytes": 1068, "last_seen_epoch": "1583961913.946455", "responder_bytes": 5297, "first_seen_epoch": "1583961789.26784" }, { "bytes": 5029, "stream": 94, "flow_id": "flow-d924164a27bccf788d59e1ac", "packets": 14, "transport": "tcp", "last_frame": 10248, "first_frame": 1899, "initiator_ip": "10.3.11.218", "responder_ip": "52.98.73.226", "initiator_port": 49741, "responder_port": 443, "initiator_bytes": 695, "last_seen_epoch": "1583961914.886707", "responder_bytes": 4334, "first_seen_epoch": "1583961789.287366" }, { "bytes": 495, "stream": 67, "flow_id": "flow-85b958c86a215097b511eae3", "packets": 2, "transport": "udp", "last_frame": 1947, "first_frame": 1946, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 59182, "responder_port": 389, "initiator_bytes": 263, "last_seen_epoch": "1583961789.799241", "responder_bytes": 232, "first_seen_epoch": "1583961789.798885" }, { "bytes": 8279, "stream": 95, "flow_id": "flow-b8e8c4848d7478111b58a81b", "packets": 26, "transport": "tcp", "last_frame": 2009, "first_frame": 1952, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 49696, "responder_port": 389, "initiator_bytes": 3909, "last_seen_epoch": "1583961789.949945", "responder_bytes": 4370, "first_seen_epoch": "1583961789.905135" }, { "bytes": 940, "stream": 96, "flow_id": "flow-6460a9bd1cebadc1e7b06656", "packets": 8, "transport": "tcp", "last_frame": 1982, "first_frame": 1975, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 49697, "responder_port": 88, "initiator_bytes": 472, "last_seen_epoch": "1583961789.926885", "responder_bytes": 468, "first_seen_epoch": "1583961789.925195" }, { "bytes": 2512, "stream": 97, "flow_id": "flow-665c90fff6432cbc8ddd2d85", "packets": 10, "transport": "tcp", "last_frame": 1992, "first_frame": 1983, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 49698, "responder_port": 88, "initiator_bytes": 606, "last_seen_epoch": "1583961789.929312", "responder_bytes": 1906, "first_seen_epoch": "1583961789.927024" }, { "bytes": 3868, "stream": 98, "flow_id": "flow-af9d49a83f633964110a114e", "packets": 12, "transport": "tcp", "last_frame": 2004, "first_frame": 1993, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 49699, "responder_port": 88, "initiator_bytes": 1951, "last_seen_epoch": "1583961789.931665", "responder_bytes": 1917, "first_seen_epoch": "1583961789.929533" }, { "bytes": 972, "stream": 68, "flow_id": "flow-edef077fdd9d1aa35a584698", "packets": 6, "transport": "udp", "last_frame": 30094, "first_frame": 2012, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 123, "responder_port": 123, "initiator_bytes": 486, "last_seen_epoch": "1583963839.65726", "responder_bytes": 486, "first_seen_epoch": "1583961790.358812" }, { "bytes": 298, "stream": 69, "flow_id": "flow-4077bd2289b5999df4106c87", "packets": 2, "transport": "udp", "last_frame": 2020, "first_frame": 2019, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 50966, "responder_port": 53, "initiator_bytes": 90, "last_seen_epoch": "1583961792.706361", "responder_bytes": 208, "first_seen_epoch": "1583961792.678223" }, { "bytes": 10765, "stream": 99, "flow_id": "flow-3724c88e4f50a86e8b99c129", "packets": 29, "transport": "tcp", "last_frame": 10188, "first_frame": 2021, "initiator_ip": "10.3.11.194", "responder_ip": "52.114.77.34", "initiator_port": 49700, "responder_port": 443, "initiator_bytes": 3390, "last_seen_epoch": "1583961902.102568", "responder_bytes": 7375, "first_seen_epoch": "1583961792.710492" }, { "bytes": 233, "stream": 70, "flow_id": "flow-0247ad77e1738846e3a6902f", "packets": 2, "transport": "udp", "last_frame": 2059, "first_frame": 2058, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 53857, "responder_port": 53, "initiator_bytes": 79, "last_seen_epoch": "1583961795.313901", "responder_bytes": 154, "first_seen_epoch": "1583961795.31356" }, { "bytes": 495, "stream": 71, "flow_id": "flow-b2a70ab4de54c884935c4740", "packets": 2, "transport": "udp", "last_frame": 2071, "first_frame": 2070, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 53858, "responder_port": 389, "initiator_bytes": 263, "last_seen_epoch": "1583961800.613343", "responder_bytes": 232, "first_seen_epoch": "1583961800.612888" }, { "bytes": 890, "stream": 100, "flow_id": "flow-980d01291b088b7306d46875", "packets": 8, "transport": "tcp", "last_frame": 2079, "first_frame": 2072, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 49701, "responder_port": 88, "initiator_bytes": 464, "last_seen_epoch": "1583961800.719898", "responder_bytes": 426, "first_seen_epoch": "1583961800.718168" }, { "bytes": 2529, "stream": 101, "flow_id": "flow-4dd040ef72b5851987269862", "packets": 10, "transport": "tcp", "last_frame": 2089, "first_frame": 2080, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 49702, "responder_port": 88, "initiator_bytes": 598, "last_seen_epoch": "1583961800.732473", "responder_bytes": 1931, "first_seen_epoch": "1583961800.725696" }, { "bytes": 3811, "stream": 102, "flow_id": "flow-7d6e628ac098fe4c57879c38", "packets": 12, "transport": "tcp", "last_frame": 2101, "first_frame": 2090, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 49703, "responder_port": 88, "initiator_bytes": 1890, "last_seen_epoch": "1583961800.745507", "responder_bytes": 1921, "first_seen_epoch": "1583961800.732858" }, { "bytes": 4103, "stream": 103, "flow_id": "flow-4cf0acc5d880f937d184d001", "packets": 12, "transport": "tcp", "last_frame": 2115, "first_frame": 2104, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 49704, "responder_port": 88, "initiator_bytes": 2062, "last_seen_epoch": "1583961800.965224", "responder_bytes": 2041, "first_seen_epoch": "1583961800.962367" }, { "bytes": 164, "stream": 72, "flow_id": "flow-25960e359c93765e905b0da9", "packets": 2, "transport": "udp", "last_frame": 2131, "first_frame": 2129, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 65025, "responder_port": 53, "initiator_bytes": 74, "last_seen_epoch": "1583961800.971143", "responder_bytes": 90, "first_seen_epoch": "1583961800.970926" }, { "bytes": 14191, "stream": 104, "flow_id": "flow-efdb554de304c13b176cc2b2", "packets": 61, "transport": "tcp", "last_frame": 2806, "first_frame": 2132, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 49705, "responder_port": 445, "initiator_bytes": 6999, "last_seen_epoch": "1583961813.688079", "responder_bytes": 7192, "first_seen_epoch": "1583961800.975654" }, { "bytes": 2362, "stream": 105, "flow_id": "flow-0384fc1470e8ace9ad8c0292", "packets": 10, "transport": "tcp", "last_frame": 2148, "first_frame": 2139, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 49706, "responder_port": 88, "initiator_bytes": 1978, "last_seen_epoch": "1583961800.989173", "responder_bytes": 384, "first_seen_epoch": "1583961800.987605" }, { "bytes": 12859, "stream": 106, "flow_id": "flow-237b2cb3e461b3161ecce0f7", "packets": 82, "transport": "tcp", "last_frame": 29612, "first_frame": 2200, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 49707, "responder_port": 445, "initiator_bytes": 8110, "last_seen_epoch": "1583963183.015811", "responder_bytes": 4749, "first_seen_epoch": "1583961801.105501" }, { "bytes": 4026, "stream": 107, "flow_id": "flow-ad7c605ced150511429d0f2f", "packets": 12, "transport": "tcp", "last_frame": 2218, "first_frame": 2207, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 49708, "responder_port": 88, "initiator_bytes": 2031, "last_seen_epoch": "1583961801.14277", "responder_bytes": 1995, "first_seen_epoch": "1583961801.140706" }, { "bytes": 3711, "stream": 108, "flow_id": "flow-41bae68d84e0c8b44c908308", "packets": 12, "transport": "tcp", "last_frame": 2230, "first_frame": 2219, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 49709, "responder_port": 88, "initiator_bytes": 1841, "last_seen_epoch": "1583961801.144514", "responder_bytes": 1870, "first_seen_epoch": "1583961801.143138" }, { "bytes": 4223, "stream": 109, "flow_id": "flow-60892ef3e08e985fba50d2df", "packets": 14, "transport": "tcp", "last_frame": 2277, "first_frame": 2244, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 49710, "responder_port": 389, "initiator_bytes": 3149, "last_seen_epoch": "1583961801.685187", "responder_bytes": 1074, "first_seen_epoch": "1583961801.302084" }, { "bytes": 3776, "stream": 110, "flow_id": "flow-a2611bdac909daad187d95c9", "packets": 16, "transport": "tcp", "last_frame": 2275, "first_frame": 2254, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 49711, "responder_port": 389, "initiator_bytes": 2870, "last_seen_epoch": "1583961801.66554", "responder_bytes": 906, "first_seen_epoch": "1583961801.314887" }, { "bytes": 265, "stream": 73, "flow_id": "flow-0b94e35e2c4d112aa77a0263", "packets": 2, "transport": "udp", "last_frame": 2281, "first_frame": 2280, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 57213, "responder_port": 53, "initiator_bytes": 72, "last_seen_epoch": "1583961806.049603", "responder_bytes": 193, "first_seen_epoch": "1583961806.049201" }, { "bytes": 16940, "stream": 111, "flow_id": "flow-069396dfc01a3e705237d261", "packets": 55, "transport": "tcp", "last_frame": 10444, "first_frame": 2282, "initiator_ip": "10.3.11.194", "responder_ip": "13.107.21.200", "initiator_port": 49712, "responder_port": 443, "initiator_bytes": 9042, "last_seen_epoch": "1583961951.550829", "responder_bytes": 7898, "first_seen_epoch": "1583961806.125889" }, { "bytes": 221, "stream": 74, "flow_id": "flow-d1de542bcadc7e1c57393057", "packets": 2, "transport": "udp", "last_frame": 2295, "first_frame": 2287, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 57694, "responder_port": 53, "initiator_bytes": 77, "last_seen_epoch": "1583961806.24083", "responder_bytes": 144, "first_seen_epoch": "1583961806.215464" }, { "bytes": 6383, "stream": 112, "flow_id": "flow-7fd66e6637ee45e8cd939b07", "packets": 23, "transport": "tcp", "last_frame": 10315, "first_frame": 2302, "initiator_ip": "10.3.11.194", "responder_ip": "13.107.42.254", "initiator_port": 49713, "responder_port": 443, "initiator_bytes": 1086, "last_seen_epoch": "1583961929.585689", "responder_bytes": 5297, "first_seen_epoch": "1583961806.273402" }, { "bytes": 221, "stream": 75, "flow_id": "flow-697bdb8d0fa8836211a6054f", "packets": 2, "transport": "udp", "last_frame": 2328, "first_frame": 2326, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 63379, "responder_port": 53, "initiator_bytes": 77, "last_seen_epoch": "1583961806.430849", "responder_bytes": 144, "first_seen_epoch": "1583961806.398703" }, { "bytes": 270, "stream": 76, "flow_id": "flow-7c8a1f7466476d00cd483d0d", "packets": 2, "transport": "udp", "last_frame": 2329, "first_frame": 2327, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 51357, "responder_port": 53, "initiator_bytes": 86, "last_seen_epoch": "1583961806.431111", "responder_bytes": 184, "first_seen_epoch": "1583961806.401801" }, { "bytes": 6662, "stream": 113, "flow_id": "flow-5116b63247a16fd1cf086d83", "packets": 23, "transport": "tcp", "last_frame": 10316, "first_frame": 2330, "initiator_ip": "10.3.11.194", "responder_ip": "13.107.3.254", "initiator_port": 49714, "responder_port": 443, "initiator_bytes": 1086, "last_seen_epoch": "1583961933.18488", "responder_bytes": 5576, "first_seen_epoch": "1583961806.431558" }, { "bytes": 6671, "stream": 114, "flow_id": "flow-30d7716bff073739c8288263", "packets": 23, "transport": "tcp", "last_frame": 10310, "first_frame": 2331, "initiator_ip": "10.3.11.194", "responder_ip": "13.107.246.254", "initiator_port": 49715, "responder_port": 443, "initiator_bytes": 1095, "last_seen_epoch": "1583961928.784285", "responder_bytes": 5576, "first_seen_epoch": "1583961806.448232" }, { "bytes": 221, "stream": 77, "flow_id": "flow-108101aeb426da154202ceca", "packets": 2, "transport": "udp", "last_frame": 2336, "first_frame": 2334, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 56652, "responder_port": 53, "initiator_bytes": 77, "last_seen_epoch": "1583961806.493595", "responder_bytes": 144, "first_seen_epoch": "1583961806.477891" }, { "bytes": 216, "stream": 78, "flow_id": "flow-ebced7971032de79d26029e6", "packets": 2, "transport": "udp", "last_frame": 2340, "first_frame": 2335, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 57780, "responder_port": 53, "initiator_bytes": 83, "last_seen_epoch": "1583961806.507845", "responder_bytes": 133, "first_seen_epoch": "1583961806.486979" }, { "bytes": 6662, "stream": 115, "flow_id": "flow-eafb3dae94bef09ad3163c62", "packets": 23, "transport": "tcp", "last_frame": 10317, "first_frame": 2337, "initiator_ip": "10.3.11.194", "responder_ip": "13.107.6.254", "initiator_port": 49716, "responder_port": 443, "initiator_bytes": 1086, "last_seen_epoch": "1583961933.257733", "responder_bytes": 5576, "first_seen_epoch": "1583961806.498387" }, { "bytes": 221, "stream": 79, "flow_id": "flow-cf87cbb894b51fa8249e6b5b", "packets": 2, "transport": "udp", "last_frame": 2339, "first_frame": 2338, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 55911, "responder_port": 53, "initiator_bytes": 77, "last_seen_epoch": "1583961806.506259", "responder_bytes": 144, "first_seen_epoch": "1583961806.505691" }, { "bytes": 6662, "stream": 116, "flow_id": "flow-58011c2ed51b5a1e76667c7b", "packets": 23, "transport": "tcp", "last_frame": 10280, "first_frame": 2341, "initiator_ip": "10.3.11.194", "responder_ip": "13.107.246.254", "initiator_port": 49717, "responder_port": 443, "initiator_bytes": 1086, "last_seen_epoch": "1583961927.239733", "responder_bytes": 5576, "first_seen_epoch": "1583961806.508096" }, { "bytes": 5713, "stream": 117, "flow_id": "flow-c67a6174a6b22829d8fe9b85", "packets": 21, "transport": "tcp", "last_frame": 10336, "first_frame": 2368, "initiator_ip": "10.3.11.194", "responder_ip": "13.107.43.14", "initiator_port": 49718, "responder_port": 443, "initiator_bytes": 1038, "last_seen_epoch": "1583961934.661607", "responder_bytes": 4675, "first_seen_epoch": "1583961806.619489" }, { "bytes": 109, "stream": 118, "flow_id": "flow-e9da69fff3928e7b0c19dbed", "packets": 2, "transport": "tcp", "last_frame": 2475, "first_frame": 2474, "initiator_ip": "10.3.11.3", "responder_ip": "10.3.11.194", "initiator_port": 445, "responder_port": 49680, "initiator_bytes": 55, "last_seen_epoch": "1583961810.262956", "responder_bytes": 54, "first_seen_epoch": "1583961810.262793" }, { "bytes": 3451, "stream": 80, "flow_id": "flow-96ecf943ee9b77f64764d159", "packets": 46, "transport": "udp", "last_frame": 21800, "first_frame": 2481, "initiator_ip": "10.3.11.119", "responder_ip": "224.0.0.251", "initiator_port": 5353, "responder_port": 5353, "initiator_bytes": 3451, "last_seen_epoch": "1583962651.29314", "responder_bytes": 0, "first_seen_epoch": "1583961810.441797" }, { "bytes": 254, "stream": 81, "flow_id": "flow-92f3b8961a58049dde1c553e", "packets": 2, "transport": "udp", "last_frame": 2485, "first_frame": 2484, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 52072, "responder_port": 53, "initiator_bytes": 95, "last_seen_epoch": "1583961810.892861", "responder_bytes": 159, "first_seen_epoch": "1583961810.892584" }, { "bytes": 192, "stream": 82, "flow_id": "flow-e85546fe70ee92c0c551a2be", "packets": 2, "transport": "udp", "last_frame": 2487, "first_frame": 2486, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 53653, "responder_port": 53, "initiator_bytes": 88, "last_seen_epoch": "1583961810.919308", "responder_bytes": 104, "first_seen_epoch": "1583961810.918613" }, { "bytes": 494, "stream": 83, "flow_id": "flow-dc2c17f44c5ae42a7787bf6b", "packets": 2, "transport": "udp", "last_frame": 2489, "first_frame": 2488, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 53655, "responder_port": 389, "initiator_bytes": 262, "last_seen_epoch": "1583961810.936672", "responder_bytes": 232, "first_seen_epoch": "1583961810.936341" }, { "bytes": 6013, "stream": 119, "flow_id": "flow-cf5626564e8aeb1c403f18a1", "packets": 13, "transport": "tcp", "last_frame": 2664, "first_frame": 2490, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 49668, "responder_port": 389, "initiator_bytes": 2694, "last_seen_epoch": "1583961813.164882", "responder_bytes": 3319, "first_seen_epoch": "1583961811.05683" }, { "bytes": 168, "stream": 84, "flow_id": "flow-f1f2274713e0a6a76217c2d9", "packets": 2, "transport": "udp", "last_frame": 2498, "first_frame": 2497, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 55940, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1583961811.185698", "responder_bytes": 92, "first_seen_epoch": "1583961811.168733" }, { "bytes": 233, "stream": 85, "flow_id": "flow-ba9651013b0135553586c61c", "packets": 2, "transport": "udp", "last_frame": 2500, "first_frame": 2499, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 59772, "responder_port": 53, "initiator_bytes": 79, "last_seen_epoch": "1583961811.510192", "responder_bytes": 154, "first_seen_epoch": "1583961811.509917" }, { "bytes": 6564, "stream": 86, "flow_id": "flow-75a9ecc11865f2d486cfc016", "packets": 69, "transport": "udp", "last_frame": 23175, "first_frame": 2501, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.255", "initiator_port": 137, "responder_port": 137, "initiator_bytes": 6564, "last_seen_epoch": "1583962651.790541", "responder_bytes": 0, "first_seen_epoch": "1583961811.521662" }, { "bytes": 128, "stream": 87, "flow_id": "flow-dc6383afe6370dffc28bb372", "packets": 2, "transport": "udp", "last_frame": 2507, "first_frame": 2504, "initiator_ip": "10.3.11.119", "responder_ip": "224.0.0.252", "initiator_port": 52488, "responder_port": 5355, "initiator_bytes": 128, "last_seen_epoch": "1583961811.933247", "responder_bytes": 0, "first_seen_epoch": "1583961811.523758" }, { "bytes": 128, "stream": 88, "flow_id": "flow-eccb282e6c442af6002226ea", "packets": 2, "transport": "udp", "last_frame": 2506, "first_frame": 2505, "initiator_ip": "10.3.11.119", "responder_ip": "224.0.0.252", "initiator_port": 49953, "responder_port": 5355, "initiator_bytes": 128, "last_seen_epoch": "1583961811.933093", "responder_bytes": 0, "first_seen_epoch": "1583961811.524156" }, { "bytes": 316, "stream": 89, "flow_id": "flow-cea0a0f5d43b2e593a61175f", "packets": 2, "transport": "udp", "last_frame": 2527, "first_frame": 2526, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 60273, "responder_port": 53, "initiator_bytes": 126, "last_seen_epoch": "1583961812.561843", "responder_bytes": 190, "first_seen_epoch": "1583961812.561544" }, { "bytes": 494, "stream": 90, "flow_id": "flow-ef47399c04bb76a891a88a2c", "packets": 2, "transport": "udp", "last_frame": 2531, "first_frame": 2530, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 60275, "responder_port": 389, "initiator_bytes": 262, "last_seen_epoch": "1583961812.83845", "responder_bytes": 232, "first_seen_epoch": "1583961812.837984" }, { "bytes": 560, "stream": 91, "flow_id": "flow-403e44035ae0e8d82fa96333", "packets": 2, "transport": "udp", "last_frame": 2533, "first_frame": 2532, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 60277, "responder_port": 389, "initiator_bytes": 308, "last_seen_epoch": "1583961812.840562", "responder_bytes": 252, "first_seen_epoch": "1583961812.840153" }, { "bytes": 538, "stream": 92, "flow_id": "flow-9c9b4a69790093ebc512e2ab", "packets": 2, "transport": "udp", "last_frame": 2535, "first_frame": 2534, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 60278, "responder_port": 389, "initiator_bytes": 306, "last_seen_epoch": "1583961812.853449", "responder_bytes": 232, "first_seen_epoch": "1583961812.853044" }, { "bytes": 3342, "stream": 120, "flow_id": "flow-960aff7d0670aece7f5fa652", "packets": 23, "transport": "tcp", "last_frame": 8039, "first_frame": 2536, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 49671, "responder_port": 135, "initiator_bytes": 1780, "last_seen_epoch": "1583961869.092986", "responder_bytes": 1562, "first_seen_epoch": "1583961812.970549" }, { "bytes": 495, "stream": 93, "flow_id": "flow-54d4049efb6710494f3b21cd", "packets": 2, "transport": "udp", "last_frame": 2545, "first_frame": 2544, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 60279, "responder_port": 389, "initiator_bytes": 263, "last_seen_epoch": "1583961813.007206", "responder_bytes": 232, "first_seen_epoch": "1583961813.006861" }, { "bytes": 4488, "stream": 121, "flow_id": "flow-1b3642a3cd4136e2f4c94760", "packets": 20, "transport": "tcp", "last_frame": 4158, "first_frame": 2546, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 49672, "responder_port": 49671, "initiator_bytes": 2606, "last_seen_epoch": "1583961839.090269", "responder_bytes": 1882, "first_seen_epoch": "1583961813.007284" }, { "bytes": 9854, "stream": 122, "flow_id": "flow-2403e76b16379be77a8cd03a", "packets": 32, "transport": "tcp", "last_frame": 2779, "first_frame": 2562, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 49673, "responder_port": 389, "initiator_bytes": 4753, "last_seen_epoch": "1583961813.563861", "responder_bytes": 5101, "first_seen_epoch": "1583961813.029718" }, { "bytes": 922, "stream": 123, "flow_id": "flow-ddd0b8a451df1b228638949a", "packets": 8, "transport": "tcp", "last_frame": 2577, "first_frame": 2570, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 49674, "responder_port": 88, "initiator_bytes": 471, "last_seen_epoch": "1583961813.121396", "responder_bytes": 451, "first_seen_epoch": "1583961813.119482" }, { "bytes": 922, "stream": 124, "flow_id": "flow-3750ea09589454c50616dd3f", "packets": 8, "transport": "tcp", "last_frame": 2585, "first_frame": 2578, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 49675, "responder_port": 88, "initiator_bytes": 471, "last_seen_epoch": "1583961813.126244", "responder_bytes": 451, "first_seen_epoch": "1583961813.123782" }, { "bytes": 2511, "stream": 125, "flow_id": "flow-1fc653f79a0761c5f2d887b4", "packets": 10, "transport": "tcp", "last_frame": 2604, "first_frame": 2586, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 49676, "responder_port": 88, "initiator_bytes": 605, "last_seen_epoch": "1583961813.138385", "responder_bytes": 1906, "first_seen_epoch": "1583961813.135101" }, { "bytes": 2511, "stream": 126, "flow_id": "flow-eecb2e2e0f4934aa7a6fe2f4", "packets": 10, "transport": "tcp", "last_frame": 2606, "first_frame": 2590, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 49677, "responder_port": 88, "initiator_bytes": 605, "last_seen_epoch": "1583961813.138869", "responder_bytes": 1906, "first_seen_epoch": "1583961813.136455" }, { "bytes": 4019, "stream": 127, "flow_id": "flow-17c635896b6ca48dfb0db8e8", "packets": 12, "transport": "tcp", "last_frame": 2619, "first_frame": 2608, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 49678, "responder_port": 88, "initiator_bytes": 2020, "last_seen_epoch": "1583961813.154848", "responder_bytes": 1999, "first_seen_epoch": "1583961813.153302" }, { "bytes": 4019, "stream": 128, "flow_id": "flow-dd342e46b593f4f394c5390c", "packets": 12, "transport": "tcp", "last_frame": 2638, "first_frame": 2620, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 49679, "responder_port": 88, "initiator_bytes": 2020, "last_seen_epoch": "1583961813.159019", "responder_bytes": 1999, "first_seen_epoch": "1583961813.156746" }, { "bytes": 19948, "stream": 129, "flow_id": "flow-981d7627fd824466b60a5537", "packets": 62, "transport": "tcp", "last_frame": 8037, "first_frame": 2633, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 49680, "responder_port": 49667, "initiator_bytes": 13618, "last_seen_epoch": "1583961869.092846", "responder_bytes": 6330, "first_seen_epoch": "1583961813.158634" }, { "bytes": 326, "stream": 94, "flow_id": "flow-ea04470849a3d6631bf65f8e", "packets": 2, "transport": "udp", "last_frame": 2660, "first_frame": 2659, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 57031, "responder_port": 53, "initiator_bytes": 131, "last_seen_epoch": "1583961813.164338", "responder_bytes": 195, "first_seen_epoch": "1583961813.164158" }, { "bytes": 477, "stream": 95, "flow_id": "flow-7cc6ea5c762cb06dd7ccafa9", "packets": 2, "transport": "udp", "last_frame": 2666, "first_frame": 2665, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 57032, "responder_port": 389, "initiator_bytes": 241, "last_seen_epoch": "1583961813.165502", "responder_bytes": 236, "first_seen_epoch": "1583961813.165246" }, { "bytes": 255, "stream": 96, "flow_id": "flow-90807ff879484dccf1dba9b2", "packets": 2, "transport": "udp", "last_frame": 2685, "first_frame": 2684, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 63995, "responder_port": 53, "initiator_bytes": 90, "last_seen_epoch": "1583961813.264308", "responder_bytes": 165, "first_seen_epoch": "1583961813.264054" }, { "bytes": 348, "stream": 130, "flow_id": "flow-548b6cc83f49b57ece617ed7", "packets": 6, "transport": "tcp", "last_frame": 2692, "first_frame": 2686, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 49681, "responder_port": 389, "initiator_bytes": 174, "last_seen_epoch": "1583961813.295735", "responder_bytes": 174, "first_seen_epoch": "1583961813.276842" }, { "bytes": 326, "stream": 97, "flow_id": "flow-bdf33ba2edfe17c3d23d1f23", "packets": 2, "transport": "udp", "last_frame": 2695, "first_frame": 2694, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 53008, "responder_port": 53, "initiator_bytes": 131, "last_seen_epoch": "1583961813.296594", "responder_bytes": 195, "first_seen_epoch": "1583961813.296328" }, { "bytes": 44229, "stream": 131, "flow_id": "flow-3ace7377e5261a27fd18027e", "packets": 171, "transport": "tcp", "last_frame": 12448, "first_frame": 2697, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 49682, "responder_port": 445, "initiator_bytes": 22932, "last_seen_epoch": "1583962001.017708", "responder_bytes": 21297, "first_seen_epoch": "1583961813.340894" }, { "bytes": 477, "stream": 98, "flow_id": "flow-3aed15a94180755f7a1fab20", "packets": 2, "transport": "udp", "last_frame": 2701, "first_frame": 2700, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 53009, "responder_port": 389, "initiator_bytes": 241, "last_seen_epoch": "1583961813.34852", "responder_bytes": 236, "first_seen_epoch": "1583961813.348109" }, { "bytes": 3987, "stream": 132, "flow_id": "flow-8c77fbcff6ca051f56b4ce16", "packets": 12, "transport": "tcp", "last_frame": 2717, "first_frame": 2706, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 49683, "responder_port": 88, "initiator_bytes": 2004, "last_seen_epoch": "1583961813.422409", "responder_bytes": 1983, "first_seen_epoch": "1583961813.419594" }, { "bytes": 3627, "stream": 133, "flow_id": "flow-c3890c6c873efe6c1262d257", "packets": 12, "transport": "tcp", "last_frame": 2729, "first_frame": 2718, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 49684, "responder_port": 88, "initiator_bytes": 1799, "last_seen_epoch": "1583961813.42523", "responder_bytes": 1828, "first_seen_epoch": "1583961813.42259" }, { "bytes": 348, "stream": 134, "flow_id": "flow-fb9857877baefcd0f07d4a6a", "packets": 6, "transport": "tcp", "last_frame": 2745, "first_frame": 2739, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 49685, "responder_port": 389, "initiator_bytes": 174, "last_seen_epoch": "1583961813.45004", "responder_bytes": 174, "first_seen_epoch": "1583961813.448803" }, { "bytes": 296, "stream": 99, "flow_id": "flow-394c3b8e9792abe8af51adaf", "packets": 2, "transport": "udp", "last_frame": 2748, "first_frame": 2747, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 56717, "responder_port": 53, "initiator_bytes": 116, "last_seen_epoch": "1583961813.453322", "responder_bytes": 180, "first_seen_epoch": "1583961813.453095" }, { "bytes": 494, "stream": 100, "flow_id": "flow-fcabd724ec1d8484e5aad6fd", "packets": 2, "transport": "udp", "last_frame": 2750, "first_frame": 2749, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 56718, "responder_port": 389, "initiator_bytes": 262, "last_seen_epoch": "1583961813.455778", "responder_bytes": 232, "first_seen_epoch": "1583961813.455508" }, { "bytes": 348, "stream": 135, "flow_id": "flow-0ce8c77517585c9cc464ed71", "packets": 6, "transport": "tcp", "last_frame": 2762, "first_frame": 2756, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 49686, "responder_port": 389, "initiator_bytes": 174, "last_seen_epoch": "1583961813.559653", "responder_bytes": 174, "first_seen_epoch": "1583961813.558278" }, { "bytes": 348, "stream": 136, "flow_id": "flow-57a243e28be7a3ac487f12b0", "packets": 6, "transport": "tcp", "last_frame": 2770, "first_frame": 2764, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 49687, "responder_port": 389, "initiator_bytes": 174, "last_seen_epoch": "1583961813.5621", "responder_bytes": 174, "first_seen_epoch": "1583961813.560589" }, { "bytes": 192, "stream": 101, "flow_id": "flow-7feb5b0ade5960c39ba5f9be", "packets": 2, "transport": "udp", "last_frame": 2809, "first_frame": 2808, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 49548, "responder_port": 53, "initiator_bytes": 88, "last_seen_epoch": "1583961813.766099", "responder_bytes": 104, "first_seen_epoch": "1583961813.765796" }, { "bytes": 8989, "stream": 137, "flow_id": "flow-4f62ee32d946ba5b0fca3e17", "packets": 22, "transport": "tcp", "last_frame": 3001, "first_frame": 2812, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 49689, "responder_port": 389, "initiator_bytes": 3796, "last_seen_epoch": "1583961814.449447", "responder_bytes": 5193, "first_seen_epoch": "1583961814.054768" }, { "bytes": 3930, "stream": 138, "flow_id": "flow-90bbb470e4582431656a9121", "packets": 12, "transport": "tcp", "last_frame": 2835, "first_frame": 2824, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 49690, "responder_port": 88, "initiator_bytes": 1985, "last_seen_epoch": "1583961814.110531", "responder_bytes": 1945, "first_seen_epoch": "1583961814.108431" }, { "bytes": 3710, "stream": 139, "flow_id": "flow-31f4201e6f46c510501d5fb1", "packets": 16, "transport": "tcp", "last_frame": 2997, "first_frame": 2838, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 49691, "responder_port": 389, "initiator_bytes": 2804, "last_seen_epoch": "1583961814.440666", "responder_bytes": 906, "first_seen_epoch": "1583961814.118754" }, { "bytes": 4019, "stream": 140, "flow_id": "flow-3f0ec73288238e2821878842", "packets": 12, "transport": "tcp", "last_frame": 2865, "first_frame": 2854, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 49692, "responder_port": 88, "initiator_bytes": 2020, "last_seen_epoch": "1583961814.330671", "responder_bytes": 1999, "first_seen_epoch": "1583961814.327762" }, { "bytes": 3627, "stream": 141, "flow_id": "flow-d83e410d6ee152c4f7a9844d", "packets": 12, "transport": "tcp", "last_frame": 2877, "first_frame": 2866, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 49693, "responder_port": 88, "initiator_bytes": 1799, "last_seen_epoch": "1583961814.331901", "responder_bytes": 1828, "first_seen_epoch": "1583961814.330825" }, { "bytes": 306, "stream": 102, "flow_id": "flow-3105eb48bac08ed466605518", "packets": 2, "transport": "udp", "last_frame": 3007, "first_frame": 3006, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 56275, "responder_port": 53, "initiator_bytes": 92, "last_seen_epoch": "1583961815.247099", "responder_bytes": 214, "first_seen_epoch": "1583961815.246867" }, { "bytes": 5064, "stream": 142, "flow_id": "flow-7f726b8694cf4700acf125e5", "packets": 25, "transport": "tcp", "last_frame": 3119, "first_frame": 3008, "initiator_ip": "10.3.11.119", "responder_ip": "40.69.218.62", "initiator_port": 49695, "responder_port": 443, "initiator_bytes": 1267, "last_seen_epoch": "1583961816.128317", "responder_bytes": 3797, "first_seen_epoch": "1583961815.249932" }, { "bytes": 255, "stream": 103, "flow_id": "flow-86ff17f386c172a8da8fdab3", "packets": 2, "transport": "udp", "last_frame": 3014, "first_frame": 3013, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 58179, "responder_port": 53, "initiator_bytes": 89, "last_seen_epoch": "1583961815.419961", "responder_bytes": 166, "first_seen_epoch": "1583961815.419746" }, { "bytes": 310, "stream": 104, "flow_id": "flow-177df8da48b69ed2f45d8e55", "packets": 2, "transport": "udp", "last_frame": 3016, "first_frame": 3015, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 57585, "responder_port": 53, "initiator_bytes": 155, "last_seen_epoch": "1583961815.424999", "responder_bytes": 155, "first_seen_epoch": "1583961815.424012" }, { "bytes": 316, "stream": 105, "flow_id": "flow-f1e3b7ef73f6262e4274abca", "packets": 2, "transport": "udp", "last_frame": 3023, "first_frame": 3022, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 64568, "responder_port": 53, "initiator_bytes": 126, "last_seen_epoch": "1583961815.687343", "responder_bytes": 190, "first_seen_epoch": "1583961815.687068" }, { "bytes": 495, "stream": 106, "flow_id": "flow-84ba8ec324003f4211048d41", "packets": 2, "transport": "udp", "last_frame": 3025, "first_frame": 3024, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 64569, "responder_port": 389, "initiator_bytes": 263, "last_seen_epoch": "1583961815.688207", "responder_bytes": 232, "first_seen_epoch": "1583961815.68792" }, { "bytes": 1566, "stream": 143, "flow_id": "flow-014aa661a00aeb564bd5800f", "packets": 11, "transport": "tcp", "last_frame": 3108, "first_frame": 3033, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 49696, "responder_port": 135, "initiator_bytes": 886, "last_seen_epoch": "1583961815.935332", "responder_bytes": 680, "first_seen_epoch": "1583961815.803342" }, { "bytes": 6655, "stream": 144, "flow_id": "flow-9deb68adf86cc15daf66eee1", "packets": 23, "transport": "tcp", "last_frame": 3109, "first_frame": 3040, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 49697, "responder_port": 49667, "initiator_bytes": 4266, "last_seen_epoch": "1583961815.9355", "responder_bytes": 2389, "first_seen_epoch": "1583961815.806841" }, { "bytes": 495, "stream": 107, "flow_id": "flow-b17d4158414afe026f1dccb1", "packets": 2, "transport": "udp", "last_frame": 3064, "first_frame": 3063, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 64571, "responder_port": 389, "initiator_bytes": 263, "last_seen_epoch": "1583961815.81775", "responder_bytes": 232, "first_seen_epoch": "1583961815.817541" }, { "bytes": 7378, "stream": 145, "flow_id": "flow-b10681621fcf4a4f43507e0d", "packets": 21, "transport": "tcp", "last_frame": 3107, "first_frame": 3069, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 49698, "responder_port": 389, "initiator_bytes": 3364, "last_seen_epoch": "1583961815.930259", "responder_bytes": 4014, "first_seen_epoch": "1583961815.91877" }, { "bytes": 6802, "stream": 146, "flow_id": "flow-7598cc9da8ccb7afe3e30059", "packets": 18, "transport": "tcp", "last_frame": 3103, "first_frame": 3086, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 49699, "responder_port": 389, "initiator_bytes": 2769, "last_seen_epoch": "1583961815.92984", "responder_bytes": 4033, "first_seen_epoch": "1583961815.924783" }, { "bytes": 352, "stream": 108, "flow_id": "flow-8188ae4491bcd375ff98c712", "packets": 2, "transport": "udp", "last_frame": 3116, "first_frame": 3115, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 52371, "responder_port": 53, "initiator_bytes": 94, "last_seen_epoch": "1583961816.043339", "responder_bytes": 258, "first_seen_epoch": "1583961816.001111" }, { "bytes": 9521, "stream": 147, "flow_id": "flow-81172622b8e8e931cd71b457", "packets": 23, "transport": "tcp", "last_frame": 3166, "first_frame": 3117, "initiator_ip": "10.3.11.119", "responder_ip": "23.4.97.247", "initiator_port": 49700, "responder_port": 443, "initiator_bytes": 1236, "last_seen_epoch": "1583961817.244854", "responder_bytes": 8285, "first_seen_epoch": "1583961816.044177" }, { "bytes": 1215, "stream": 109, "flow_id": "flow-0c0eec3c8eb1f49918467297", "packets": 5, "transport": "udp", "last_frame": 30104, "first_frame": 3120, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.255", "initiator_port": 138, "responder_port": 138, "initiator_bytes": 1215, "last_seen_epoch": "1583963972.84086", "responder_bytes": 0, "first_seen_epoch": "1583961816.676656" }, { "bytes": 245, "stream": 110, "flow_id": "flow-aed9d5d2347db38acb621d44", "packets": 2, "transport": "udp", "last_frame": 3122, "first_frame": 3121, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 52029, "responder_port": 53, "initiator_bytes": 90, "last_seen_epoch": "1583961816.742544", "responder_bytes": 155, "first_seen_epoch": "1583961816.717826" }, { "bytes": 8941, "stream": 148, "flow_id": "flow-b2162598880194da9bb07200", "packets": 23, "transport": "tcp", "last_frame": 10279, "first_frame": 3123, "initiator_ip": "10.3.11.218", "responder_ip": "52.109.12.19", "initiator_port": 49742, "responder_port": 443, "initiator_bytes": 1668, "last_seen_epoch": "1583961926.77805", "responder_bytes": 7273, "first_seen_epoch": "1583961816.74346" }, { "bytes": 352, "stream": 111, "flow_id": "flow-b98ae15262d80c141027934a", "packets": 2, "transport": "udp", "last_frame": 3163, "first_frame": 3162, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 57740, "responder_port": 53, "initiator_bytes": 94, "last_seen_epoch": "1583961817.238134", "responder_bytes": 258, "first_seen_epoch": "1583961817.237735" }, { "bytes": 9285, "stream": 149, "flow_id": "flow-4f292676b3304591f9bedaaf", "packets": 22, "transport": "tcp", "last_frame": 3193, "first_frame": 3164, "initiator_ip": "10.3.11.119", "responder_ip": "23.4.97.247", "initiator_port": 49701, "responder_port": 443, "initiator_bytes": 1376, "last_seen_epoch": "1583961817.414357", "responder_bytes": 7909, "first_seen_epoch": "1583961817.238746" }, { "bytes": 360, "stream": 112, "flow_id": "flow-77faf997c46d8d677cc92a50", "packets": 2, "transport": "udp", "last_frame": 3187, "first_frame": 3186, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 53718, "responder_port": 53, "initiator_bytes": 96, "last_seen_epoch": "1583961817.390606", "responder_bytes": 264, "first_seen_epoch": "1583961817.390295" }, { "bytes": 9044, "stream": 150, "flow_id": "flow-bd36135357f9826190063bfd", "packets": 22, "transport": "tcp", "last_frame": 3236, "first_frame": 3188, "initiator_ip": "10.3.11.119", "responder_ip": "23.4.97.247", "initiator_port": 49702, "responder_port": 443, "initiator_bytes": 1368, "last_seen_epoch": "1583961817.529197", "responder_bytes": 7676, "first_seen_epoch": "1583961817.391223" }, { "bytes": 9283, "stream": 151, "flow_id": "flow-4ef8aea4b1cd4abcde464fe1", "packets": 22, "transport": "tcp", "last_frame": 3241, "first_frame": 3189, "initiator_ip": "10.3.11.119", "responder_ip": "23.4.97.247", "initiator_port": 49703, "responder_port": 443, "initiator_bytes": 1377, "last_seen_epoch": "1583961817.608979", "responder_bytes": 7906, "first_seen_epoch": "1583961817.393386" }, { "bytes": 210, "stream": 113, "flow_id": "flow-a2893e1bd335d8693c88bae5", "packets": 2, "transport": "udp", "last_frame": 3231, "first_frame": 3230, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 58678, "responder_port": 53, "initiator_bytes": 97, "last_seen_epoch": "1583961817.510251", "responder_bytes": 113, "first_seen_epoch": "1583961817.509957" }, { "bytes": 5795, "stream": 152, "flow_id": "flow-e3125b5aad3858cfe681111e", "packets": 28, "transport": "tcp", "last_frame": 10284, "first_frame": 3232, "initiator_ip": "10.3.11.119", "responder_ip": "52.161.15.246", "initiator_port": 49704, "responder_port": 443, "initiator_bytes": 1945, "last_seen_epoch": "1583961927.550533", "responder_bytes": 3850, "first_seen_epoch": "1583961817.511301" }, { "bytes": 9046, "stream": 153, "flow_id": "flow-1c200d98b455bd4d84ea215f", "packets": 22, "transport": "tcp", "last_frame": 3300, "first_frame": 3233, "initiator_ip": "10.3.11.119", "responder_ip": "23.4.97.247", "initiator_port": 49705, "responder_port": 443, "initiator_bytes": 1369, "last_seen_epoch": "1583961817.708258", "responder_bytes": 7677, "first_seen_epoch": "1583961817.51433" }, { "bytes": 9331, "stream": 154, "flow_id": "flow-785a4b419a1f02b65734f107", "packets": 22, "transport": "tcp", "last_frame": 3296, "first_frame": 3234, "initiator_ip": "10.3.11.119", "responder_ip": "23.4.97.247", "initiator_port": 49706, "responder_port": 443, "initiator_bytes": 1374, "last_seen_epoch": "1583961817.700893", "responder_bytes": 7957, "first_seen_epoch": "1583961817.51699" }, { "bytes": 9043, "stream": 155, "flow_id": "flow-8a31279d1aeca3cb1864d73a", "packets": 22, "transport": "tcp", "last_frame": 3375, "first_frame": 3297, "initiator_ip": "10.3.11.119", "responder_ip": "23.4.97.247", "initiator_port": 49707, "responder_port": 443, "initiator_bytes": 1366, "last_seen_epoch": "1583961817.863498", "responder_bytes": 7677, "first_seen_epoch": "1583961817.706656" }, { "bytes": 210, "stream": 114, "flow_id": "flow-c0bc45023a3a4b382b58c2db", "packets": 2, "transport": "udp", "last_frame": 3304, "first_frame": 3299, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 65093, "responder_port": 53, "initiator_bytes": 97, "last_seen_epoch": "1583961817.728584", "responder_bytes": 113, "first_seen_epoch": "1583961817.708162" }, { "bytes": 9323, "stream": 156, "flow_id": "flow-62129f6c9c55ae7ab6b9132f", "packets": 22, "transport": "tcp", "last_frame": 3355, "first_frame": 3301, "initiator_ip": "10.3.11.119", "responder_ip": "23.4.97.247", "initiator_port": 49708, "responder_port": 443, "initiator_bytes": 1374, "last_seen_epoch": "1583961817.842895", "responder_bytes": 7949, "first_seen_epoch": "1583961817.717151" }, { "bytes": 5743, "stream": 157, "flow_id": "flow-b38bdb7536657344fc8bbfa0", "packets": 27, "transport": "tcp", "last_frame": 10288, "first_frame": 3305, "initiator_ip": "10.3.11.119", "responder_ip": "13.78.187.58", "initiator_port": 49709, "responder_port": 443, "initiator_bytes": 1946, "last_seen_epoch": "1583961927.754804", "responder_bytes": 3797, "first_seen_epoch": "1583961817.729089" }, { "bytes": 9042, "stream": 158, "flow_id": "flow-2cc8d701e726ad567e75e66a", "packets": 22, "transport": "tcp", "last_frame": 3421, "first_frame": 3353, "initiator_ip": "10.3.11.119", "responder_ip": "23.4.97.247", "initiator_port": 49710, "responder_port": 443, "initiator_bytes": 1366, "last_seen_epoch": "1583961818.068218", "responder_bytes": 7676, "first_seen_epoch": "1583961817.839184" }, { "bytes": 9242, "stream": 159, "flow_id": "flow-266ad873b2e10c84b98bc1c9", "packets": 21, "transport": "tcp", "last_frame": 3452, "first_frame": 3369, "initiator_ip": "10.3.11.119", "responder_ip": "23.4.97.247", "initiator_port": 49711, "responder_port": 443, "initiator_bytes": 1325, "last_seen_epoch": "1583961818.251653", "responder_bytes": 7917, "first_seen_epoch": "1583961817.853587" }, { "bytes": 5743, "stream": 160, "flow_id": "flow-177c19ee7ae1550b48ea3255", "packets": 27, "transport": "tcp", "last_frame": 10292, "first_frame": 3373, "initiator_ip": "10.3.11.119", "responder_ip": "52.161.15.246", "initiator_port": 49712, "responder_port": 443, "initiator_bytes": 1947, "last_seen_epoch": "1583961927.94498", "responder_bytes": 3796, "first_seen_epoch": "1583961817.857924" }, { "bytes": 5741, "stream": 161, "flow_id": "flow-69d715462aec95045a8de0d2", "packets": 27, "transport": "tcp", "last_frame": 10296, "first_frame": 3415, "initiator_ip": "10.3.11.119", "responder_ip": "52.161.15.246", "initiator_port": 49713, "responder_port": 443, "initiator_bytes": 1944, "last_seen_epoch": "1583961928.238281", "responder_bytes": 3797, "first_seen_epoch": "1583961818.002088" }, { "bytes": 9047, "stream": 162, "flow_id": "flow-ae4a5441d6c49fd35013ee96", "packets": 22, "transport": "tcp", "last_frame": 3507, "first_frame": 3444, "initiator_ip": "10.3.11.119", "responder_ip": "23.4.97.247", "initiator_port": 49714, "responder_port": 443, "initiator_bytes": 1371, "last_seen_epoch": "1583961818.470423", "responder_bytes": 7676, "first_seen_epoch": "1583961818.202367" }, { "bytes": 9231, "stream": 163, "flow_id": "flow-7572f064f4f2c47869103780", "packets": 21, "transport": "tcp", "last_frame": 3506, "first_frame": 3445, "initiator_ip": "10.3.11.119", "responder_ip": "23.4.97.247", "initiator_port": 49715, "responder_port": 443, "initiator_bytes": 1325, "last_seen_epoch": "1583961818.470311", "responder_bytes": 7906, "first_seen_epoch": "1583961818.204747" }, { "bytes": 9047, "stream": 164, "flow_id": "flow-269bfd2c10783820dfeca636", "packets": 22, "transport": "tcp", "last_frame": 3556, "first_frame": 3501, "initiator_ip": "10.3.11.119", "responder_ip": "23.4.97.247", "initiator_port": 49716, "responder_port": 443, "initiator_bytes": 1371, "last_seen_epoch": "1583961818.778792", "responder_bytes": 7676, "first_seen_epoch": "1583961818.458574" }, { "bytes": 210, "stream": 115, "flow_id": "flow-9a350c8722ad2b2bac064f4f", "packets": 2, "transport": "udp", "last_frame": 3512, "first_frame": 3503, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 49765, "responder_port": 53, "initiator_bytes": 97, "last_seen_epoch": "1583961818.499999", "responder_bytes": 113, "first_seen_epoch": "1583961818.47016" }, { "bytes": 9240, "stream": 165, "flow_id": "flow-587f5b13be1d4351bd681e93", "packets": 21, "transport": "tcp", "last_frame": 3573, "first_frame": 3511, "initiator_ip": "10.3.11.119", "responder_ip": "23.4.97.247", "initiator_port": 49717, "responder_port": 443, "initiator_bytes": 1325, "last_seen_epoch": "1583961818.883563", "responder_bytes": 7915, "first_seen_epoch": "1583961818.476712" }, { "bytes": 5800, "stream": 166, "flow_id": "flow-20d496e37f71b2bf5ce93e8c", "packets": 28, "transport": "tcp", "last_frame": 10309, "first_frame": 3513, "initiator_ip": "10.3.11.119", "responder_ip": "13.78.186.254", "initiator_port": 49718, "responder_port": 443, "initiator_bytes": 1951, "last_seen_epoch": "1583961928.523681", "responder_bytes": 3849, "first_seen_epoch": "1583961818.50059" }, { "bytes": 5799, "stream": 167, "flow_id": "flow-bfd7acee8cdfd5f9af487312", "packets": 28, "transport": "tcp", "last_frame": 10314, "first_frame": 3567, "initiator_ip": "10.3.11.119", "responder_ip": "52.161.15.246", "initiator_port": 49719, "responder_port": 443, "initiator_bytes": 1949, "last_seen_epoch": "1583961928.97741", "responder_bytes": 3850, "first_seen_epoch": "1583961818.79525" }, { "bytes": 8993, "stream": 168, "flow_id": "flow-79c3f4254a7b37201c567bfe", "packets": 21, "transport": "tcp", "last_frame": 3614, "first_frame": 3568, "initiator_ip": "10.3.11.119", "responder_ip": "23.4.97.247", "initiator_port": 49720, "responder_port": 443, "initiator_bytes": 1317, "last_seen_epoch": "1583961819.163252", "responder_bytes": 7676, "first_seen_epoch": "1583961818.796219" }, { "bytes": 8213, "stream": 169, "flow_id": "flow-b4fc90886a64e84279430560", "packets": 25, "transport": "tcp", "last_frame": 3688, "first_frame": 3619, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 49721, "responder_port": 389, "initiator_bytes": 3843, "last_seen_epoch": "1583961821.38242", "responder_bytes": 4370, "first_seen_epoch": "1583961821.34535" }, { "bytes": 4429, "stream": 170, "flow_id": "flow-c509bf8dd2bebfbd67969561", "packets": 15, "transport": "tcp", "last_frame": 3684, "first_frame": 3640, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 49722, "responder_port": 389, "initiator_bytes": 3563, "last_seen_epoch": "1583961821.381831", "responder_bytes": 866, "first_seen_epoch": "1583961821.363034" }, { "bytes": 940, "stream": 171, "flow_id": "flow-2199e6b49d2553ccbf7563f6", "packets": 8, "transport": "tcp", "last_frame": 3656, "first_frame": 3649, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 49723, "responder_port": 88, "initiator_bytes": 472, "last_seen_epoch": "1583961821.374864", "responder_bytes": 468, "first_seen_epoch": "1583961821.373209" }, { "bytes": 2512, "stream": 172, "flow_id": "flow-f517073b0605e284332fe3f5", "packets": 10, "transport": "tcp", "last_frame": 3666, "first_frame": 3657, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 49724, "responder_port": 88, "initiator_bytes": 606, "last_seen_epoch": "1583961821.376396", "responder_bytes": 1906, "first_seen_epoch": "1583961821.374909" }, { "bytes": 3868, "stream": 173, "flow_id": "flow-b4918ffe3a92413fec1618cd", "packets": 12, "transport": "tcp", "last_frame": 3678, "first_frame": 3667, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 49725, "responder_port": 88, "initiator_bytes": 1951, "last_seen_epoch": "1583961821.378448", "responder_bytes": 1917, "first_seen_epoch": "1583961821.376701" }, { "bytes": 972, "stream": 116, "flow_id": "flow-7a1eb3efb487ef4b281ad49d", "packets": 6, "transport": "udp", "last_frame": 30096, "first_frame": 3689, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 123, "responder_port": 123, "initiator_bytes": 486, "last_seen_epoch": "1583963869.531097", "responder_bytes": 486, "first_seen_epoch": "1583961821.467115" }, { "bytes": 245, "stream": 117, "flow_id": "flow-64330eafa4099fd960b4790f", "packets": 2, "transport": "udp", "last_frame": 3699, "first_frame": 3698, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 49527, "responder_port": 53, "initiator_bytes": 91, "last_seen_epoch": "1583961823.771503", "responder_bytes": 154, "first_seen_epoch": "1583961823.738973" }, { "bytes": 8404, "stream": 174, "flow_id": "flow-2f3f5f3ad95d13d07cae0705", "packets": 22, "transport": "tcp", "last_frame": 4035, "first_frame": 3700, "initiator_ip": "10.3.11.218", "responder_ip": "40.119.2.214", "initiator_port": 49743, "responder_port": 443, "initiator_bytes": 1459, "last_seen_epoch": "1583961833.78433", "responder_bytes": 6945, "first_seen_epoch": "1583961823.77447" }, { "bytes": 298, "stream": 118, "flow_id": "flow-21558b44d8ea1a4961ad26c5", "packets": 2, "transport": "udp", "last_frame": 3706, "first_frame": 3705, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 64687, "responder_port": 53, "initiator_bytes": 90, "last_seen_epoch": "1583961824.00281", "responder_bytes": 208, "first_seen_epoch": "1583961823.973236" }, { "bytes": 10766, "stream": 175, "flow_id": "flow-1f9417b588c36e1ca28ef298", "packets": 29, "transport": "tcp", "last_frame": 10321, "first_frame": 3707, "initiator_ip": "10.3.11.119", "responder_ip": "52.114.132.73", "initiator_port": 49726, "responder_port": 443, "initiator_bytes": 3390, "last_seen_epoch": "1583961933.374166", "responder_bytes": 7376, "first_seen_epoch": "1583961824.006906" }, { "bytes": 233, "stream": 119, "flow_id": "flow-f87091dc939d7438360f086d", "packets": 2, "transport": "udp", "last_frame": 3764, "first_frame": 3763, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 52163, "responder_port": 53, "initiator_bytes": 79, "last_seen_epoch": "1583961826.57692", "responder_bytes": 154, "first_seen_epoch": "1583961826.576626" }, { "bytes": 233, "stream": 120, "flow_id": "flow-f141bd6e760ac42904c6a139", "packets": 2, "transport": "udp", "last_frame": 3768, "first_frame": 3767, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 53338, "responder_port": 53, "initiator_bytes": 79, "last_seen_epoch": "1583961829.279628", "responder_bytes": 154, "first_seen_epoch": "1583961829.279283" }, { "bytes": 880, "stream": 176, "flow_id": "flow-229db184cc387800735add61", "packets": 8, "transport": "tcp", "last_frame": 3778, "first_frame": 3771, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 49727, "responder_port": 88, "initiator_bytes": 459, "last_seen_epoch": "1583961831.212902", "responder_bytes": 421, "first_seen_epoch": "1583961831.211122" }, { "bytes": 2469, "stream": 177, "flow_id": "flow-f7e1dbc8cd339a7e8d9a56ca", "packets": 10, "transport": "tcp", "last_frame": 3788, "first_frame": 3779, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 49728, "responder_port": 88, "initiator_bytes": 593, "last_seen_epoch": "1583961831.219805", "responder_bytes": 1876, "first_seen_epoch": "1583961831.217902" }, { "bytes": 3711, "stream": 178, "flow_id": "flow-6576db715ff8874a50a53b0e", "packets": 12, "transport": "tcp", "last_frame": 3800, "first_frame": 3789, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 49729, "responder_port": 88, "initiator_bytes": 1840, "last_seen_epoch": "1583961831.222045", "responder_bytes": 1871, "first_seen_epoch": "1583961831.220065" }, { "bytes": 4003, "stream": 179, "flow_id": "flow-c0b4816ade8fc3bda99da860", "packets": 12, "transport": "tcp", "last_frame": 3814, "first_frame": 3803, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 49730, "responder_port": 88, "initiator_bytes": 2012, "last_seen_epoch": "1583961831.472502", "responder_bytes": 1991, "first_seen_epoch": "1583961831.470279" }, { "bytes": 164, "stream": 121, "flow_id": "flow-745c5a53810a917e6e0b59e4", "packets": 2, "transport": "udp", "last_frame": 3827, "first_frame": 3825, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 57361, "responder_port": 53, "initiator_bytes": 74, "last_seen_epoch": "1583961831.476298", "responder_bytes": 90, "first_seen_epoch": "1583961831.476016" }, { "bytes": 14155, "stream": 180, "flow_id": "flow-d6f6cec47438bda678223c4e", "packets": 61, "transport": "tcp", "last_frame": 4254, "first_frame": 3831, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 49731, "responder_port": 445, "initiator_bytes": 6979, "last_seen_epoch": "1583961845.623181", "responder_bytes": 7176, "first_seen_epoch": "1583961831.485341" }, { "bytes": 2312, "stream": 181, "flow_id": "flow-2ebab549b5f6994032c91629", "packets": 10, "transport": "tcp", "last_frame": 3847, "first_frame": 3838, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 49732, "responder_port": 88, "initiator_bytes": 1928, "last_seen_epoch": "1583961831.501165", "responder_bytes": 384, "first_seen_epoch": "1583961831.499622" }, { "bytes": 12636, "stream": 182, "flow_id": "flow-c5106da6149206248729171d", "packets": 80, "transport": "tcp", "last_frame": 29835, "first_frame": 3899, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 49733, "responder_port": 445, "initiator_bytes": 7965, "last_seen_epoch": "1583963217.169438", "responder_bytes": 4671, "first_seen_epoch": "1583961831.643003" }, { "bytes": 3926, "stream": 183, "flow_id": "flow-526ec7480e08c6032126ed25", "packets": 12, "transport": "tcp", "last_frame": 3917, "first_frame": 3906, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 49734, "responder_port": 88, "initiator_bytes": 1981, "last_seen_epoch": "1583961831.66615", "responder_bytes": 1945, "first_seen_epoch": "1583961831.663687" }, { "bytes": 3503, "stream": 184, "flow_id": "flow-0149aac0966c4677d203f026", "packets": 10, "transport": "tcp", "last_frame": 3927, "first_frame": 3918, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 49735, "responder_port": 88, "initiator_bytes": 1737, "last_seen_epoch": "1583961831.667966", "responder_bytes": 1766, "first_seen_epoch": "1583961831.66638" }, { "bytes": 4223, "stream": 185, "flow_id": "flow-5a5f94efc41abc5451cef454", "packets": 14, "transport": "tcp", "last_frame": 3974, "first_frame": 3944, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 49736, "responder_port": 389, "initiator_bytes": 3149, "last_seen_epoch": "1583961832.19681", "responder_bytes": 1074, "first_seen_epoch": "1583961831.832293" }, { "bytes": 3618, "stream": 186, "flow_id": "flow-8a61687ffa78af1821a15934", "packets": 14, "transport": "tcp", "last_frame": 3972, "first_frame": 3953, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 49737, "responder_port": 389, "initiator_bytes": 2766, "last_seen_epoch": "1583961832.169747", "responder_bytes": 852, "first_seen_epoch": "1583961831.843336" }, { "bytes": 265, "stream": 122, "flow_id": "flow-163108e494c0fceeab0b39de", "packets": 2, "transport": "udp", "last_frame": 3980, "first_frame": 3979, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 64690, "responder_port": 53, "initiator_bytes": 72, "last_seen_epoch": "1583961832.907313", "responder_bytes": 193, "first_seen_epoch": "1583961832.890108" }, { "bytes": 10687, "stream": 187, "flow_id": "flow-c734645e28aaa7b77f2a579c", "packets": 28, "transport": "tcp", "last_frame": 9812, "first_frame": 3981, "initiator_ip": "10.3.11.218", "responder_ip": "204.79.197.200", "initiator_port": 49744, "responder_port": 443, "initiator_bytes": 3112, "last_seen_epoch": "1583961893.108809", "responder_bytes": 7575, "first_seen_epoch": "1583961832.908797" }, { "bytes": 193, "stream": 123, "flow_id": "flow-9662bac9eed1b8dd2204b993", "packets": 2, "transport": "udp", "last_frame": 4009, "first_frame": 4008, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 52895, "responder_port": 53, "initiator_bytes": 71, "last_seen_epoch": "1583961833.292679", "responder_bytes": 122, "first_seen_epoch": "1583961833.271472" }, { "bytes": 8726, "stream": 188, "flow_id": "flow-d09141c9da844fa7e5960c1b", "packets": 26, "transport": "tcp", "last_frame": 4036, "first_frame": 4010, "initiator_ip": "10.3.11.218", "responder_ip": "52.179.129.229", "initiator_port": 49745, "responder_port": 443, "initiator_bytes": 3001, "last_seen_epoch": "1583961833.86628", "responder_bytes": 5725, "first_seen_epoch": "1583961833.294232" }, { "bytes": 265, "stream": 124, "flow_id": "flow-b086ad5704c2fe5ffb8e9407", "packets": 2, "transport": "udp", "last_frame": 4038, "first_frame": 4037, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 64504, "responder_port": 53, "initiator_bytes": 72, "last_seen_epoch": "1583961837.107859", "responder_bytes": 193, "first_seen_epoch": "1583961837.107429" }, { "bytes": 19215, "stream": 189, "flow_id": "flow-5eb22c4e2a248b7b084abeb1", "packets": 57, "transport": "tcp", "last_frame": 12236, "first_frame": 4039, "initiator_ip": "10.3.11.119", "responder_ip": "13.107.21.200", "initiator_port": 49738, "responder_port": 443, "initiator_bytes": 9364, "last_seen_epoch": "1583961980.205211", "responder_bytes": 9851, "first_seen_epoch": "1583961837.119051" }, { "bytes": 221, "stream": 125, "flow_id": "flow-30b6fe4c5f953830268f85a8", "packets": 2, "transport": "udp", "last_frame": 4047, "first_frame": 4044, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 54553, "responder_port": 53, "initiator_bytes": 77, "last_seen_epoch": "1583961837.170614", "responder_bytes": 144, "first_seen_epoch": "1583961837.153044" }, { "bytes": 225, "stream": 126, "flow_id": "flow-8996e91f8030c481a9d7056c", "packets": 2, "transport": "udp", "last_frame": 4063, "first_frame": 4045, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 60083, "responder_port": 53, "initiator_bytes": 79, "last_seen_epoch": "1583961837.210365", "responder_bytes": 146, "first_seen_epoch": "1583961837.160541" }, { "bytes": 231, "stream": 127, "flow_id": "flow-d2337b48263e4acab91f8e2a", "packets": 2, "transport": "udp", "last_frame": 4058, "first_frame": 4046, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 50810, "responder_port": 53, "initiator_bytes": 79, "last_seen_epoch": "1583961837.19057", "responder_bytes": 152, "first_seen_epoch": "1583961837.16415" }, { "bytes": 8460, "stream": 190, "flow_id": "flow-d48c33194b219aac786a0ea7", "packets": 22, "transport": "tcp", "last_frame": 10906, "first_frame": 4057, "initiator_ip": "10.3.11.119", "responder_ip": "13.107.18.254", "initiator_port": 49739, "responder_port": 443, "initiator_bytes": 987, "last_seen_epoch": "1583961960.97761", "responder_bytes": 7473, "first_seen_epoch": "1583961837.173669" }, { "bytes": 8237, "stream": 191, "flow_id": "flow-7d02f53b258179d802db55f7", "packets": 23, "transport": "tcp", "last_frame": 11195, "first_frame": 4064, "initiator_ip": "10.3.11.119", "responder_ip": "13.107.136.254", "initiator_port": 49740, "responder_port": 443, "initiator_bytes": 1043, "last_seen_epoch": "1583961964.483886", "responder_bytes": 7194, "first_seen_epoch": "1583961837.217374" }, { "bytes": 11323, "stream": 192, "flow_id": "flow-d64e3630f41c3bba56f9d2c9", "packets": 27, "transport": "tcp", "last_frame": 29756, "first_frame": 4069, "initiator_ip": "10.3.11.119", "responder_ip": "72.21.81.200", "initiator_port": 49741, "responder_port": 443, "initiator_bytes": 1065, "last_seen_epoch": "1583963202.19958", "responder_bytes": 10258, "first_seen_epoch": "1583961837.231292" }, { "bytes": 316, "stream": 128, "flow_id": "flow-a889e8f214b3fb791cf31c7a", "packets": 2, "transport": "udp", "last_frame": 4174, "first_frame": 4173, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 57350, "responder_port": 53, "initiator_bytes": 126, "last_seen_epoch": "1583961844.289742", "responder_bytes": 190, "first_seen_epoch": "1583961844.289363" }, { "bytes": 495, "stream": 129, "flow_id": "flow-f409fc918281268d44e62bd0", "packets": 2, "transport": "udp", "last_frame": 4176, "first_frame": 4175, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 57351, "responder_port": 389, "initiator_bytes": 263, "last_seen_epoch": "1583961844.290638", "responder_bytes": 232, "first_seen_epoch": "1583961844.290306" }, { "bytes": 1512, "stream": 193, "flow_id": "flow-934d3b161aca5b4b12173bdc", "packets": 10, "transport": "tcp", "last_frame": 4246, "first_frame": 4177, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 49746, "responder_port": 135, "initiator_bytes": 832, "last_seen_epoch": "1583961844.43988", "responder_bytes": 680, "first_seen_epoch": "1583961844.407432" }, { "bytes": 6589, "stream": 194, "flow_id": "flow-41c1a27e8c45e413f04d4139", "packets": 22, "transport": "tcp", "last_frame": 4247, "first_frame": 4184, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 49747, "responder_port": 49667, "initiator_bytes": 4200, "last_seen_epoch": "1583961844.440171", "responder_bytes": 2389, "first_seen_epoch": "1583961844.411734" }, { "bytes": 7378, "stream": 195, "flow_id": "flow-938c3d365496d289241d7fa4", "packets": 21, "transport": "tcp", "last_frame": 4245, "first_frame": 4207, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 49748, "responder_port": 389, "initiator_bytes": 3364, "last_seen_epoch": "1583961844.437665", "responder_bytes": 4014, "first_seen_epoch": "1583961844.423055" }, { "bytes": 6802, "stream": 196, "flow_id": "flow-911042bf929e30d5169f1f3a", "packets": 18, "transport": "tcp", "last_frame": 4241, "first_frame": 4224, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 49749, "responder_port": 389, "initiator_bytes": 2769, "last_seen_epoch": "1583961844.43733", "responder_bytes": 4033, "first_seen_epoch": "1583961844.431923" }, { "bytes": 265, "stream": 130, "flow_id": "flow-4c8d0fe6f8a24d3552c77191", "packets": 2, "transport": "udp", "last_frame": 4257, "first_frame": 4256, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 63015, "responder_port": 53, "initiator_bytes": 72, "last_seen_epoch": "1583961848.562517", "responder_bytes": 193, "first_seen_epoch": "1583961848.516411" }, { "bytes": 10598, "stream": 197, "flow_id": "flow-97cce7095666fec6c2584b25", "packets": 26, "transport": "tcp", "last_frame": 10205, "first_frame": 4258, "initiator_ip": "10.3.11.194", "responder_ip": "204.79.197.200", "initiator_port": 49719, "responder_port": 443, "initiator_bytes": 3076, "last_seen_epoch": "1583961908.707155", "responder_bytes": 7522, "first_seen_epoch": "1583961848.563834" }, { "bytes": 193, "stream": 131, "flow_id": "flow-5af60d8cbcfbf5405fc88aeb", "packets": 2, "transport": "udp", "last_frame": 4284, "first_frame": 4283, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 61107, "responder_port": 53, "initiator_bytes": 71, "last_seen_epoch": "1583961848.817143", "responder_bytes": 122, "first_seen_epoch": "1583961848.81689" }, { "bytes": 8721, "stream": 198, "flow_id": "flow-8fbb9adfc04b1d6d5566657e", "packets": 26, "transport": "tcp", "last_frame": 4310, "first_frame": 4285, "initiator_ip": "10.3.11.194", "responder_ip": "52.179.129.229", "initiator_port": 49720, "responder_port": 443, "initiator_bytes": 2997, "last_seen_epoch": "1583961849.475435", "responder_bytes": 5724, "first_seen_epoch": "1583961848.818423" }, { "bytes": 860, "stream": 132, "flow_id": "flow-7bfc51c19404b42e008baae0", "packets": 4, "transport": "udp", "last_frame": 4427, "first_frame": 4311, "initiator_ip": "10.3.11.119", "responder_ip": "239.255.255.250", "initiator_port": 50812, "responder_port": 1900, "initiator_bytes": 860, "last_seen_epoch": "1583961854.810945", "responder_bytes": 0, "first_seen_epoch": "1583961851.807484" }, { "bytes": 233, "stream": 133, "flow_id": "flow-55af4f24268a792bda1c384c", "packets": 2, "transport": "udp", "last_frame": 4316, "first_frame": 4315, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 54690, "responder_port": 53, "initiator_bytes": 79, "last_seen_epoch": "1583961853.498879", "responder_bytes": 154, "first_seen_epoch": "1583961853.498551" }, { "bytes": 128, "stream": 134, "flow_id": "flow-cbbf1ad53ec3b44bd0813fd3", "packets": 2, "transport": "udp", "last_frame": 4332, "first_frame": 4319, "initiator_ip": "10.3.11.119", "responder_ip": "224.0.0.252", "initiator_port": 62407, "responder_port": 5355, "initiator_bytes": 128, "last_seen_epoch": "1583961853.910447", "responder_bytes": 0, "first_seen_epoch": "1583961853.500242" }, { "bytes": 128, "stream": 135, "flow_id": "flow-20a179a82a85485126df6e43", "packets": 2, "transport": "udp", "last_frame": 4333, "first_frame": 4322, "initiator_ip": "10.3.11.119", "responder_ip": "224.0.0.252", "initiator_port": 55618, "responder_port": 5355, "initiator_bytes": 128, "last_seen_epoch": "1583961853.911409", "responder_bytes": 0, "first_seen_epoch": "1583961853.501519" }, { "bytes": 202, "stream": 136, "flow_id": "flow-73bb87f4d6f12b70db5b7644", "packets": 2, "transport": "udp", "last_frame": 4348, "first_frame": 4338, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 64602, "responder_port": 53, "initiator_bytes": 86, "last_seen_epoch": "1583961854.572439", "responder_bytes": 116, "first_seen_epoch": "1583961854.498926" }, { "bytes": 211, "stream": 137, "flow_id": "flow-8ed4df34d7399da2b3b208ec", "packets": 2, "transport": "udp", "last_frame": 4342, "first_frame": 4339, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 64082, "responder_port": 53, "initiator_bytes": 81, "last_seen_epoch": "1583961854.516637", "responder_bytes": 130, "first_seen_epoch": "1583961854.499941" }, { "bytes": 10360, "stream": 199, "flow_id": "flow-35b0cf84703eaff5499f8697", "packets": 28, "transport": "tcp", "last_frame": 12237, "first_frame": 4343, "initiator_ip": "10.3.11.119", "responder_ip": "13.107.3.128", "initiator_port": 49742, "responder_port": 443, "initiator_bytes": 1931, "last_seen_epoch": "1583961980.96821", "responder_bytes": 8429, "first_seen_epoch": "1583961854.519862" }, { "bytes": 23190, "stream": 200, "flow_id": "flow-70abe48e1b4fff3de3489097", "packets": 33, "transport": "tcp", "last_frame": 7724, "first_frame": 4349, "initiator_ip": "10.3.11.119", "responder_ip": "72.167.191.69", "initiator_port": 49743, "responder_port": 80, "initiator_bytes": 1932, "last_seen_epoch": "1583961864.844776", "responder_bytes": 21258, "first_seen_epoch": "1583961854.573113" }, { "bytes": 394, "stream": 201, "flow_id": "flow-67f59eb412d9a7c5bdf7fc40", "packets": 7, "transport": "tcp", "last_frame": 7779, "first_frame": 4350, "initiator_ip": "10.3.11.119", "responder_ip": "72.167.191.69", "initiator_port": 49744, "responder_port": 80, "initiator_bytes": 228, "last_seen_epoch": "1583961864.903457", "responder_bytes": 166, "first_seen_epoch": "1583961854.574098" }, { "bytes": 445, "stream": 138, "flow_id": "flow-8cd0519f3bcab723d4fc4158", "packets": 4, "transport": "udp", "last_frame": 5213, "first_frame": 4385, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 50998, "responder_port": 53, "initiator_bytes": 153, "last_seen_epoch": "1583961856.360527", "responder_bytes": 292, "first_seen_epoch": "1583961854.731137" }, { "bytes": 206, "stream": 139, "flow_id": "flow-b2c2bd6213b12eedf331bfe1", "packets": 2, "transport": "udp", "last_frame": 4391, "first_frame": 4386, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 58195, "responder_port": 53, "initiator_bytes": 77, "last_seen_epoch": "1583961854.757824", "responder_bytes": 129, "first_seen_epoch": "1583961854.731803" }, { "bytes": 248, "stream": 140, "flow_id": "flow-5148dbc59fe53c51717715ec", "packets": 2, "transport": "udp", "last_frame": 4396, "first_frame": 4387, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 63238, "responder_port": 53, "initiator_bytes": 74, "last_seen_epoch": "1583961854.76653", "responder_bytes": 174, "first_seen_epoch": "1583961854.732156" }, { "bytes": 5161, "stream": 202, "flow_id": "flow-d111762f8357f2d05abb6a8e", "packets": 17, "transport": "tcp", "last_frame": 7729, "first_frame": 4392, "initiator_ip": "10.3.11.119", "responder_ip": "216.58.194.42", "initiator_port": 49745, "responder_port": 443, "initiator_bytes": 1025, "last_seen_epoch": "1583961864.857564", "responder_bytes": 4136, "first_seen_epoch": "1583961854.758733" }, { "bytes": 5875, "stream": 203, "flow_id": "flow-df811e26f4038a1aadc490c3", "packets": 17, "transport": "tcp", "last_frame": 8229, "first_frame": 4393, "initiator_ip": "10.3.11.119", "responder_ip": "216.58.194.131", "initiator_port": 49746, "responder_port": 443, "initiator_bytes": 1025, "last_seen_epoch": "1583961872.498985", "responder_bytes": 4850, "first_seen_epoch": "1583961854.759856" }, { "bytes": 245, "stream": 141, "flow_id": "flow-713a6a947aa374ebf1fb8c8e", "packets": 2, "transport": "udp", "last_frame": 4426, "first_frame": 4394, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 55982, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1583961854.810288", "responder_bytes": 169, "first_seen_epoch": "1583961854.763504" }, { "bytes": 248, "stream": 142, "flow_id": "flow-e3a33308185e9066e4f3cf79", "packets": 2, "transport": "udp", "last_frame": 4416, "first_frame": 4395, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 51916, "responder_port": 53, "initiator_bytes": 74, "last_seen_epoch": "1583961854.797966", "responder_bytes": 174, "first_seen_epoch": "1583961854.76485" }, { "bytes": 7838, "stream": 204, "flow_id": "flow-861b8f00db97f98ec0a8f4eb", "packets": 20, "transport": "tcp", "last_frame": 8190, "first_frame": 4397, "initiator_ip": "10.3.11.119", "responder_ip": "23.211.18.27", "initiator_port": 49747, "responder_port": 443, "initiator_bytes": 1095, "last_seen_epoch": "1583961872.459509", "responder_bytes": 6743, "first_seen_epoch": "1583961854.767615" }, { "bytes": 5070, "stream": 205, "flow_id": "flow-caf39a73b819d7b28def744d", "packets": 34, "transport": "tcp", "last_frame": 16143, "first_frame": 4412, "initiator_ip": "10.3.11.119", "responder_ip": "216.58.194.42", "initiator_port": 49748, "responder_port": 80, "initiator_bytes": 1646, "last_seen_epoch": "1583962436.365175", "responder_bytes": 3424, "first_seen_epoch": "1583961854.7909" }, { "bytes": 3287, "stream": 206, "flow_id": "flow-17b424573283dde0ba465314", "packets": 33, "transport": "tcp", "last_frame": 16145, "first_frame": 4413, "initiator_ip": "10.3.11.119", "responder_ip": "216.58.194.42", "initiator_port": 49749, "responder_port": 80, "initiator_bytes": 1378, "last_seen_epoch": "1583962436.365266", "responder_bytes": 1909, "first_seen_epoch": "1583961854.792205" }, { "bytes": 26061, "stream": 207, "flow_id": "flow-73c26240a5cd29095aa7ee07", "packets": 57, "transport": "tcp", "last_frame": 16157, "first_frame": 4414, "initiator_ip": "10.3.11.119", "responder_ip": "23.211.18.27", "initiator_port": 49750, "responder_port": 80, "initiator_bytes": 2533, "last_seen_epoch": "1583962436.366122", "responder_bytes": 23528, "first_seen_epoch": "1583961854.794295" }, { "bytes": 172, "stream": 143, "flow_id": "flow-39f85f8b337672a877b200fa", "packets": 2, "transport": "udp", "last_frame": 4438, "first_frame": 4415, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 50409, "responder_port": 53, "initiator_bytes": 70, "last_seen_epoch": "1583961854.840055", "responder_bytes": 102, "first_seen_epoch": "1583961854.795171" }, { "bytes": 394, "stream": 208, "flow_id": "flow-cb2dcc1ea6e24de12043d5ef", "packets": 7, "transport": "tcp", "last_frame": 8232, "first_frame": 4417, "initiator_ip": "10.3.11.119", "responder_ip": "23.211.18.27", "initiator_port": 49751, "responder_port": 80, "initiator_bytes": 228, "last_seen_epoch": "1583961872.499108", "responder_bytes": 166, "first_seen_epoch": "1583961854.799438" }, { "bytes": 7837, "stream": 209, "flow_id": "flow-e280c673cfa8c9cfde5a1302", "packets": 20, "transport": "tcp", "last_frame": 8238, "first_frame": 4418, "initiator_ip": "10.3.11.119", "responder_ip": "23.211.18.27", "initiator_port": 49752, "responder_port": 443, "initiator_bytes": 1095, "last_seen_epoch": "1583961872.49941", "responder_bytes": 6742, "first_seen_epoch": "1583961854.799875" }, { "bytes": 248, "stream": 144, "flow_id": "flow-5724a86c00dcf0ee07c6ac99", "packets": 2, "transport": "udp", "last_frame": 4446, "first_frame": 4419, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 57456, "responder_port": 53, "initiator_bytes": 74, "last_seen_epoch": "1583961854.845638", "responder_bytes": 174, "first_seen_epoch": "1583961854.800699" }, { "bytes": 2631535, "stream": 210, "flow_id": "flow-7e9e89f6919dafcfb939a97c", "packets": 2209, "transport": "tcp", "last_frame": 16167, "first_frame": 4428, "initiator_ip": "10.3.11.119", "responder_ip": "23.209.74.120", "initiator_port": 49753, "responder_port": 80, "initiator_bytes": 28549, "last_seen_epoch": "1583962436.36665", "responder_bytes": 2602986, "first_seen_epoch": "1583961854.811192" }, { "bytes": 304508, "stream": 211, "flow_id": "flow-241d1b2a8f4fcc65974b48ce", "packets": 277, "transport": "tcp", "last_frame": 16163, "first_frame": 4429, "initiator_ip": "10.3.11.119", "responder_ip": "23.209.74.120", "initiator_port": 49754, "responder_port": 80, "initiator_bytes": 4617, "last_seen_epoch": "1583962436.366442", "responder_bytes": 299891, "first_seen_epoch": "1583961854.81146" }, { "bytes": 394, "stream": 212, "flow_id": "flow-75043e50e0682cf783f38218", "packets": 7, "transport": "tcp", "last_frame": 8207, "first_frame": 4430, "initiator_ip": "10.3.11.119", "responder_ip": "23.209.74.120", "initiator_port": 49755, "responder_port": 80, "initiator_bytes": 228, "last_seen_epoch": "1583961872.498628", "responder_bytes": 166, "first_seen_epoch": "1583961854.811858" }, { "bytes": 36191, "stream": 213, "flow_id": "flow-4df33e6db222b9ec78f5db13", "packets": 71, "transport": "tcp", "last_frame": 14687, "first_frame": 4441, "initiator_ip": "10.3.11.119", "responder_ip": "104.26.9.32", "initiator_port": 49756, "responder_port": 443, "initiator_bytes": 2547, "last_seen_epoch": "1583962255.261746", "responder_bytes": 33644, "first_seen_epoch": "1583961854.841276" }, { "bytes": 7784, "stream": 214, "flow_id": "flow-a9720fd17009b0d5d68f27de", "packets": 19, "transport": "tcp", "last_frame": 8192, "first_frame": 4447, "initiator_ip": "10.3.11.119", "responder_ip": "23.211.18.27", "initiator_port": 49757, "responder_port": 443, "initiator_bytes": 1095, "last_seen_epoch": "1583961872.459635", "responder_bytes": 6689, "first_seen_epoch": "1583961854.847454" }, { "bytes": 41072, "stream": 215, "flow_id": "flow-8cc13eddcc94b3743ed2aec0", "packets": 66, "transport": "tcp", "last_frame": 16147, "first_frame": 4497, "initiator_ip": "10.3.11.119", "responder_ip": "216.58.194.131", "initiator_port": 49758, "responder_port": 80, "initiator_bytes": 2531, "last_seen_epoch": "1583962436.365392", "responder_bytes": 38541, "first_seen_epoch": "1583961854.872321" }, { "bytes": 180, "stream": 145, "flow_id": "flow-89032532d9414552a10328a8", "packets": 2, "transport": "udp", "last_frame": 4543, "first_frame": 4537, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 62899, "responder_port": 53, "initiator_bytes": 74, "last_seen_epoch": "1583961854.926971", "responder_bytes": 106, "first_seen_epoch": "1583961854.904733" }, { "bytes": 257, "stream": 146, "flow_id": "flow-1c86a408cc74556edd3eaaee", "packets": 2, "transport": "udp", "last_frame": 4544, "first_frame": 4538, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 54867, "responder_port": 53, "initiator_bytes": 74, "last_seen_epoch": "1583961854.927021", "responder_bytes": 183, "first_seen_epoch": "1583961854.904839" }, { "bytes": 2592, "stream": 216, "flow_id": "flow-0718675dc108f965976aa2c4", "packets": 33, "transport": "tcp", "last_frame": 16171, "first_frame": 4545, "initiator_ip": "10.3.11.119", "responder_ip": "72.246.84.150", "initiator_port": 49759, "responder_port": 80, "initiator_bytes": 1340, "last_seen_epoch": "1583962436.366849", "responder_bytes": 1252, "first_seen_epoch": "1583961854.927665" }, { "bytes": 48734, "stream": 217, "flow_id": "flow-3dbcd30ba15caebb19cbef3a", "packets": 97, "transport": "tcp", "last_frame": 16189, "first_frame": 4546, "initiator_ip": "10.3.11.119", "responder_ip": "52.9.108.55", "initiator_port": 49760, "responder_port": 443, "initiator_bytes": 4223, "last_seen_epoch": "1583962436.425363", "responder_bytes": 44511, "first_seen_epoch": "1583961854.928008" }, { "bytes": 245269, "stream": 218, "flow_id": "flow-d8b7dde8d2a4f43471f54d2c", "packets": 218, "transport": "tcp", "last_frame": 10153, "first_frame": 4569, "initiator_ip": "10.3.11.119", "responder_ip": "72.246.84.150", "initiator_port": 49761, "responder_port": 443, "initiator_bytes": 4021, "last_seen_epoch": "1583961896.460551", "responder_bytes": 241248, "first_seen_epoch": "1583961855.036726" }, { "bytes": 60751, "stream": 219, "flow_id": "flow-8cc6243e286e776f7814a93a", "packets": 99, "transport": "tcp", "last_frame": 10159, "first_frame": 4644, "initiator_ip": "10.3.11.119", "responder_ip": "23.211.18.27", "initiator_port": 49762, "responder_port": 443, "initiator_bytes": 4451, "last_seen_epoch": "1583961896.519565", "responder_bytes": 56300, "first_seen_epoch": "1583961855.183203" }, { "bytes": 233, "stream": 147, "flow_id": "flow-3d4faffe2fc164a133b0b4a7", "packets": 2, "transport": "udp", "last_frame": 4810, "first_frame": 4809, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 53058, "responder_port": 53, "initiator_bytes": 79, "last_seen_epoch": "1583961855.330672", "responder_bytes": 154, "first_seen_epoch": "1583961855.330328" }, { "bytes": 204, "stream": 148, "flow_id": "flow-dc63a462c71c74e78235d429", "packets": 2, "transport": "udp", "last_frame": 4916, "first_frame": 4876, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 62383, "responder_port": 53, "initiator_bytes": 87, "last_seen_epoch": "1583961856.009855", "responder_bytes": 117, "first_seen_epoch": "1583961855.929704" }, { "bytes": 248, "stream": 149, "flow_id": "flow-35d78138f790e5d64990f533", "packets": 2, "transport": "udp", "last_frame": 4886, "first_frame": 4877, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 57173, "responder_port": 53, "initiator_bytes": 75, "last_seen_epoch": "1583961855.968427", "responder_bytes": 173, "first_seen_epoch": "1583961855.929844" }, { "bytes": 104160, "stream": 220, "flow_id": "flow-7e7e50c2d4f486b6a929aeaa", "packets": 118, "transport": "tcp", "last_frame": 16151, "first_frame": 4919, "initiator_ip": "10.3.11.119", "responder_ip": "216.58.194.131", "initiator_port": 49763, "responder_port": 80, "initiator_bytes": 3313, "last_seen_epoch": "1583962436.365631", "responder_bytes": 100847, "first_seen_epoch": "1583961856.048049" }, { "bytes": 394, "stream": 221, "flow_id": "flow-c391f889e660b86c180dc05e", "packets": 7, "transport": "tcp", "last_frame": 8199, "first_frame": 4920, "initiator_ip": "10.3.11.119", "responder_ip": "216.58.194.131", "initiator_port": 49764, "responder_port": 80, "initiator_bytes": 228, "last_seen_epoch": "1583961872.497856", "responder_bytes": 166, "first_seen_epoch": "1583961856.048899" }, { "bytes": 56087, "stream": 222, "flow_id": "flow-48e7d93e4ac4b54c71c9f478", "packets": 79, "transport": "tcp", "last_frame": 16149, "first_frame": 4921, "initiator_ip": "10.3.11.119", "responder_ip": "216.58.194.131", "initiator_port": 49765, "responder_port": 80, "initiator_bytes": 2716, "last_seen_epoch": "1583962436.365512", "responder_bytes": 53371, "first_seen_epoch": "1583961856.049685" }, { "bytes": 394, "stream": 223, "flow_id": "flow-f7f988cd89f2e171ceb39f73", "packets": 7, "transport": "tcp", "last_frame": 8200, "first_frame": 4922, "initiator_ip": "10.3.11.119", "responder_ip": "216.58.194.131", "initiator_port": 49766, "responder_port": 80, "initiator_bytes": 228, "last_seen_epoch": "1583961872.498002", "responder_bytes": 166, "first_seen_epoch": "1583961856.050179" }, { "bytes": 242, "stream": 150, "flow_id": "flow-7b38a73751bf3b6ce7459e2c", "packets": 2, "transport": "udp", "last_frame": 5207, "first_frame": 4925, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 51214, "responder_port": 53, "initiator_bytes": 73, "last_seen_epoch": "1583961856.36048", "responder_bytes": 169, "first_seen_epoch": "1583961856.052929" }, { "bytes": 249, "stream": 151, "flow_id": "flow-a4e2db8c862917b5697f4366", "packets": 2, "transport": "udp", "last_frame": 5227, "first_frame": 4926, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 63285, "responder_port": 53, "initiator_bytes": 78, "last_seen_epoch": "1583961856.360811", "responder_bytes": 171, "first_seen_epoch": "1583961856.053988" }, { "bytes": 240, "stream": 152, "flow_id": "flow-b0956e3744c6fba965ae5e43", "packets": 2, "transport": "udp", "last_frame": 5064, "first_frame": 5033, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 49174, "responder_port": 53, "initiator_bytes": 88, "last_seen_epoch": "1583961856.184965", "responder_bytes": 152, "first_seen_epoch": "1583961856.143539" }, { "bytes": 39392, "stream": 224, "flow_id": "flow-59683c3f1e0eea6b7a8cdda1", "packets": 64, "transport": "tcp", "last_frame": 16153, "first_frame": 5059, "initiator_ip": "10.3.11.119", "responder_ip": "216.58.194.131", "initiator_port": 49767, "responder_port": 80, "initiator_bytes": 2099, "last_seen_epoch": "1583962436.365771", "responder_bytes": 37293, "first_seen_epoch": "1583961856.174067" }, { "bytes": 349981, "stream": 225, "flow_id": "flow-46ad06c753d844838d7aa2da", "packets": 307, "transport": "tcp", "last_frame": 14311, "first_frame": 5090, "initiator_ip": "10.3.11.119", "responder_ip": "13.249.26.99", "initiator_port": 49768, "responder_port": 443, "initiator_bytes": 4653, "last_seen_epoch": "1583962096.484873", "responder_bytes": 345328, "first_seen_epoch": "1583961856.234647" }, { "bytes": 6712, "stream": 226, "flow_id": "flow-03ea2f72fa5f7196af822722", "packets": 17, "transport": "tcp", "last_frame": 5350, "first_frame": 5091, "initiator_ip": "10.3.11.119", "responder_ip": "13.249.26.99", "initiator_port": 49769, "responder_port": 443, "initiator_bytes": 1087, "last_seen_epoch": "1583961856.46145", "responder_bytes": 5625, "first_seen_epoch": "1583961856.234854" }, { "bytes": 6727, "stream": 227, "flow_id": "flow-aa1af0a794822309171d19db", "packets": 16, "transport": "tcp", "last_frame": 5353, "first_frame": 5092, "initiator_ip": "10.3.11.119", "responder_ip": "13.249.26.99", "initiator_port": 49770, "responder_port": 443, "initiator_bytes": 1033, "last_seen_epoch": "1583961856.464678", "responder_bytes": 5694, "first_seen_epoch": "1583961856.235106" }, { "bytes": 6889, "stream": 228, "flow_id": "flow-d51f9781193bf98f32a9c6fe", "packets": 19, "transport": "tcp", "last_frame": 8246, "first_frame": 5093, "initiator_ip": "10.3.11.119", "responder_ip": "13.249.26.99", "initiator_port": 49771, "responder_port": 443, "initiator_bytes": 1141, "last_seen_epoch": "1583961872.499531", "responder_bytes": 5748, "first_seen_epoch": "1583961856.235303" }, { "bytes": 6781, "stream": 229, "flow_id": "flow-9ddf548730e041581ab297e1", "packets": 17, "transport": "tcp", "last_frame": 5346, "first_frame": 5163, "initiator_ip": "10.3.11.119", "responder_ip": "13.249.26.99", "initiator_port": 49772, "responder_port": 443, "initiator_bytes": 1087, "last_seen_epoch": "1583961856.456338", "responder_bytes": 5694, "first_seen_epoch": "1583961856.334847" }, { "bytes": 8110, "stream": 230, "flow_id": "flow-0a44b3e0e7c4780a2df39993", "packets": 24, "transport": "tcp", "last_frame": 10161, "first_frame": 5248, "initiator_ip": "10.3.11.119", "responder_ip": "23.44.170.27", "initiator_port": 49773, "responder_port": 443, "initiator_bytes": 1620, "last_seen_epoch": "1583961896.519772", "responder_bytes": 6490, "first_seen_epoch": "1583961856.365321" }, { "bytes": 26719, "stream": 231, "flow_id": "flow-49220d3c79d74cac4d16ae01", "packets": 51, "transport": "tcp", "last_frame": 16159, "first_frame": 5454, "initiator_ip": "10.3.11.119", "responder_ip": "23.211.18.27", "initiator_port": 49774, "responder_port": 80, "initiator_bytes": 1468, "last_seen_epoch": "1583962436.366222", "responder_bytes": 25251, "first_seen_epoch": "1583961856.582716" }, { "bytes": 13910, "stream": 232, "flow_id": "flow-16eaeb0ff6b0a59808eb20c4", "packets": 21, "transport": "tcp", "last_frame": 7719, "first_frame": 5802, "initiator_ip": "10.3.11.119", "responder_ip": "23.211.18.27", "initiator_port": 49775, "responder_port": 80, "initiator_bytes": 816, "last_seen_epoch": "1583961864.844483", "responder_bytes": 13094, "first_seen_epoch": "1583961856.725954" }, { "bytes": 243, "stream": 153, "flow_id": "flow-c18ea3bb68c249fba57a0f00", "packets": 2, "transport": "udp", "last_frame": 5937, "first_frame": 5936, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 50929, "responder_port": 53, "initiator_bytes": 75, "last_seen_epoch": "1583961856.889136", "responder_bytes": 168, "first_seen_epoch": "1583961856.850533" }, { "bytes": 197, "stream": 154, "flow_id": "flow-72fa6c5b45c171f9d60df702", "packets": 2, "transport": "udp", "last_frame": 5984, "first_frame": 5938, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 64749, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1583961856.929561", "responder_bytes": 121, "first_seen_epoch": "1583961856.893298" }, { "bytes": 208, "stream": 155, "flow_id": "flow-ccc78e60838969f81df44a9f", "packets": 2, "transport": "udp", "last_frame": 5989, "first_frame": 5939, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 59796, "responder_port": 53, "initiator_bytes": 80, "last_seen_epoch": "1583961856.974342", "responder_bytes": 128, "first_seen_epoch": "1583961856.894261" }, { "bytes": 4555, "stream": 233, "flow_id": "flow-03044fba3697b54253743981", "packets": 15, "transport": "tcp", "last_frame": 6310, "first_frame": 6000, "initiator_ip": "10.3.11.119", "responder_ip": "31.13.65.7", "initiator_port": 49776, "responder_port": 443, "initiator_bytes": 971, "last_seen_epoch": "1583961857.341504", "responder_bytes": 3584, "first_seen_epoch": "1583961856.975874" }, { "bytes": 335, "stream": 156, "flow_id": "flow-cfa6dd405ab2fc5e34ac77c0", "packets": 2, "transport": "udp", "last_frame": 6069, "first_frame": 6001, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 54130, "responder_port": 53, "initiator_bytes": 80, "last_seen_epoch": "1583961857.209794", "responder_bytes": 255, "first_seen_epoch": "1583961857.000173" }, { "bytes": 174, "stream": 157, "flow_id": "flow-0fe209ce57edc409a1612f62", "packets": 2, "transport": "udp", "last_frame": 6018, "first_frame": 6002, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 54590, "responder_port": 53, "initiator_bytes": 71, "last_seen_epoch": "1583961857.057731", "responder_bytes": 103, "first_seen_epoch": "1583961857.008064" }, { "bytes": 228, "stream": 158, "flow_id": "flow-557f63a85225a7f7afa7a03b", "packets": 2, "transport": "udp", "last_frame": 6019, "first_frame": 6003, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 59880, "responder_port": 53, "initiator_bytes": 84, "last_seen_epoch": "1583961857.067951", "responder_bytes": 144, "first_seen_epoch": "1583961857.015931" }, { "bytes": 217, "stream": 159, "flow_id": "flow-32077d8937498cb42f21ade2", "packets": 2, "transport": "udp", "last_frame": 6020, "first_frame": 6006, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 51664, "responder_port": 53, "initiator_bytes": 78, "last_seen_epoch": "1583961857.068008", "responder_bytes": 139, "first_seen_epoch": "1583961857.017781" }, { "bytes": 25924, "stream": 234, "flow_id": "flow-ca5952093ccfc381a7acd902", "packets": 63, "transport": "tcp", "last_frame": 16185, "first_frame": 6021, "initiator_ip": "10.3.11.119", "responder_ip": "151.101.50.208", "initiator_port": 49777, "responder_port": 443, "initiator_bytes": 2590, "last_seen_epoch": "1583962436.382276", "responder_bytes": 23334, "first_seen_epoch": "1583961857.069077" }, { "bytes": 27947, "stream": 235, "flow_id": "flow-26cc7c6afbda25690d40a652", "packets": 54, "transport": "tcp", "last_frame": 14315, "first_frame": 6022, "initiator_ip": "10.3.11.119", "responder_ip": "216.58.193.142", "initiator_port": 49778, "responder_port": 443, "initiator_bytes": 2296, "last_seen_epoch": "1583962097.289262", "responder_bytes": 25651, "first_seen_epoch": "1583961857.069348" }, { "bytes": 8226, "stream": 236, "flow_id": "flow-29723c54007adfcd367b79ac", "packets": 26, "transport": "tcp", "last_frame": 10271, "first_frame": 6037, "initiator_ip": "10.3.11.119", "responder_ip": "31.13.65.7", "initiator_port": 49779, "responder_port": 443, "initiator_bytes": 1627, "last_seen_epoch": "1583961922.503542", "responder_bytes": 6599, "first_seen_epoch": "1583961857.144648" }, { "bytes": 33058, "stream": 237, "flow_id": "flow-621e35b7751a6cf43ce96e97", "packets": 57, "transport": "tcp", "last_frame": 16169, "first_frame": 6074, "initiator_ip": "10.3.11.119", "responder_ip": "72.21.91.66", "initiator_port": 49780, "responder_port": 80, "initiator_bytes": 1548, "last_seen_epoch": "1583962436.366737", "responder_bytes": 31510, "first_seen_epoch": "1583961857.235086" }, { "bytes": 125230, "stream": 238, "flow_id": "flow-3438493dc33808fe72ca03c2", "packets": 125, "transport": "tcp", "last_frame": 16161, "first_frame": 6079, "initiator_ip": "10.3.11.119", "responder_ip": "23.209.74.120", "initiator_port": 49781, "responder_port": 80, "initiator_bytes": 2041, "last_seen_epoch": "1583962436.366332", "responder_bytes": 123189, "first_seen_epoch": "1583961857.237651" }, { "bytes": 399812, "stream": 239, "flow_id": "flow-c1bf8552f3d661ab82cb3280", "packets": 333, "transport": "tcp", "last_frame": 16166, "first_frame": 6080, "initiator_ip": "10.3.11.119", "responder_ip": "23.209.74.120", "initiator_port": 49782, "responder_port": 80, "initiator_bytes": 3283, "last_seen_epoch": "1583962436.366608", "responder_bytes": 396529, "first_seen_epoch": "1583961857.238101" }, { "bytes": 394, "stream": 240, "flow_id": "flow-870728fe17b5492c377a6ba9", "packets": 7, "transport": "tcp", "last_frame": 8223, "first_frame": 6082, "initiator_ip": "10.3.11.119", "responder_ip": "72.21.91.66", "initiator_port": 49783, "responder_port": 80, "initiator_bytes": 228, "last_seen_epoch": "1583961872.49884", "responder_bytes": 166, "first_seen_epoch": "1583961857.252044" }, { "bytes": 7108, "stream": 160, "flow_id": "flow-af7e06a17e590485d2a4d607", "packets": 7, "transport": "udp", "last_frame": 6424, "first_frame": 6083, "initiator_ip": "10.3.11.119", "responder_ip": "216.58.193.142", "initiator_port": 51665, "responder_port": 443, "initiator_bytes": 2932, "last_seen_epoch": "1583961857.380398", "responder_bytes": 4176, "first_seen_epoch": "1583961857.26797" }, { "bytes": 33413, "stream": 241, "flow_id": "flow-a52aae8c3c4cdd7ef725899a", "packets": 67, "transport": "tcp", "last_frame": 16177, "first_frame": 6518, "initiator_ip": "10.3.11.119", "responder_ip": "72.21.91.66", "initiator_port": 49784, "responder_port": 443, "initiator_bytes": 4452, "last_seen_epoch": "1583962436.367306", "responder_bytes": 28961, "first_seen_epoch": "1583961857.416852" }, { "bytes": 127366, "stream": 242, "flow_id": "flow-07cf0573a9cbddb5a1d7903d", "packets": 115, "transport": "tcp", "last_frame": 10275, "first_frame": 6824, "initiator_ip": "10.3.11.119", "responder_ip": "31.13.65.7", "initiator_port": 49785, "responder_port": 443, "initiator_bytes": 2198, "last_seen_epoch": "1583961922.828056", "responder_bytes": 125168, "first_seen_epoch": "1583961857.466922" }, { "bytes": 230, "stream": 161, "flow_id": "flow-90d1edd9bce99d3c07036255", "packets": 2, "transport": "udp", "last_frame": 7142, "first_frame": 7057, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 51174, "responder_port": 53, "initiator_bytes": 83, "last_seen_epoch": "1583961857.789491", "responder_bytes": 147, "first_seen_epoch": "1583961857.752218" }, { "bytes": 9123, "stream": 243, "flow_id": "flow-72e40086e190201deac312d3", "packets": 51, "transport": "tcp", "last_frame": 16187, "first_frame": 7143, "initiator_ip": "10.3.11.119", "responder_ip": "104.244.42.8", "initiator_port": 49786, "responder_port": 443, "initiator_bytes": 3045, "last_seen_epoch": "1583962436.425174", "responder_bytes": 6078, "first_seen_epoch": "1583961857.790499" }, { "bytes": 415862, "stream": 244, "flow_id": "flow-f3c3c0232ce8a745f5e8813a", "packets": 419, "transport": "tcp", "last_frame": 12256, "first_frame": 7213, "initiator_ip": "10.3.11.119", "responder_ip": "31.13.93.35", "initiator_port": 49787, "responder_port": 443, "initiator_bytes": 21466, "last_seen_epoch": "1583961985.473662", "responder_bytes": 394396, "first_seen_epoch": "1583961858.000198" }, { "bytes": 4330, "stream": 245, "flow_id": "flow-5ad2798d06f06ad6f9386d47", "packets": 12, "transport": "tcp", "last_frame": 7250, "first_frame": 7218, "initiator_ip": "10.3.11.119", "responder_ip": "31.13.93.35", "initiator_port": 49788, "responder_port": 443, "initiator_bytes": 853, "last_seen_epoch": "1583961858.074401", "responder_bytes": 3477, "first_seen_epoch": "1583961858.025073" }, { "bytes": 178, "stream": 246, "flow_id": "flow-cc8de174e29d28f5c1c85475", "packets": 3, "transport": "tcp", "last_frame": 7244, "first_frame": 7219, "initiator_ip": "10.3.11.119", "responder_ip": "31.13.93.35", "initiator_port": 49789, "responder_port": 443, "initiator_bytes": 120, "last_seen_epoch": "1583961858.074112", "responder_bytes": 58, "first_seen_epoch": "1583961858.035744" }, { "bytes": 249, "stream": 162, "flow_id": "flow-ae37036ea711492e4ea39aaf", "packets": 2, "transport": "udp", "last_frame": 7317, "first_frame": 7316, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 54704, "responder_port": 53, "initiator_bytes": 87, "last_seen_epoch": "1583961858.377882", "responder_bytes": 162, "first_seen_epoch": "1583961858.377611" }, { "bytes": 249, "stream": 163, "flow_id": "flow-37ae9148b6cb5c7c53c74a11", "packets": 2, "transport": "udp", "last_frame": 7320, "first_frame": 7318, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 58103, "responder_port": 53, "initiator_bytes": 87, "last_seen_epoch": "1583961858.378172", "responder_bytes": 162, "first_seen_epoch": "1583961858.377972" }, { "bytes": 243, "stream": 164, "flow_id": "flow-c268fc393ad8b34ab6a3d21c", "packets": 2, "transport": "udp", "last_frame": 7322, "first_frame": 7319, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 56398, "responder_port": 53, "initiator_bytes": 84, "last_seen_epoch": "1583961858.378408", "responder_bytes": 159, "first_seen_epoch": "1583961858.378167" }, { "bytes": 144, "stream": 165, "flow_id": "flow-48bf97dd4e0ea1e4693caf2f", "packets": 2, "transport": "udp", "last_frame": 7565, "first_frame": 7325, "initiator_ip": "10.3.11.119", "responder_ip": "224.0.0.252", "initiator_port": 49529, "responder_port": 5355, "initiator_bytes": 144, "last_seen_epoch": "1583961858.812069", "responder_bytes": 0, "first_seen_epoch": "1583961858.379446" }, { "bytes": 138, "stream": 166, "flow_id": "flow-545d844614cf8e018fcecac1", "packets": 2, "transport": "udp", "last_frame": 7567, "first_frame": 7329, "initiator_ip": "10.3.11.119", "responder_ip": "224.0.0.252", "initiator_port": 58024, "responder_port": 5355, "initiator_bytes": 138, "last_seen_epoch": "1583961858.812414", "responder_bytes": 0, "first_seen_epoch": "1583961858.380611" }, { "bytes": 144, "stream": 167, "flow_id": "flow-f4a4027582fea72e9cde18c9", "packets": 2, "transport": "udp", "last_frame": 7566, "first_frame": 7330, "initiator_ip": "10.3.11.119", "responder_ip": "224.0.0.252", "initiator_port": 50563, "responder_port": 5355, "initiator_bytes": 144, "last_seen_epoch": "1583961858.812225", "responder_bytes": 0, "first_seen_epoch": "1583961858.380926" }, { "bytes": 257, "stream": 168, "flow_id": "flow-a945ba63a3f4b1dd46dbe23f", "packets": 2, "transport": "udp", "last_frame": 7613, "first_frame": 7612, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 65103, "responder_port": 53, "initiator_bytes": 80, "last_seen_epoch": "1583961859.233927", "responder_bytes": 177, "first_seen_epoch": "1583961859.201037" }, { "bytes": 3518, "stream": 247, "flow_id": "flow-b7864ab62012d6e005c4c90c", "packets": 33, "transport": "tcp", "last_frame": 16155, "first_frame": 7614, "initiator_ip": "10.3.11.119", "responder_ip": "23.206.208.173", "initiator_port": 49790, "responder_port": 80, "initiator_bytes": 1943, "last_seen_epoch": "1583962436.365923", "responder_bytes": 1575, "first_seen_epoch": "1583961859.234595" }, { "bytes": 10579, "stream": 248, "flow_id": "flow-5df6d06f2877b5eb31a9f934", "packets": 47, "transport": "tcp", "last_frame": 16175, "first_frame": 7651, "initiator_ip": "10.3.11.119", "responder_ip": "23.206.208.173", "initiator_port": 49791, "responder_port": 443, "initiator_bytes": 3050, "last_seen_epoch": "1583962436.367051", "responder_bytes": 7529, "first_seen_epoch": "1583961859.352057" }, { "bytes": 233, "stream": 169, "flow_id": "flow-8199599260f7ef88606c5bc7", "packets": 2, "transport": "udp", "last_frame": 7699, "first_frame": 7698, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 60671, "responder_port": 53, "initiator_bytes": 79, "last_seen_epoch": "1583961862.500827", "responder_bytes": 154, "first_seen_epoch": "1583961862.500514" }, { "bytes": 128, "stream": 170, "flow_id": "flow-aea99ced89ed2f3bb9d7df4a", "packets": 2, "transport": "udp", "last_frame": 7708, "first_frame": 7702, "initiator_ip": "10.3.11.119", "responder_ip": "224.0.0.252", "initiator_port": 55040, "responder_port": 5355, "initiator_bytes": 128, "last_seen_epoch": "1583961862.912162", "responder_bytes": 0, "first_seen_epoch": "1583961862.502219" }, { "bytes": 233, "stream": 171, "flow_id": "flow-37f441b5de3fd939c97c18df", "packets": 2, "transport": "udp", "last_frame": 7704, "first_frame": 7703, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 60041, "responder_port": 53, "initiator_bytes": 79, "last_seen_epoch": "1583961862.503491", "responder_bytes": 154, "first_seen_epoch": "1583961862.503247" }, { "bytes": 128, "stream": 172, "flow_id": "flow-261787ac9e618874844c4494", "packets": 2, "transport": "udp", "last_frame": 7709, "first_frame": 7707, "initiator_ip": "10.3.11.119", "responder_ip": "224.0.0.252", "initiator_port": 59443, "responder_port": 5355, "initiator_bytes": 128, "last_seen_epoch": "1583961862.915231", "responder_bytes": 0, "first_seen_epoch": "1583961862.505027" }, { "bytes": 2506, "stream": 173, "flow_id": "flow-b4f7a89e04f3129c74651514", "packets": 14, "transport": "udp", "last_frame": 16274, "first_frame": 8024, "initiator_ip": "10.3.11.119", "responder_ip": "239.255.255.250", "initiator_port": 59446, "responder_port": 1900, "initiator_bytes": 2506, "last_seen_epoch": "1583962448.365971", "responder_bytes": 0, "first_seen_epoch": "1583961865.380057" }, { "bytes": 1292, "stream": 249, "flow_id": "flow-5ab282a138c0b5b404072926", "packets": 12, "transport": "tcp", "last_frame": 10172, "first_frame": 8040, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 49795, "responder_port": 135, "initiator_bytes": 730, "last_seen_epoch": "1583961899.093072", "responder_bytes": 562, "first_seen_epoch": "1583961869.478175" }, { "bytes": 2066, "stream": 250, "flow_id": "flow-69a662ab8156ce70bacde68c", "packets": 14, "transport": "tcp", "last_frame": 10171, "first_frame": 8047, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 49796, "responder_port": 49667, "initiator_bytes": 1234, "last_seen_epoch": "1583961899.092932", "responder_bytes": 832, "first_seen_epoch": "1583961869.479673" }, { "bytes": 1578, "stream": 251, "flow_id": "flow-fa93c917bb127a67b57821a8", "packets": 11, "transport": "tcp", "last_frame": 8158, "first_frame": 8066, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 49721, "responder_port": 135, "initiator_bytes": 898, "last_seen_epoch": "1583961870.716405", "responder_bytes": 680, "first_seen_epoch": "1583961870.361387" }, { "bytes": 6697, "stream": 252, "flow_id": "flow-115f83a50ad063fd9d58d96d", "packets": 23, "transport": "tcp", "last_frame": 8159, "first_frame": 8073, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 49722, "responder_port": 49667, "initiator_bytes": 4308, "last_seen_epoch": "1583961870.716551", "responder_bytes": 2389, "first_seen_epoch": "1583961870.366614" }, { "bytes": 7312, "stream": 253, "flow_id": "flow-a92ae5e0440b7c66dbeab860", "packets": 19, "transport": "tcp", "last_frame": 8130, "first_frame": 8096, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 49723, "responder_port": 389, "initiator_bytes": 3352, "last_seen_epoch": "1583961870.400202", "responder_bytes": 3960, "first_seen_epoch": "1583961870.381194" }, { "bytes": 6736, "stream": 254, "flow_id": "flow-f447ce6aa54a4967edb9c101", "packets": 16, "transport": "tcp", "last_frame": 8128, "first_frame": 8113, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 49724, "responder_port": 389, "initiator_bytes": 2757, "last_seen_epoch": "1583961870.399767", "responder_bytes": 3979, "first_seen_epoch": "1583961870.392618" }, { "bytes": 409, "stream": 174, "flow_id": "flow-b148a4b294ed5659798a0b41", "packets": 2, "transport": "udp", "last_frame": 8136, "first_frame": 8135, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 65510, "responder_port": 53, "initiator_bytes": 85, "last_seen_epoch": "1583961870.477543", "responder_bytes": 324, "first_seen_epoch": "1583961870.452904" }, { "bytes": 7479, "stream": 255, "flow_id": "flow-2ce5aa59aa5980e0f227987b", "packets": 20, "transport": "tcp", "last_frame": 8160, "first_frame": 8137, "initiator_ip": "10.3.11.194", "responder_ip": "40.126.0.67", "initiator_port": 49725, "responder_port": 443, "initiator_bytes": 1483, "last_seen_epoch": "1583961870.718012", "responder_bytes": 5996, "first_seen_epoch": "1583961870.478405" }, { "bytes": 292, "stream": 175, "flow_id": "flow-e0948151c5101928e0843954", "packets": 2, "transport": "udp", "last_frame": 8172, "first_frame": 8171, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 65273, "responder_port": 53, "initiator_bytes": 114, "last_seen_epoch": "1583961872.40779", "responder_bytes": 178, "first_seen_epoch": "1583961872.407421" }, { "bytes": 459, "stream": 176, "flow_id": "flow-2d385c7311636529e0c0ef74", "packets": 2, "transport": "udp", "last_frame": 8174, "first_frame": 8173, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 65274, "responder_port": 389, "initiator_bytes": 227, "last_seen_epoch": "1583961872.409164", "responder_bytes": 232, "first_seen_epoch": "1583961872.408782" }, { "bytes": 6819, "stream": 256, "flow_id": "flow-2ef444f14517b9f6c9c7e270", "packets": 15, "transport": "tcp", "last_frame": 8309, "first_frame": 8256, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 49726, "responder_port": 3268, "initiator_bytes": 3108, "last_seen_epoch": "1583961872.551692", "responder_bytes": 3711, "first_seen_epoch": "1583961872.516587" }, { "bytes": 245, "stream": 177, "flow_id": "flow-db20829334ba3c8143a1f374", "packets": 2, "transport": "udp", "last_frame": 8543, "first_frame": 8542, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 53095, "responder_port": 53, "initiator_bytes": 90, "last_seen_epoch": "1583961873.836267", "responder_bytes": 155, "first_seen_epoch": "1583961873.835905" }, { "bytes": 8887, "stream": 257, "flow_id": "flow-ebe57421ef252f89ec548745", "packets": 22, "transport": "tcp", "last_frame": 12241, "first_frame": 8544, "initiator_ip": "10.3.11.119", "responder_ip": "52.109.12.19", "initiator_port": 49797, "responder_port": 443, "initiator_bytes": 1614, "last_seen_epoch": "1583961983.904097", "responder_bytes": 7273, "first_seen_epoch": "1583961873.836735" }, { "bytes": 299, "stream": 178, "flow_id": "flow-dbe9927f050942f4a9bdac1c", "packets": 2, "transport": "udp", "last_frame": 8550, "first_frame": 8549, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 60920, "responder_port": 53, "initiator_bytes": 74, "last_seen_epoch": "1583961873.974309", "responder_bytes": 225, "first_seen_epoch": "1583961873.948506" }, { "bytes": 24901, "stream": 258, "flow_id": "flow-9e9073d44d4d236a8617da15", "packets": 44, "transport": "tcp", "last_frame": 12245, "first_frame": 8551, "initiator_ip": "10.3.11.218", "responder_ip": "40.90.22.185", "initiator_port": 49750, "responder_port": 443, "initiator_bytes": 6620, "last_seen_epoch": "1583961984.288269", "responder_bytes": 18281, "first_seen_epoch": "1583961873.977039" }, { "bytes": 166, "stream": 179, "flow_id": "flow-4b8d05d72f32a7ea5d966d31", "packets": 2, "transport": "udp", "last_frame": 8612, "first_frame": 8611, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 63929, "responder_port": 53, "initiator_bytes": 75, "last_seen_epoch": "1583961876.430841", "responder_bytes": 91, "first_seen_epoch": "1583961876.384749" }, { "bytes": 488507, "stream": 259, "flow_id": "flow-7753d459b9d3d23a494f6dad", "packets": 389, "transport": "tcp", "last_frame": 9001, "first_frame": 8613, "initiator_ip": "10.3.11.194", "responder_ip": "50.87.248.17", "initiator_port": 49727, "responder_port": 80, "initiator_bytes": 3626, "last_seen_epoch": "1583961877.065453", "responder_bytes": 484881, "first_seen_epoch": "1583961876.446849" }, { "bytes": 298, "stream": 180, "flow_id": "flow-94acb004eec2e800032db70e", "packets": 2, "transport": "udp", "last_frame": 9004, "first_frame": 9003, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 63468, "responder_port": 53, "initiator_bytes": 90, "last_seen_epoch": "1583961880.041235", "responder_bytes": 208, "first_seen_epoch": "1583961879.976722" }, { "bytes": 14322, "stream": 260, "flow_id": "flow-be93253dd3f08851b5452541", "packets": 33, "transport": "tcp", "last_frame": 12266, "first_frame": 9005, "initiator_ip": "10.3.11.194", "responder_ip": "52.114.132.73", "initiator_port": 49728, "responder_port": 443, "initiator_bytes": 8732, "last_seen_epoch": "1583961989.964235", "responder_bytes": 5590, "first_seen_epoch": "1583961880.049027" }, { "bytes": 1292, "stream": 261, "flow_id": "flow-bed5e2c4d1e1ab8ff3598a38", "packets": 12, "transport": "tcp", "last_frame": 9820, "first_frame": 9034, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 49754, "responder_port": 135, "initiator_bytes": 730, "last_seen_epoch": "1583961893.949723", "responder_bytes": 562, "first_seen_epoch": "1583961880.396281" }, { "bytes": 2066, "stream": 262, "flow_id": "flow-df28b96398bf663de72075ed", "packets": 14, "transport": "tcp", "last_frame": 9819, "first_frame": 9041, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 49755, "responder_port": 49667, "initiator_bytes": 1234, "last_seen_epoch": "1583961893.949629", "responder_bytes": 832, "first_seen_epoch": "1583961880.398334" }, { "bytes": 233, "stream": 181, "flow_id": "flow-8fe04a6dbab671fac49b0014", "packets": 2, "transport": "udp", "last_frame": 9418, "first_frame": 9417, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 50813, "responder_port": 53, "initiator_bytes": 79, "last_seen_epoch": "1583961886.594398", "responder_bytes": 154, "first_seen_epoch": "1583961886.59406" }, { "bytes": 316, "stream": 182, "flow_id": "flow-ec987439623637ecdb07b3b5", "packets": 2, "transport": "udp", "last_frame": 9739, "first_frame": 9738, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 56200, "responder_port": 53, "initiator_bytes": 126, "last_seen_epoch": "1583961892.292615", "responder_bytes": 190, "first_seen_epoch": "1583961892.292288" }, { "bytes": 495, "stream": 183, "flow_id": "flow-abd1a0f04cfbf6988fbb93f3", "packets": 2, "transport": "udp", "last_frame": 9741, "first_frame": 9740, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 56201, "responder_port": 389, "initiator_bytes": 263, "last_seen_epoch": "1583961892.294031", "responder_bytes": 232, "first_seen_epoch": "1583961892.293716" }, { "bytes": 1512, "stream": 263, "flow_id": "flow-9b0fb005273151ee38fa33f5", "packets": 10, "transport": "tcp", "last_frame": 9810, "first_frame": 9742, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 49798, "responder_port": 135, "initiator_bytes": 832, "last_seen_epoch": "1583961892.451254", "responder_bytes": 680, "first_seen_epoch": "1583961892.40775" }, { "bytes": 6655, "stream": 264, "flow_id": "flow-fc14069521aae89e16547910", "packets": 23, "transport": "tcp", "last_frame": 9811, "first_frame": 9749, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 49799, "responder_port": 49667, "initiator_bytes": 4266, "last_seen_epoch": "1583961892.45155", "responder_bytes": 2389, "first_seen_epoch": "1583961892.413745" }, { "bytes": 7378, "stream": 265, "flow_id": "flow-a52f2080dea2c6fc791a31e0", "packets": 21, "transport": "tcp", "last_frame": 9808, "first_frame": 9772, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 49800, "responder_port": 389, "initiator_bytes": 3364, "last_seen_epoch": "1583961892.448316", "responder_bytes": 4014, "first_seen_epoch": "1583961892.430249" }, { "bytes": 6694, "stream": 266, "flow_id": "flow-39f0d373bdc932fd390ef3cc", "packets": 16, "transport": "tcp", "last_frame": 9804, "first_frame": 9789, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 49801, "responder_port": 389, "initiator_bytes": 2715, "last_seen_epoch": "1583961892.447586", "responder_bytes": 3979, "first_seen_epoch": "1583961892.44115" }, { "bytes": 233, "stream": 184, "flow_id": "flow-b3e75458641aaa7b65cc143a", "packets": 2, "transport": "udp", "last_frame": 9824, "first_frame": 9823, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 63206, "responder_port": 53, "initiator_bytes": 79, "last_seen_epoch": "1583961895.300384", "responder_bytes": 154, "first_seen_epoch": "1583961895.300081" }, { "bytes": 128, "stream": 185, "flow_id": "flow-76cb9f09e89cc0cf108880c8", "packets": 2, "transport": "udp", "last_frame": 9828, "first_frame": 9827, "initiator_ip": "10.3.11.119", "responder_ip": "224.0.0.252", "initiator_port": 55764, "responder_port": 5355, "initiator_bytes": 128, "last_seen_epoch": "1583961895.711917", "responder_bytes": 0, "first_seen_epoch": "1583961895.301879" }, { "bytes": 238, "stream": 186, "flow_id": "flow-903de966e9a7413dacf983f1", "packets": 2, "transport": "udp", "last_frame": 10212, "first_frame": 10206, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 56670, "responder_port": 53, "initiator_bytes": 78, "last_seen_epoch": "1583961911.739107", "responder_bytes": 160, "first_seen_epoch": "1583961911.711934" }, { "bytes": 233, "stream": 187, "flow_id": "flow-5ac5d01509dfdcb6c1d26a33", "packets": 2, "transport": "udp", "last_frame": 10208, "first_frame": 10207, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 51250, "responder_port": 53, "initiator_bytes": 79, "last_seen_epoch": "1583961911.713832", "responder_bytes": 154, "first_seen_epoch": "1583961911.713467" }, { "bytes": 128, "stream": 188, "flow_id": "flow-64c5c605473bd0dd0a9a57f5", "packets": 2, "transport": "udp", "last_frame": 10235, "first_frame": 10211, "initiator_ip": "10.3.11.119", "responder_ip": "224.0.0.252", "initiator_port": 57713, "responder_port": 5355, "initiator_bytes": 128, "last_seen_epoch": "1583961912.125051", "responder_bytes": 0, "first_seen_epoch": "1583961911.715242" }, { "bytes": 11371, "stream": 267, "flow_id": "flow-aa22668aa04c73c69454c635", "packets": 28, "transport": "tcp", "last_frame": 14051, "first_frame": 10213, "initiator_ip": "10.3.11.119", "responder_ip": "13.107.6.158", "initiator_port": 49802, "responder_port": 443, "initiator_bytes": 3371, "last_seen_epoch": "1583962038.92304", "responder_bytes": 8000, "first_seen_epoch": "1583961911.739899" }, { "bytes": 355, "stream": 189, "flow_id": "flow-5c264ece76e84329ed5e180f", "packets": 2, "transport": "udp", "last_frame": 10325, "first_frame": 10324, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 56939, "responder_port": 53, "initiator_bytes": 83, "last_seen_epoch": "1583961934.209558", "responder_bytes": 272, "first_seen_epoch": "1583961934.167029" }, { "bytes": 2004, "stream": 268, "flow_id": "flow-7c0ea2a8089e99aef8bd507f", "packets": 14, "transport": "tcp", "last_frame": 12342, "first_frame": 10326, "initiator_ip": "10.3.11.218", "responder_ip": "8.253.164.248", "initiator_port": 49756, "responder_port": 80, "initiator_bytes": 959, "last_seen_epoch": "1583961994.357508", "responder_bytes": 1045, "first_seen_epoch": "1583961934.212345" }, { "bytes": 245, "stream": 190, "flow_id": "flow-3a0b9083708b83c13ed3649d", "packets": 2, "transport": "udp", "last_frame": 10339, "first_frame": 10338, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 53697, "responder_port": 53, "initiator_bytes": 90, "last_seen_epoch": "1583961936.171143", "responder_bytes": 155, "first_seen_epoch": "1583961936.170865" }, { "bytes": 8885, "stream": 269, "flow_id": "flow-f58d54edee1c8b3e956ac5fb", "packets": 22, "transport": "tcp", "last_frame": 14076, "first_frame": 10340, "initiator_ip": "10.3.11.194", "responder_ip": "52.109.12.19", "initiator_port": 49729, "responder_port": 443, "initiator_bytes": 1612, "last_seen_epoch": "1583962046.219517", "responder_bytes": 7273, "first_seen_epoch": "1583961936.171749" }, { "bytes": 10268, "stream": 270, "flow_id": "flow-281f8d128965671e0241dce5", "packets": 28, "transport": "tcp", "last_frame": 14211, "first_frame": 10358, "initiator_ip": "10.3.11.218", "responder_ip": "204.79.197.200", "initiator_port": 49757, "responder_port": 443, "initiator_bytes": 3338, "last_seen_epoch": "1583962061.512087", "responder_bytes": 6930, "first_seen_epoch": "1583961938.533812" }, { "bytes": 451, "stream": 191, "flow_id": "flow-a9f42cad4550152bde5b1696", "packets": 4, "transport": "udp", "last_frame": 10456, "first_frame": 10443, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 62843, "responder_port": 53, "initiator_bytes": 258, "last_seen_epoch": "1583961954.783018", "responder_bytes": 193, "first_seen_epoch": "1583961950.896457" }, { "bytes": 5176, "stream": 271, "flow_id": "flow-839cf72866e9d81704955eff", "packets": 24, "transport": "tcp", "last_frame": 10480, "first_frame": 10457, "initiator_ip": "10.3.11.194", "responder_ip": "13.68.93.109", "initiator_port": 49730, "responder_port": 443, "initiator_bytes": 1296, "last_seen_epoch": "1583961955.39263", "responder_bytes": 3880, "first_seen_epoch": "1583961954.785969" }, { "bytes": 272, "stream": 192, "flow_id": "flow-698d4be51eae65273e1ebacb", "packets": 2, "transport": "udp", "last_frame": 10482, "first_frame": 10481, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 54610, "responder_port": 53, "initiator_bytes": 74, "last_seen_epoch": "1583961955.604959", "responder_bytes": 198, "first_seen_epoch": "1583961955.59038" }, { "bytes": 26569, "stream": 272, "flow_id": "flow-a4c68a34d55995e0d843391a", "packets": 46, "transport": "tcp", "last_frame": 10539, "first_frame": 10483, "initiator_ip": "10.3.11.194", "responder_ip": "40.90.22.191", "initiator_port": 49731, "responder_port": 443, "initiator_bytes": 6580, "last_seen_epoch": "1583961956.214532", "responder_bytes": 19989, "first_seen_epoch": "1583961955.609469" }, { "bytes": 202, "stream": 193, "flow_id": "flow-5f2f22fcc83d860da5a55cd4", "packets": 2, "transport": "udp", "last_frame": 10496, "first_frame": 10494, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 50346, "responder_port": 53, "initiator_bytes": 77, "last_seen_epoch": "1583961955.805772", "responder_bytes": 125, "first_seen_epoch": "1583961955.768821" }, { "bytes": 2849, "stream": 273, "flow_id": "flow-dac284f53550154a911dcc07", "packets": 12, "transport": "tcp", "last_frame": 13085, "first_frame": 10497, "initiator_ip": "10.3.11.194", "responder_ip": "72.21.91.29", "initiator_port": 49732, "responder_port": 80, "initiator_bytes": 685, "last_seen_epoch": "1583962016.142298", "responder_bytes": 2164, "first_seen_epoch": "1583961955.806692" }, { "bytes": 294, "stream": 194, "flow_id": "flow-e6f3baae26526ffb4e8bb56e", "packets": 2, "transport": "udp", "last_frame": 10540, "first_frame": 10537, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 55580, "responder_port": 53, "initiator_bytes": 86, "last_seen_epoch": "1583961956.376456", "responder_bytes": 208, "first_seen_epoch": "1583961956.185076" }, { "bytes": 22773, "stream": 274, "flow_id": "flow-1e3a296b1e50238770d357d6", "packets": 35, "transport": "tcp", "last_frame": 10575, "first_frame": 10541, "initiator_ip": "10.3.11.194", "responder_ip": "40.91.76.238", "initiator_port": 49733, "responder_port": 443, "initiator_bytes": 7155, "last_seen_epoch": "1583961956.865667", "responder_bytes": 15618, "first_seen_epoch": "1583961956.381264" }, { "bytes": 23753, "stream": 275, "flow_id": "flow-8c64d44ef6bdd7de5010d97f", "packets": 39, "transport": "tcp", "last_frame": 10616, "first_frame": 10576, "initiator_ip": "10.3.11.194", "responder_ip": "40.91.76.238", "initiator_port": 49734, "responder_port": 443, "initiator_bytes": 7447, "last_seen_epoch": "1583961957.503882", "responder_bytes": 16306, "first_seen_epoch": "1583961956.871498" }, { "bytes": 22790, "stream": 276, "flow_id": "flow-f7fbc2ecaf47e4959852df5b", "packets": 35, "transport": "tcp", "last_frame": 10651, "first_frame": 10614, "initiator_ip": "10.3.11.194", "responder_ip": "40.91.76.238", "initiator_port": 49735, "responder_port": 443, "initiator_bytes": 7167, "last_seen_epoch": "1583961957.901053", "responder_bytes": 15623, "first_seen_epoch": "1583961957.436976" }, { "bytes": 23899, "stream": 277, "flow_id": "flow-c08abef9040d290ee0cee6e0", "packets": 39, "transport": "tcp", "last_frame": 10691, "first_frame": 10649, "initiator_ip": "10.3.11.194", "responder_ip": "40.91.76.238", "initiator_port": 49736, "responder_port": 443, "initiator_bytes": 7495, "last_seen_epoch": "1583961958.472788", "responder_bytes": 16404, "first_seen_epoch": "1583961957.842808" }, { "bytes": 23326, "stream": 278, "flow_id": "flow-151702559d477643019d703b", "packets": 38, "transport": "tcp", "last_frame": 10728, "first_frame": 10688, "initiator_ip": "10.3.11.194", "responder_ip": "40.91.76.238", "initiator_port": 49737, "responder_port": 443, "initiator_bytes": 7471, "last_seen_epoch": "1583961958.925688", "responder_bytes": 15855, "first_seen_epoch": "1583961958.348783" }, { "bytes": 23855, "stream": 279, "flow_id": "flow-003a2cb2da40222dab224779", "packets": 39, "transport": "tcp", "last_frame": 10767, "first_frame": 10726, "initiator_ip": "10.3.11.194", "responder_ip": "40.91.76.238", "initiator_port": 49738, "responder_port": 443, "initiator_bytes": 7479, "last_seen_epoch": "1583961959.419939", "responder_bytes": 16376, "first_seen_epoch": "1583961958.878876" }, { "bytes": 22783, "stream": 280, "flow_id": "flow-7d6487df47ec48ccc3f3c860", "packets": 36, "transport": "tcp", "last_frame": 10803, "first_frame": 10765, "initiator_ip": "10.3.11.194", "responder_ip": "40.91.76.238", "initiator_port": 49739, "responder_port": 443, "initiator_bytes": 7197, "last_seen_epoch": "1583961959.798482", "responder_bytes": 15586, "first_seen_epoch": "1583961959.378547" }, { "bytes": 23999, "stream": 281, "flow_id": "flow-bd0a58aca690dc7cbd7653fd", "packets": 41, "transport": "tcp", "last_frame": 10844, "first_frame": 10801, "initiator_ip": "10.3.11.194", "responder_ip": "40.91.76.238", "initiator_port": 49740, "responder_port": 443, "initiator_bytes": 7599, "last_seen_epoch": "1583961960.30199", "responder_bytes": 16400, "first_seen_epoch": "1583961959.759886" }, { "bytes": 23071, "stream": 282, "flow_id": "flow-a863c64555fee43835681a07", "packets": 38, "transport": "tcp", "last_frame": 10882, "first_frame": 10842, "initiator_ip": "10.3.11.194", "responder_ip": "40.91.76.238", "initiator_port": 49741, "responder_port": 443, "initiator_bytes": 7365, "last_seen_epoch": "1583961960.705594", "responder_bytes": 15706, "first_seen_epoch": "1583961960.232956" }, { "bytes": 22833, "stream": 283, "flow_id": "flow-cf92712811fee425faa0cde4", "packets": 36, "transport": "tcp", "last_frame": 10919, "first_frame": 10880, "initiator_ip": "10.3.11.194", "responder_ip": "40.91.76.238", "initiator_port": 49742, "responder_port": 443, "initiator_bytes": 7214, "last_seen_epoch": "1583961961.094451", "responder_bytes": 15619, "first_seen_epoch": "1583961960.655154" }, { "bytes": 23886, "stream": 284, "flow_id": "flow-fd2692098b524f3fee6073a4", "packets": 39, "transport": "tcp", "last_frame": 10958, "first_frame": 10917, "initiator_ip": "10.3.11.194", "responder_ip": "40.91.76.238", "initiator_port": 49743, "responder_port": 443, "initiator_bytes": 7492, "last_seen_epoch": "1583961961.615427", "responder_bytes": 16394, "first_seen_epoch": "1583961961.063723" }, { "bytes": 23719, "stream": 285, "flow_id": "flow-4015c6efa74f4b113bd37bf5", "packets": 39, "transport": "tcp", "last_frame": 10997, "first_frame": 10956, "initiator_ip": "10.3.11.194", "responder_ip": "40.91.76.238", "initiator_port": 49744, "responder_port": 443, "initiator_bytes": 7436, "last_seen_epoch": "1583961962.153845", "responder_bytes": 16283, "first_seen_epoch": "1583961961.579749" }, { "bytes": 22871, "stream": 286, "flow_id": "flow-428f1589f69fe9a4c7c9a7f9", "packets": 36, "transport": "tcp", "last_frame": 11033, "first_frame": 10995, "initiator_ip": "10.3.11.194", "responder_ip": "40.91.76.238", "initiator_port": 49745, "responder_port": 443, "initiator_bytes": 7230, "last_seen_epoch": "1583961962.536082", "responder_bytes": 15641, "first_seen_epoch": "1583961962.102293" }, { "bytes": 23886, "stream": 287, "flow_id": "flow-13d0c7c13e85038333a2ee53", "packets": 39, "transport": "tcp", "last_frame": 11072, "first_frame": 11031, "initiator_ip": "10.3.11.194", "responder_ip": "40.91.76.238", "initiator_port": 49746, "responder_port": 443, "initiator_bytes": 7492, "last_seen_epoch": "1583961963.047999", "responder_bytes": 16394, "first_seen_epoch": "1583961962.492575" }, { "bytes": 23046, "stream": 288, "flow_id": "flow-c630aa55dcd37768990227c9", "packets": 36, "transport": "tcp", "last_frame": 11109, "first_frame": 11070, "initiator_ip": "10.3.11.194", "responder_ip": "40.91.76.238", "initiator_port": 49747, "responder_port": 443, "initiator_bytes": 7286, "last_seen_epoch": "1583961963.48501", "responder_bytes": 15760, "first_seen_epoch": "1583961963.004814" }, { "bytes": 22833, "stream": 289, "flow_id": "flow-064a2c8ad6ffa01712b21d5d", "packets": 36, "transport": "tcp", "last_frame": 11144, "first_frame": 11106, "initiator_ip": "10.3.11.194", "responder_ip": "40.91.76.238", "initiator_port": 49748, "responder_port": 443, "initiator_bytes": 7214, "last_seen_epoch": "1583961963.829937", "responder_bytes": 15619, "first_seen_epoch": "1583961963.3991" }, { "bytes": 22911, "stream": 290, "flow_id": "flow-67735734c7dde456b4786497", "packets": 35, "transport": "tcp", "last_frame": 11179, "first_frame": 11142, "initiator_ip": "10.3.11.194", "responder_ip": "40.91.76.238", "initiator_port": 49749, "responder_port": 443, "initiator_bytes": 7204, "last_seen_epoch": "1583961964.347196", "responder_bytes": 15707, "first_seen_epoch": "1583961963.783585" }, { "bytes": 23027, "stream": 291, "flow_id": "flow-73165cd1fcb543b13620e7e1", "packets": 36, "transport": "tcp", "last_frame": 11221, "first_frame": 11177, "initiator_ip": "10.3.11.194", "responder_ip": "40.91.76.238", "initiator_port": 49750, "responder_port": 443, "initiator_bytes": 7282, "last_seen_epoch": "1583961964.789074", "responder_bytes": 15745, "first_seen_epoch": "1583961964.307612" }, { "bytes": 23299, "stream": 292, "flow_id": "flow-6ff0c7dd3246dbab05b87070", "packets": 37, "transport": "tcp", "last_frame": 11258, "first_frame": 11219, "initiator_ip": "10.3.11.194", "responder_ip": "40.91.76.238", "initiator_port": 49751, "responder_port": 443, "initiator_bytes": 7418, "last_seen_epoch": "1583961965.356983", "responder_bytes": 15881, "first_seen_epoch": "1583961964.719298" }, { "bytes": 22827, "stream": 293, "flow_id": "flow-3432992bd432e0dd41171bb6", "packets": 36, "transport": "tcp", "last_frame": 11297, "first_frame": 11256, "initiator_ip": "10.3.11.194", "responder_ip": "40.91.76.238", "initiator_port": 49752, "responder_port": 443, "initiator_bytes": 7214, "last_seen_epoch": "1583961965.775117", "responder_bytes": 15613, "first_seen_epoch": "1583961965.318233" }, { "bytes": 23036, "stream": 294, "flow_id": "flow-bb70ba98a5718ec5505ab1f1", "packets": 37, "transport": "tcp", "last_frame": 11334, "first_frame": 11295, "initiator_ip": "10.3.11.194", "responder_ip": "40.91.76.238", "initiator_port": 49753, "responder_port": 443, "initiator_bytes": 7320, "last_seen_epoch": "1583961966.192054", "responder_bytes": 15716, "first_seen_epoch": "1583961965.739676" }, { "bytes": 22965, "stream": 295, "flow_id": "flow-452628312ddc7192fc4d0aed", "packets": 36, "transport": "tcp", "last_frame": 11371, "first_frame": 11332, "initiator_ip": "10.3.11.194", "responder_ip": "40.91.76.238", "initiator_port": 49754, "responder_port": 443, "initiator_bytes": 7258, "last_seen_epoch": "1583961966.659378", "responder_bytes": 15707, "first_seen_epoch": "1583961966.147123" }, { "bytes": 23873, "stream": 296, "flow_id": "flow-ca27707bbedd0dc14f2a72a3", "packets": 39, "transport": "tcp", "last_frame": 11409, "first_frame": 11368, "initiator_ip": "10.3.11.194", "responder_ip": "40.91.76.238", "initiator_port": 49755, "responder_port": 443, "initiator_bytes": 7488, "last_seen_epoch": "1583961967.133005", "responder_bytes": 16385, "first_seen_epoch": "1583961966.532746" }, { "bytes": 23548, "stream": 297, "flow_id": "flow-41ed92076235fec0872935d2", "packets": 38, "transport": "tcp", "last_frame": 11447, "first_frame": 11407, "initiator_ip": "10.3.11.194", "responder_ip": "40.91.76.238", "initiator_port": 49756, "responder_port": 443, "initiator_bytes": 7536, "last_seen_epoch": "1583961967.658376", "responder_bytes": 16012, "first_seen_epoch": "1583961967.096034" }, { "bytes": 23721, "stream": 298, "flow_id": "flow-41a04864dfc1c442c52ead62", "packets": 39, "transport": "tcp", "last_frame": 11486, "first_frame": 11445, "initiator_ip": "10.3.11.194", "responder_ip": "40.91.76.238", "initiator_port": 49757, "responder_port": 443, "initiator_bytes": 7436, "last_seen_epoch": "1583961968.126355", "responder_bytes": 16285, "first_seen_epoch": "1583961967.610384" }, { "bytes": 22935, "stream": 299, "flow_id": "flow-74ff4e0eff808e4907c3b4a7", "packets": 35, "transport": "tcp", "last_frame": 11522, "first_frame": 11484, "initiator_ip": "10.3.11.194", "responder_ip": "40.91.76.238", "initiator_port": 49758, "responder_port": 443, "initiator_bytes": 7212, "last_seen_epoch": "1583961968.576495", "responder_bytes": 15723, "first_seen_epoch": "1583961968.076019" }, { "bytes": 22735, "stream": 300, "flow_id": "flow-043a311446bdba7822407855", "packets": 35, "transport": "tcp", "last_frame": 11556, "first_frame": 11519, "initiator_ip": "10.3.11.194", "responder_ip": "40.91.76.238", "initiator_port": 49759, "responder_port": 443, "initiator_bytes": 7144, "last_seen_epoch": "1583961968.984204", "responder_bytes": 15591, "first_seen_epoch": "1583961968.461454" }, { "bytes": 23725, "stream": 301, "flow_id": "flow-ea843fe41094cd0a1f19afc2", "packets": 39, "transport": "tcp", "last_frame": 11595, "first_frame": 11554, "initiator_ip": "10.3.11.194", "responder_ip": "40.91.76.238", "initiator_port": 49760, "responder_port": 443, "initiator_bytes": 7436, "last_seen_epoch": "1583961969.499346", "responder_bytes": 16289, "first_seen_epoch": "1583961968.942775" }, { "bytes": 23764, "stream": 302, "flow_id": "flow-7ba4a76d44a94d896a14de48", "packets": 40, "transport": "tcp", "last_frame": 11636, "first_frame": 11593, "initiator_ip": "10.3.11.194", "responder_ip": "40.91.76.238", "initiator_port": 49761, "responder_port": 443, "initiator_bytes": 7490, "last_seen_epoch": "1583961969.985064", "responder_bytes": 16274, "first_seen_epoch": "1583961969.44933" }, { "bytes": 23886, "stream": 303, "flow_id": "flow-a8b594dcffcb654ec8505d71", "packets": 39, "transport": "tcp", "last_frame": 11674, "first_frame": 11633, "initiator_ip": "10.3.11.194", "responder_ip": "40.91.76.238", "initiator_port": 49762, "responder_port": 443, "initiator_bytes": 7492, "last_seen_epoch": "1583961970.509753", "responder_bytes": 16394, "first_seen_epoch": "1583961969.920358" }, { "bytes": 22809, "stream": 304, "flow_id": "flow-77a71cea94aa49242b67ccd5", "packets": 36, "transport": "tcp", "last_frame": 11710, "first_frame": 11672, "initiator_ip": "10.3.11.194", "responder_ip": "40.91.76.238", "initiator_port": 49763, "responder_port": 443, "initiator_bytes": 7206, "last_seen_epoch": "1583961970.927644", "responder_bytes": 15603, "first_seen_epoch": "1583961970.446386" }, { "bytes": 22883, "stream": 305, "flow_id": "flow-c1bbc8f7de693228a82172a1", "packets": 35, "transport": "tcp", "last_frame": 11746, "first_frame": 11708, "initiator_ip": "10.3.11.194", "responder_ip": "40.91.76.238", "initiator_port": 49764, "responder_port": 443, "initiator_bytes": 7196, "last_seen_epoch": "1583961971.342731", "responder_bytes": 15687, "first_seen_epoch": "1583961970.845596" }, { "bytes": 23481, "stream": 306, "flow_id": "flow-320f1030422bbaecf0978ec4", "packets": 39, "transport": "tcp", "last_frame": 11786, "first_frame": 11743, "initiator_ip": "10.3.11.194", "responder_ip": "40.91.76.238", "initiator_port": 49765, "responder_port": 443, "initiator_bytes": 7434, "last_seen_epoch": "1583961972.488743", "responder_bytes": 16047, "first_seen_epoch": "1583961971.279492" }, { "bytes": 860, "stream": 195, "flow_id": "flow-79299fe876e3a0efe1babc3c", "packets": 4, "transport": "udp", "last_frame": 11924, "first_frame": 11771, "initiator_ip": "10.3.11.119", "responder_ip": "239.255.255.250", "initiator_port": 57715, "responder_port": 1900, "initiator_bytes": 860, "last_seen_epoch": "1583961974.719978", "responder_bytes": 0, "first_seen_epoch": "1583961971.717394" }, { "bytes": 22989, "stream": 307, "flow_id": "flow-3b5e0ea1172d62f03f6c28a8", "packets": 36, "transport": "tcp", "last_frame": 11822, "first_frame": 11783, "initiator_ip": "10.3.11.194", "responder_ip": "40.91.76.238", "initiator_port": 49766, "responder_port": 443, "initiator_bytes": 7266, "last_seen_epoch": "1583961972.958938", "responder_bytes": 15723, "first_seen_epoch": "1583961972.391681" }, { "bytes": 23793, "stream": 308, "flow_id": "flow-3c790794b8e5a55a2c9b254d", "packets": 39, "transport": "tcp", "last_frame": 11861, "first_frame": 11820, "initiator_ip": "10.3.11.194", "responder_ip": "40.91.76.238", "initiator_port": 49767, "responder_port": 443, "initiator_bytes": 7452, "last_seen_epoch": "1583961973.568602", "responder_bytes": 16341, "first_seen_epoch": "1583961972.912878" }, { "bytes": 23175, "stream": 309, "flow_id": "flow-a882a700c2c0e273b16fbc05", "packets": 36, "transport": "tcp", "last_frame": 11900, "first_frame": 11859, "initiator_ip": "10.3.11.194", "responder_ip": "40.91.76.238", "initiator_port": 49768, "responder_port": 443, "initiator_bytes": 7246, "last_seen_epoch": "1583961974.258754", "responder_bytes": 15929, "first_seen_epoch": "1583961973.499098" }, { "bytes": 23114, "stream": 310, "flow_id": "flow-60c186cd558605e037e92ad5", "packets": 35, "transport": "tcp", "last_frame": 11936, "first_frame": 11898, "initiator_ip": "10.3.11.194", "responder_ip": "40.91.76.238", "initiator_port": 49769, "responder_port": 443, "initiator_bytes": 7192, "last_seen_epoch": "1583961974.927044", "responder_bytes": 15922, "first_seen_epoch": "1583961974.18136" }, { "bytes": 22820, "stream": 311, "flow_id": "flow-e188b2245e94124d2c15f183", "packets": 35, "transport": "tcp", "last_frame": 11971, "first_frame": 11934, "initiator_ip": "10.3.11.194", "responder_ip": "40.91.76.238", "initiator_port": 49770, "responder_port": 443, "initiator_bytes": 7176, "last_seen_epoch": "1583961975.344555", "responder_bytes": 15644, "first_seen_epoch": "1583961974.883473" }, { "bytes": 22870, "stream": 312, "flow_id": "flow-66b20fa01014540b85a62cbb", "packets": 36, "transport": "tcp", "last_frame": 12007, "first_frame": 11969, "initiator_ip": "10.3.11.194", "responder_ip": "40.91.76.238", "initiator_port": 49771, "responder_port": 443, "initiator_bytes": 7230, "last_seen_epoch": "1583961975.723589", "responder_bytes": 15640, "first_seen_epoch": "1583961975.265683" }, { "bytes": 23333, "stream": 313, "flow_id": "flow-707cfdcc60661d1f6a5f03af", "packets": 37, "transport": "tcp", "last_frame": 12044, "first_frame": 12005, "initiator_ip": "10.3.11.194", "responder_ip": "40.91.76.238", "initiator_port": 49772, "responder_port": 443, "initiator_bytes": 7310, "last_seen_epoch": "1583961976.463053", "responder_bytes": 16023, "first_seen_epoch": "1583961975.668546" }, { "bytes": 23931, "stream": 314, "flow_id": "flow-1b6ca710d5610783ddfbfab3", "packets": 40, "transport": "tcp", "last_frame": 12084, "first_frame": 12042, "initiator_ip": "10.3.11.194", "responder_ip": "40.91.76.238", "initiator_port": 49773, "responder_port": 443, "initiator_bytes": 7542, "last_seen_epoch": "1583961976.952774", "responder_bytes": 16389, "first_seen_epoch": "1583961976.407773" }, { "bytes": 22863, "stream": 315, "flow_id": "flow-f36afdd8d759bc0e2d42ee03", "packets": 35, "transport": "tcp", "last_frame": 12119, "first_frame": 12082, "initiator_ip": "10.3.11.194", "responder_ip": "40.91.76.238", "initiator_port": 49774, "responder_port": 443, "initiator_bytes": 7188, "last_seen_epoch": "1583961977.3834", "responder_bytes": 15675, "first_seen_epoch": "1583961976.896315" }, { "bytes": 22825, "stream": 316, "flow_id": "flow-21fafddca128e5e88123ff35", "packets": 36, "transport": "tcp", "last_frame": 12155, "first_frame": 12117, "initiator_ip": "10.3.11.194", "responder_ip": "40.91.76.238", "initiator_port": 49775, "responder_port": 443, "initiator_bytes": 7210, "last_seen_epoch": "1583961977.77106", "responder_bytes": 15615, "first_seen_epoch": "1583961977.332827" }, { "bytes": 23747, "stream": 317, "flow_id": "flow-ec20bf89b9efa48d0d94f0da", "packets": 38, "transport": "tcp", "last_frame": 12193, "first_frame": 12153, "initiator_ip": "10.3.11.194", "responder_ip": "40.91.76.238", "initiator_port": 49776, "responder_port": 443, "initiator_bytes": 7410, "last_seen_epoch": "1583961978.296945", "responder_bytes": 16337, "first_seen_epoch": "1583961977.741847" }, { "bytes": 22799, "stream": 318, "flow_id": "flow-55235fb9f654e6ee07adf238", "packets": 35, "transport": "tcp", "last_frame": 12227, "first_frame": 12191, "initiator_ip": "10.3.11.194", "responder_ip": "40.91.76.238", "initiator_port": 49777, "responder_port": 443, "initiator_bytes": 7168, "last_seen_epoch": "1583961978.710484", "responder_bytes": 15631, "first_seen_epoch": "1583961978.257044" }, { "bytes": 44070, "stream": 319, "flow_id": "flow-03829e007000863ae3a40d9e", "packets": 68, "transport": "tcp", "last_frame": 14294, "first_frame": 12306, "initiator_ip": "10.3.11.218", "responder_ip": "40.90.22.185", "initiator_port": 49758, "responder_port": 443, "initiator_bytes": 12137, "last_seen_epoch": "1583962094.004988", "responder_bytes": 31933, "first_seen_epoch": "1583961993.942257" }, { "bytes": 270, "stream": 196, "flow_id": "flow-c15c4f603b944998f20f6365", "packets": 2, "transport": "udp", "last_frame": 12357, "first_frame": 12354, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 55825, "responder_port": 53, "initiator_bytes": 82, "last_seen_epoch": "1583961994.711946", "responder_bytes": 188, "first_seen_epoch": "1583961994.562581" }, { "bytes": 9424, "stream": 320, "flow_id": "flow-ca3c35e20491e42901563f80", "packets": 35, "transport": "tcp", "last_frame": 15705, "first_frame": 12358, "initiator_ip": "10.3.11.218", "responder_ip": "52.242.211.89", "initiator_port": 49759, "responder_port": 443, "initiator_bytes": 3313, "last_seen_epoch": "1583962386.921505", "responder_bytes": 6111, "first_seen_epoch": "1583961994.714835" }, { "bytes": 310, "stream": 197, "flow_id": "flow-99782c9470a92733763a5344", "packets": 2, "transport": "udp", "last_frame": 12412, "first_frame": 12411, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 59547, "responder_port": 53, "initiator_bytes": 83, "last_seen_epoch": "1583961995.556452", "responder_bytes": 227, "first_seen_epoch": "1583961995.533222" }, { "bytes": 10617, "stream": 321, "flow_id": "flow-8f99af1da2afcfb5b94fa1ab", "packets": 30, "transport": "tcp", "last_frame": 12442, "first_frame": 12413, "initiator_ip": "10.3.11.218", "responder_ip": "13.107.246.10", "initiator_port": 49760, "responder_port": 443, "initiator_bytes": 2851, "last_seen_epoch": "1583961996.009996", "responder_bytes": 7766, "first_seen_epoch": "1583961995.559307" }, { "bytes": 213, "stream": 198, "flow_id": "flow-970345c15daf997eefcda8b0", "packets": 2, "transport": "udp", "last_frame": 12452, "first_frame": 12451, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 51577, "responder_port": 53, "initiator_bytes": 73, "last_seen_epoch": "1583962012.93815", "responder_bytes": 140, "first_seen_epoch": "1583962012.911857" }, { "bytes": 9953, "stream": 322, "flow_id": "flow-828d4218a5fa8bd204c336a9", "packets": 27, "transport": "tcp", "last_frame": 14477, "first_frame": 12453, "initiator_ip": "10.3.11.218", "responder_ip": "204.79.197.222", "initiator_port": 49761, "responder_port": 443, "initiator_bytes": 1895, "last_seen_epoch": "1583962141.446591", "responder_bytes": 8058, "first_seen_epoch": "1583962012.942759" }, { "bytes": 220, "stream": 199, "flow_id": "flow-f43fb70f026d4cb94928e9c0", "packets": 2, "transport": "udp", "last_frame": 12477, "first_frame": 12475, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 62757, "responder_port": 53, "initiator_bytes": 72, "last_seen_epoch": "1583962013.872494", "responder_bytes": 148, "first_seen_epoch": "1583962013.75464" }, { "bytes": 265, "stream": 200, "flow_id": "flow-a9c0522042634977a7a688ef", "packets": 2, "transport": "udp", "last_frame": 12478, "first_frame": 12476, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 60598, "responder_port": 53, "initiator_bytes": 72, "last_seen_epoch": "1583962013.872576", "responder_bytes": 193, "first_seen_epoch": "1583962013.755011" }, { "bytes": 247, "stream": 201, "flow_id": "flow-d79ca3c18de87cc40bdd378d", "packets": 2, "transport": "udp", "last_frame": 12480, "first_frame": 12479, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 61421, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1583962014.002923", "responder_bytes": 171, "first_seen_epoch": "1583962013.966655" }, { "bytes": 5713, "stream": 323, "flow_id": "flow-954ac72cdd770a005c76b8be", "packets": 15, "transport": "tcp", "last_frame": 13120, "first_frame": 12481, "initiator_ip": "10.3.11.218", "responder_ip": "23.211.36.128", "initiator_port": 49762, "responder_port": 443, "initiator_bytes": 766, "last_seen_epoch": "1583962016.787125", "responder_bytes": 4947, "first_seen_epoch": "1583962014.098217" }, { "bytes": 6918, "stream": 324, "flow_id": "flow-d850b862463b3b3c36d7f1a9", "packets": 18, "transport": "tcp", "last_frame": 13121, "first_frame": 12482, "initiator_ip": "10.3.11.218", "responder_ip": "23.211.36.128", "initiator_port": 49763, "responder_port": 443, "initiator_bytes": 1299, "last_seen_epoch": "1583962016.787264", "responder_bytes": 5619, "first_seen_epoch": "1583962014.098304" }, { "bytes": 331, "stream": 202, "flow_id": "flow-ff33c9e7adac0e3c4b1b72e4", "packets": 2, "transport": "udp", "last_frame": 12513, "first_frame": 12512, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 51361, "responder_port": 53, "initiator_bytes": 85, "last_seen_epoch": "1583962014.306944", "responder_bytes": 246, "first_seen_epoch": "1583962014.281442" }, { "bytes": 51385, "stream": 325, "flow_id": "flow-d8115a06445a84972902f80d", "packets": 68, "transport": "tcp", "last_frame": 13119, "first_frame": 12514, "initiator_ip": "10.3.11.218", "responder_ip": "52.173.134.115", "initiator_port": 49764, "responder_port": 443, "initiator_bytes": 5234, "last_seen_epoch": "1583962016.786989", "responder_bytes": 46151, "first_seen_epoch": "1583962014.307668" }, { "bytes": 142480, "stream": 326, "flow_id": "flow-f9491bda5ad58af0bf09d889", "packets": 143, "transport": "tcp", "last_frame": 13122, "first_frame": 12515, "initiator_ip": "10.3.11.218", "responder_ip": "52.173.134.115", "initiator_port": 49765, "responder_port": 443, "initiator_bytes": 6801, "last_seen_epoch": "1583962016.787374", "responder_bytes": 135679, "first_seen_epoch": "1583962014.307733" }, { "bytes": 38109, "stream": 327, "flow_id": "flow-31d959e988c6d190399b7de2", "packets": 42, "transport": "tcp", "last_frame": 13123, "first_frame": 12548, "initiator_ip": "10.3.11.218", "responder_ip": "52.173.134.115", "initiator_port": 49766, "responder_port": 443, "initiator_bytes": 1582, "last_seen_epoch": "1583962016.787475", "responder_bytes": 36527, "first_seen_epoch": "1583962014.981509" }, { "bytes": 324, "stream": 203, "flow_id": "flow-5ae94ebea57aa235ce0a57e8", "packets": 2, "transport": "udp", "last_frame": 12625, "first_frame": 12622, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 59288, "responder_port": 53, "initiator_bytes": 113, "last_seen_epoch": "1583962015.260881", "responder_bytes": 211, "first_seen_epoch": "1583962015.215242" }, { "bytes": 7913, "stream": 328, "flow_id": "flow-736241565bfb4e45f5b32987", "packets": 29, "transport": "tcp", "last_frame": 14472, "first_frame": 12626, "initiator_ip": "10.3.11.218", "responder_ip": "204.79.197.254", "initiator_port": 49767, "responder_port": 443, "initiator_bytes": 1715, "last_seen_epoch": "1583962140.186295", "responder_bytes": 6198, "first_seen_epoch": "1583962015.26167" }, { "bytes": 5336, "stream": 329, "flow_id": "flow-035f27ba83acf9e54e4f9c10", "packets": 14, "transport": "tcp", "last_frame": 13124, "first_frame": 12652, "initiator_ip": "10.3.11.218", "responder_ip": "52.173.134.115", "initiator_port": 49768, "responder_port": 443, "initiator_bytes": 753, "last_seen_epoch": "1583962016.787588", "responder_bytes": 4583, "first_seen_epoch": "1583962015.489326" }, { "bytes": 5336, "stream": 330, "flow_id": "flow-1605e860c08f255b998ad131", "packets": 14, "transport": "tcp", "last_frame": 13125, "first_frame": 12657, "initiator_ip": "10.3.11.218", "responder_ip": "52.173.134.115", "initiator_port": 49769, "responder_port": 443, "initiator_bytes": 753, "last_seen_epoch": "1583962016.78767", "responder_bytes": 4583, "first_seen_epoch": "1583962015.49005" }, { "bytes": 5336, "stream": 331, "flow_id": "flow-c77b9658dd7e104e78e2652e", "packets": 14, "transport": "tcp", "last_frame": 13126, "first_frame": 12658, "initiator_ip": "10.3.11.218", "responder_ip": "52.173.134.115", "initiator_port": 49770, "responder_port": 443, "initiator_bytes": 753, "last_seen_epoch": "1583962016.787738", "responder_bytes": 4583, "first_seen_epoch": "1583962015.491234" }, { "bytes": 209, "stream": 204, "flow_id": "flow-d872ef4f487c8782d41bba70", "packets": 2, "transport": "udp", "last_frame": 12660, "first_frame": 12659, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 55053, "responder_port": 53, "initiator_bytes": 82, "last_seen_epoch": "1583962015.538643", "responder_bytes": 127, "first_seen_epoch": "1583962015.493983" }, { "bytes": 64634, "stream": 332, "flow_id": "flow-6863b5926106fc661f316146", "packets": 70, "transport": "tcp", "last_frame": 13127, "first_frame": 12661, "initiator_ip": "10.3.11.218", "responder_ip": "152.199.4.33", "initiator_port": 49771, "responder_port": 443, "initiator_bytes": 1750, "last_seen_epoch": "1583962016.787824", "responder_bytes": 62884, "first_seen_epoch": "1583962015.539236" }, { "bytes": 9104, "stream": 333, "flow_id": "flow-62d4e11fcf94e8d4b304dc88", "packets": 22, "transport": "tcp", "last_frame": 13128, "first_frame": 12662, "initiator_ip": "10.3.11.218", "responder_ip": "152.199.4.33", "initiator_port": 49772, "responder_port": 443, "initiator_bytes": 1005, "last_seen_epoch": "1583962016.7879", "responder_bytes": 8099, "first_seen_epoch": "1583962015.539282" }, { "bytes": 8318, "stream": 334, "flow_id": "flow-717341509ee34aef957dd01b", "packets": 27, "transport": "tcp", "last_frame": 14479, "first_frame": 12830, "initiator_ip": "10.3.11.218", "responder_ip": "13.107.18.254", "initiator_port": 49773, "responder_port": 443, "initiator_bytes": 1839, "last_seen_epoch": "1583962142.591133", "responder_bytes": 6479, "first_seen_epoch": "1583962015.689714" }, { "bytes": 284, "stream": 205, "flow_id": "flow-48d26d8937a4105d9047b718", "packets": 2, "transport": "udp", "last_frame": 12946, "first_frame": 12903, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 57104, "responder_port": 53, "initiator_bytes": 89, "last_seen_epoch": "1583962015.928169", "responder_bytes": 195, "first_seen_epoch": "1583962015.841022" }, { "bytes": 231, "stream": 206, "flow_id": "flow-4c357d6e0a29ea38400b7ec2", "packets": 2, "transport": "udp", "last_frame": 12907, "first_frame": 12906, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 53344, "responder_port": 53, "initiator_bytes": 79, "last_seen_epoch": "1583962015.867946", "responder_bytes": 152, "first_seen_epoch": "1583962015.853494" }, { "bytes": 8133, "stream": 335, "flow_id": "flow-a33ef118eb520803650109de", "packets": 29, "transport": "tcp", "last_frame": 14478, "first_frame": 12908, "initiator_ip": "10.3.11.218", "responder_ip": "13.107.136.254", "initiator_port": 49774, "responder_port": 443, "initiator_bytes": 1658, "last_seen_epoch": "1583962141.613497", "responder_bytes": 6475, "first_seen_epoch": "1583962015.868956" }, { "bytes": 7940, "stream": 336, "flow_id": "flow-c5195f28e0dcb3a5f22bfcf7", "packets": 20, "transport": "tcp", "last_frame": 13129, "first_frame": 12951, "initiator_ip": "10.3.11.218", "responder_ip": "64.4.54.254", "initiator_port": 49775, "responder_port": 443, "initiator_bytes": 2325, "last_seen_epoch": "1583962016.78797", "responder_bytes": 5615, "first_seen_epoch": "1583962015.941477" }, { "bytes": 15032, "stream": 337, "flow_id": "flow-5b94b19cff6cd8bed11054e6", "packets": 32, "transport": "tcp", "last_frame": 13118, "first_frame": 12952, "initiator_ip": "10.3.11.218", "responder_ip": "64.4.54.254", "initiator_port": 49776, "responder_port": 443, "initiator_bytes": 7677, "last_seen_epoch": "1583962016.725954", "responder_bytes": 7355, "first_seen_epoch": "1583962015.941729" }, { "bytes": 7939, "stream": 338, "flow_id": "flow-f6e12c181960beb4e32ca190", "packets": 20, "transport": "tcp", "last_frame": 13130, "first_frame": 12953, "initiator_ip": "10.3.11.218", "responder_ip": "64.4.54.254", "initiator_port": 49777, "responder_port": 443, "initiator_bytes": 2324, "last_seen_epoch": "1583962016.788048", "responder_bytes": 5615, "first_seen_epoch": "1583962015.942378" }, { "bytes": 7938, "stream": 339, "flow_id": "flow-3bd484fb29e4175f776a7307", "packets": 20, "transport": "tcp", "last_frame": 13131, "first_frame": 12954, "initiator_ip": "10.3.11.218", "responder_ip": "64.4.54.254", "initiator_port": 49778, "responder_port": 443, "initiator_bytes": 2323, "last_seen_epoch": "1583962016.788112", "responder_bytes": 5615, "first_seen_epoch": "1583962015.942579" }, { "bytes": 7998, "stream": 340, "flow_id": "flow-1116113813372a304c3c548d", "packets": 21, "transport": "tcp", "last_frame": 13132, "first_frame": 12955, "initiator_ip": "10.3.11.218", "responder_ip": "64.4.54.254", "initiator_port": 49779, "responder_port": 443, "initiator_bytes": 2383, "last_seen_epoch": "1583962016.788218", "responder_bytes": 5615, "first_seen_epoch": "1583962015.943002" }, { "bytes": 7939, "stream": 341, "flow_id": "flow-d4c8cf71277ac2311565162b", "packets": 20, "transport": "tcp", "last_frame": 13133, "first_frame": 12956, "initiator_ip": "10.3.11.218", "responder_ip": "64.4.54.254", "initiator_port": 49780, "responder_port": 443, "initiator_bytes": 2324, "last_seen_epoch": "1583962016.788304", "responder_bytes": 5615, "first_seen_epoch": "1583962015.944148" }, { "bytes": 29272, "stream": 342, "flow_id": "flow-00a99fadd5cff40e31a765ed", "packets": 145, "transport": "tcp", "last_frame": 14055, "first_frame": 13134, "initiator_ip": "10.3.11.218", "responder_ip": "13.107.5.80", "initiator_port": 49781, "responder_port": 443, "initiator_bytes": 8721, "last_seen_epoch": "1583962039.248946", "responder_bytes": 20551, "first_seen_epoch": "1583962020.825554" }, { "bytes": 7643, "stream": 343, "flow_id": "flow-935915aa3f5d0b733782bf07", "packets": 22, "transport": "tcp", "last_frame": 14054, "first_frame": 13135, "initiator_ip": "10.3.11.218", "responder_ip": "13.107.5.80", "initiator_port": 49782, "responder_port": 443, "initiator_bytes": 1081, "last_seen_epoch": "1583962039.248722", "responder_bytes": 6562, "first_seen_epoch": "1583962020.825727" }, { "bytes": 172, "stream": 207, "flow_id": "flow-798f66d5b1dc6277d2330094", "packets": 2, "transport": "udp", "last_frame": 13302, "first_frame": 13301, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 51781, "responder_port": 53, "initiator_bytes": 78, "last_seen_epoch": "1583962027.252924", "responder_bytes": 94, "first_seen_epoch": "1583962027.181355" }, { "bytes": 69618, "stream": 344, "flow_id": "flow-c9f3825c456532b8a0ee8623", "packets": 70, "transport": "tcp", "last_frame": 14053, "first_frame": 13303, "initiator_ip": "10.3.11.218", "responder_ip": "65.254.227.240", "initiator_port": 49783, "responder_port": 80, "initiator_bytes": 1997, "last_seen_epoch": "1583962039.248567", "responder_bytes": 67621, "first_seen_epoch": "1583962027.253624" }, { "bytes": 150223, "stream": 345, "flow_id": "flow-1ab5e077c94d60b97cf703cd", "packets": 140, "transport": "tcp", "last_frame": 14052, "first_frame": 13304, "initiator_ip": "10.3.11.218", "responder_ip": "65.254.227.240", "initiator_port": 49784, "responder_port": 80, "initiator_bytes": 2555, "last_seen_epoch": "1583962039.248449", "responder_bytes": 147668, "first_seen_epoch": "1583962027.253703" }, { "bytes": 4605, "stream": 346, "flow_id": "flow-ce43a5ed984313ab4e5d6bf6", "packets": 10, "transport": "tcp", "last_frame": 14058, "first_frame": 13328, "initiator_ip": "10.3.11.218", "responder_ip": "65.254.227.240", "initiator_port": 49785, "responder_port": 80, "initiator_bytes": 616, "last_seen_epoch": "1583962039.249351", "responder_bytes": 3989, "first_seen_epoch": "1583962027.43214" }, { "bytes": 23594, "stream": 347, "flow_id": "flow-001bbae6b89e260a9c112569", "packets": 26, "transport": "tcp", "last_frame": 14059, "first_frame": 13329, "initiator_ip": "10.3.11.218", "responder_ip": "65.254.227.240", "initiator_port": 49786, "responder_port": 80, "initiator_bytes": 831, "last_seen_epoch": "1583962039.249468", "responder_bytes": 22763, "first_seen_epoch": "1583962027.433982" }, { "bytes": 4854, "stream": 348, "flow_id": "flow-527e1b896a2e6695cc062901", "packets": 10, "transport": "tcp", "last_frame": 14061, "first_frame": 13330, "initiator_ip": "10.3.11.218", "responder_ip": "65.254.227.240", "initiator_port": 49787, "responder_port": 80, "initiator_bytes": 615, "last_seen_epoch": "1583962039.249611", "responder_bytes": 4239, "first_seen_epoch": "1583962027.435985" }, { "bytes": 5082, "stream": 349, "flow_id": "flow-67fc581be251f9bededc2c7f", "packets": 10, "transport": "tcp", "last_frame": 14063, "first_frame": 13331, "initiator_ip": "10.3.11.218", "responder_ip": "65.254.227.240", "initiator_port": 49788, "responder_port": 80, "initiator_bytes": 618, "last_seen_epoch": "1583962039.249763", "responder_bytes": 4464, "first_seen_epoch": "1583962027.437677" }, { "bytes": 207, "stream": 208, "flow_id": "flow-a6a2cec3325cd7525a157243", "packets": 2, "transport": "udp", "last_frame": 13334, "first_frame": 13332, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 60740, "responder_port": 53, "initiator_bytes": 78, "last_seen_epoch": "1583962027.473726", "responder_bytes": 129, "first_seen_epoch": "1583962027.442392" }, { "bytes": 180, "stream": 209, "flow_id": "flow-101456c3e9c1c9f2d5debe3a", "packets": 2, "transport": "udp", "last_frame": 13391, "first_frame": 13333, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 54789, "responder_port": 53, "initiator_bytes": 82, "last_seen_epoch": "1583962027.518423", "responder_bytes": 98, "first_seen_epoch": "1583962027.448432" }, { "bytes": 232, "stream": 350, "flow_id": "flow-7c12f75381a0fa100657cd45", "packets": 4, "transport": "tcp", "last_frame": 14062, "first_frame": 13335, "initiator_ip": "10.3.11.218", "responder_ip": "172.217.6.144", "initiator_port": 49789, "responder_port": 80, "initiator_bytes": 174, "last_seen_epoch": "1583962039.249691", "responder_bytes": 58, "first_seen_epoch": "1583962027.474539" }, { "bytes": 82486, "stream": 351, "flow_id": "flow-4c92a42e677450931ab966b8", "packets": 83, "transport": "tcp", "last_frame": 14064, "first_frame": 13336, "initiator_ip": "10.3.11.218", "responder_ip": "172.217.6.144", "initiator_port": 49790, "responder_port": 80, "initiator_bytes": 2152, "last_seen_epoch": "1583962039.249859", "responder_bytes": 80334, "first_seen_epoch": "1583962027.474605" }, { "bytes": 332, "stream": 210, "flow_id": "flow-4e29cdbc812ec03960e5461a", "packets": 4, "transport": "udp", "last_frame": 13828, "first_frame": 13387, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 56419, "responder_port": 53, "initiator_bytes": 237, "last_seen_epoch": "1583962031.453069", "responder_bytes": 95, "first_seen_epoch": "1583962027.49785" }, { "bytes": 63069, "stream": 352, "flow_id": "flow-484e6079696c8959d9e7447a", "packets": 57, "transport": "tcp", "last_frame": 14056, "first_frame": 13392, "initiator_ip": "10.3.11.218", "responder_ip": "65.254.227.240", "initiator_port": 49791, "responder_port": 80, "initiator_bytes": 1108, "last_seen_epoch": "1583962039.249127", "responder_bytes": 61961, "first_seen_epoch": "1583962027.519165" }, { "bytes": 73519, "stream": 353, "flow_id": "flow-5428f2a6fa5d85ab043ece9a", "packets": 63, "transport": "tcp", "last_frame": 14060, "first_frame": 13393, "initiator_ip": "10.3.11.218", "responder_ip": "65.254.227.240", "initiator_port": 49792, "responder_port": 80, "initiator_bytes": 1051, "last_seen_epoch": "1583962039.249547", "responder_bytes": 72468, "first_seen_epoch": "1583962027.519209" }, { "bytes": 78996, "stream": 354, "flow_id": "flow-81d68debc0b7d7407d727925", "packets": 69, "transport": "tcp", "last_frame": 14066, "first_frame": 13394, "initiator_ip": "10.3.11.218", "responder_ip": "65.254.227.240", "initiator_port": 49793, "responder_port": 80, "initiator_bytes": 1160, "last_seen_epoch": "1583962039.250137", "responder_bytes": 77836, "first_seen_epoch": "1583962027.51942" }, { "bytes": 72990, "stream": 355, "flow_id": "flow-18ab79ba7b42507c39cb53cb", "packets": 64, "transport": "tcp", "last_frame": 14065, "first_frame": 13395, "initiator_ip": "10.3.11.218", "responder_ip": "65.254.227.240", "initiator_port": 49794, "responder_port": 80, "initiator_bytes": 1111, "last_seen_epoch": "1583962039.250046", "responder_bytes": 71879, "first_seen_epoch": "1583962027.519459" }, { "bytes": 41642, "stream": 356, "flow_id": "flow-678b7e7ab2fa5e60dcc9a3d7", "packets": 52, "transport": "tcp", "last_frame": 14057, "first_frame": 13829, "initiator_ip": "10.3.11.218", "responder_ip": "172.217.12.74", "initiator_port": 49795, "responder_port": 443, "initiator_bytes": 1482, "last_seen_epoch": "1583962039.249223", "responder_bytes": 40160, "first_seen_epoch": "1583962031.453804" }, { "bytes": 4898, "stream": 357, "flow_id": "flow-289232d48e5de3246ab36840", "packets": 20, "transport": "tcp", "last_frame": 14067, "first_frame": 13830, "initiator_ip": "10.3.11.218", "responder_ip": "172.217.12.74", "initiator_port": 49796, "responder_port": 443, "initiator_bytes": 969, "last_seen_epoch": "1583962039.250222", "responder_bytes": 3929, "first_seen_epoch": "1583962031.453845" }, { "bytes": 34996, "stream": 358, "flow_id": "flow-2c968f8ecdbd0aecab7e15b8", "packets": 36, "transport": "tcp", "last_frame": 14068, "first_frame": 13831, "initiator_ip": "10.3.11.218", "responder_ip": "172.217.12.74", "initiator_port": 49797, "responder_port": 80, "initiator_bytes": 930, "last_seen_epoch": "1583962039.250341", "responder_bytes": 34066, "first_seen_epoch": "1583962031.453999" }, { "bytes": 270, "stream": 211, "flow_id": "flow-1d4a28dc68d4d142d294ecd8", "packets": 2, "transport": "udp", "last_frame": 14081, "first_frame": 14080, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 61335, "responder_port": 53, "initiator_bytes": 82, "last_seen_epoch": "1583962054.581731", "responder_bytes": 188, "first_seen_epoch": "1583962054.455424" }, { "bytes": 9013, "stream": 359, "flow_id": "flow-15d81bd46fc9d1d279cd6aae", "packets": 34, "transport": "tcp", "last_frame": 30239, "first_frame": 14082, "initiator_ip": "10.3.11.218", "responder_ip": "52.242.211.89", "initiator_port": 49798, "responder_port": 443, "initiator_bytes": 2946, "last_seen_epoch": "1583964400.899336", "responder_bytes": 6067, "first_seen_epoch": "1583962054.582309" }, { "bytes": 265, "stream": 212, "flow_id": "flow-ba54ccf4b725bccdfddc65c9", "packets": 2, "transport": "udp", "last_frame": 14092, "first_frame": 14087, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 58992, "responder_port": 53, "initiator_bytes": 72, "last_seen_epoch": "1583962054.68448", "responder_bytes": 193, "first_seen_epoch": "1583962054.667278" }, { "bytes": 10915, "stream": 360, "flow_id": "flow-6c0d4a67d4fb0b7deb4c04de", "packets": 27, "transport": "tcp", "last_frame": 14436, "first_frame": 14095, "initiator_ip": "10.3.11.218", "responder_ip": "204.79.197.200", "initiator_port": 49799, "responder_port": 443, "initiator_bytes": 3059, "last_seen_epoch": "1583962114.830515", "responder_bytes": 7856, "first_seen_epoch": "1583962054.68605" }, { "bytes": 316, "stream": 213, "flow_id": "flow-b1987c12aff9d0019484a35f", "packets": 2, "transport": "udp", "last_frame": 14137, "first_frame": 14136, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 56549, "responder_port": 53, "initiator_bytes": 126, "last_seen_epoch": "1583962055.558822", "responder_bytes": 190, "first_seen_epoch": "1583962055.5585" }, { "bytes": 495, "stream": 214, "flow_id": "flow-ca63a91bd09ec1f29ae385db", "packets": 2, "transport": "udp", "last_frame": 14139, "first_frame": 14138, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 56550, "responder_port": 389, "initiator_bytes": 263, "last_seen_epoch": "1583962055.560005", "responder_bytes": 232, "first_seen_epoch": "1583962055.559693" }, { "bytes": 1512, "stream": 361, "flow_id": "flow-255de803ef27b1675295af9c", "packets": 10, "transport": "tcp", "last_frame": 14209, "first_frame": 14140, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 49800, "responder_port": 135, "initiator_bytes": 832, "last_seen_epoch": "1583962055.715669", "responder_bytes": 680, "first_seen_epoch": "1583962055.68099" }, { "bytes": 6589, "stream": 362, "flow_id": "flow-36880c95329689325157b9a9", "packets": 22, "transport": "tcp", "last_frame": 14210, "first_frame": 14147, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 49801, "responder_port": 49667, "initiator_bytes": 4200, "last_seen_epoch": "1583962055.716318", "responder_bytes": 2389, "first_seen_epoch": "1583962055.685831" }, { "bytes": 7378, "stream": 363, "flow_id": "flow-f6aa5d1d60070af637704607", "packets": 21, "transport": "tcp", "last_frame": 14208, "first_frame": 14170, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 49802, "responder_port": 389, "initiator_bytes": 3364, "last_seen_epoch": "1583962055.710629", "responder_bytes": 4014, "first_seen_epoch": "1583962055.696602" }, { "bytes": 6802, "stream": 364, "flow_id": "flow-21cf936398d713d418a46f19", "packets": 18, "transport": "tcp", "last_frame": 14204, "first_frame": 14187, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 49803, "responder_port": 389, "initiator_bytes": 2769, "last_seen_epoch": "1583962055.710162", "responder_bytes": 4033, "first_seen_epoch": "1583962055.705245" }, { "bytes": 15187, "stream": 365, "flow_id": "flow-ffa06f994a132e6432792ae3", "packets": 33, "transport": "tcp", "last_frame": 14592, "first_frame": 14259, "initiator_ip": "10.3.11.218", "responder_ip": "52.114.77.34", "initiator_port": 49804, "responder_port": 443, "initiator_bytes": 7702, "last_seen_epoch": "1583962196.40767", "responder_bytes": 7485, "first_seen_epoch": "1583962086.266405" }, { "bytes": 860, "stream": 215, "flow_id": "flow-699c86e8b8806090ca8ad32e", "packets": 4, "transport": "udp", "last_frame": 14295, "first_frame": 14288, "initiator_ip": "10.3.11.119", "responder_ip": "239.255.255.250", "initiator_port": 57717, "responder_port": 1900, "initiator_bytes": 860, "last_seen_epoch": "1583962094.725001", "responder_bytes": 0, "first_seen_epoch": "1583962091.721089" }, { "bytes": 12046, "stream": 366, "flow_id": "flow-d763152116eadda68782d82f", "packets": 30, "transport": "tcp", "last_frame": 14661, "first_frame": 14316, "initiator_ip": "10.3.11.194", "responder_ip": "52.114.77.34", "initiator_port": 49778, "responder_port": 443, "initiator_bytes": 4669, "last_seen_epoch": "1583962222.365609", "responder_bytes": 7377, "first_seen_epoch": "1583962112.225453" }, { "bytes": 316, "stream": 216, "flow_id": "flow-ed457e7585645da2b971f7a3", "packets": 2, "transport": "udp", "last_frame": 14343, "first_frame": 14342, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 53030, "responder_port": 53, "initiator_bytes": 126, "last_seen_epoch": "1583962113.697369", "responder_bytes": 190, "first_seen_epoch": "1583962113.696961" }, { "bytes": 495, "stream": 217, "flow_id": "flow-1efaad0204d12cdb1d7657ab", "packets": 2, "transport": "udp", "last_frame": 14345, "first_frame": 14344, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 53031, "responder_port": 389, "initiator_bytes": 263, "last_seen_epoch": "1583962113.698502", "responder_bytes": 232, "first_seen_epoch": "1583962113.698271" }, { "bytes": 1512, "stream": 367, "flow_id": "flow-a03014ea702a185ef5c78adc", "packets": 10, "transport": "tcp", "last_frame": 14415, "first_frame": 14346, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 49803, "responder_port": 135, "initiator_bytes": 832, "last_seen_epoch": "1583962113.834992", "responder_bytes": 680, "first_seen_epoch": "1583962113.80654" }, { "bytes": 6589, "stream": 368, "flow_id": "flow-07a9ce0036a6ec6261c53f83", "packets": 22, "transport": "tcp", "last_frame": 14416, "first_frame": 14353, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 49804, "responder_port": 49667, "initiator_bytes": 4200, "last_seen_epoch": "1583962113.835316", "responder_bytes": 2389, "first_seen_epoch": "1583962113.810417" }, { "bytes": 7378, "stream": 369, "flow_id": "flow-6e16160297e01fd9d06d23f2", "packets": 21, "transport": "tcp", "last_frame": 14414, "first_frame": 14376, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 49805, "responder_port": 389, "initiator_bytes": 3364, "last_seen_epoch": "1583962113.83234", "responder_bytes": 4014, "first_seen_epoch": "1583962113.819745" }, { "bytes": 6802, "stream": 370, "flow_id": "flow-917f5c2cf8be7f1a596be911", "packets": 18, "transport": "tcp", "last_frame": 14410, "first_frame": 14393, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 49806, "responder_port": 389, "initiator_bytes": 2769, "last_seen_epoch": "1583962113.83178", "responder_bytes": 4033, "first_seen_epoch": "1583962113.826519" }, { "bytes": 343, "stream": 218, "flow_id": "flow-ac12533ceba906435a046de2", "packets": 3, "transport": "udp", "last_frame": 14421, "first_frame": 14419, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 58860, "responder_port": 53, "initiator_bytes": 184, "last_seen_epoch": "1583962114.660248", "responder_bytes": 159, "first_seen_epoch": "1583962114.533183" }, { "bytes": 8751, "stream": 371, "flow_id": "flow-a49af27465aea34d93d83b9c", "packets": 20, "transport": "tcp", "last_frame": 14674, "first_frame": 14422, "initiator_ip": "10.3.11.218", "responder_ip": "52.109.8.30", "initiator_port": 49805, "responder_port": 443, "initiator_bytes": 1322, "last_seen_epoch": "1583962237.925912", "responder_bytes": 7429, "first_seen_epoch": "1583962114.660986" }, { "bytes": 15242, "stream": 372, "flow_id": "flow-b06c58cab79b8a4be32ec003", "packets": 33, "transport": "tcp", "last_frame": 14681, "first_frame": 14480, "initiator_ip": "10.3.11.119", "responder_ip": "52.114.132.73", "initiator_port": 49807, "responder_port": 443, "initiator_bytes": 7758, "last_seen_epoch": "1583962253.65866", "responder_bytes": 7484, "first_seen_epoch": "1583962143.557308" }, { "bytes": 10030, "stream": 373, "flow_id": "flow-895d78d6da7c31ccc602f188", "packets": 24, "transport": "tcp", "last_frame": 14532, "first_frame": 14509, "initiator_ip": "10.3.11.194", "responder_ip": "52.114.132.73", "initiator_port": 49779, "responder_port": 443, "initiator_bytes": 4712, "last_seen_epoch": "1583962156.397281", "responder_bytes": 5318, "first_seen_epoch": "1583962155.887182" }, { "bytes": 252, "stream": 374, "flow_id": "flow-4247b4d52cc94adbe7f3b4d7", "packets": 4, "transport": "tcp", "last_frame": 14596, "first_frame": 14593, "initiator_ip": "10.3.11.194", "responder_ip": "185.141.27.238", "initiator_port": 49780, "responder_port": 443, "initiator_bytes": 198, "last_seen_epoch": "1583962203.728441", "responder_bytes": 54, "first_seen_epoch": "1583962196.854388" }, { "bytes": 120, "stream": 375, "flow_id": "flow-e34ea083d8cd9492f481405f", "packets": 2, "transport": "tcp", "last_frame": 14602, "first_frame": 14599, "initiator_ip": "10.3.11.194", "responder_ip": "185.141.27.238", "initiator_port": 49780, "responder_port": 443, "initiator_bytes": 66, "last_seen_epoch": "1583962210.643371", "responder_bytes": 54, "first_seen_epoch": "1583962204.257563" }, { "bytes": 120, "stream": 376, "flow_id": "flow-7632d7506022e55faa69900e", "packets": 2, "transport": "tcp", "last_frame": 14620, "first_frame": 14603, "initiator_ip": "10.3.11.194", "responder_ip": "185.141.27.238", "initiator_port": 49780, "responder_port": 443, "initiator_bytes": 66, "last_seen_epoch": "1583962216.837513", "responder_bytes": 54, "first_seen_epoch": "1583962211.148581" }, { "bytes": 860, "stream": 219, "flow_id": "flow-9abb64b16ea3217e41a076b8", "packets": 4, "transport": "udp", "last_frame": 14609, "first_frame": 14606, "initiator_ip": "10.3.11.119", "responder_ip": "239.255.255.250", "initiator_port": 53033, "responder_port": 1900, "initiator_bytes": 860, "last_seen_epoch": "1583962214.72724", "responder_bytes": 0, "first_seen_epoch": "1583962211.723631" }, { "bytes": 168, "stream": 220, "flow_id": "flow-0bdafcd996d23445fbe7f219", "packets": 2, "transport": "udp", "last_frame": 14615, "first_frame": 14614, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 55092, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1583962215.989692", "responder_bytes": 92, "first_seen_epoch": "1583962215.914197" }, { "bytes": 233, "stream": 221, "flow_id": "flow-34f3a873d1f7a03a6b331bdd", "packets": 2, "transport": "udp", "last_frame": 14638, "first_frame": 14637, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 55314, "responder_port": 53, "initiator_bytes": 79, "last_seen_epoch": "1583962217.840598", "responder_bytes": 154, "first_seen_epoch": "1583962217.840321" }, { "bytes": 128, "stream": 222, "flow_id": "flow-2edf7467de099feaa07db0a9", "packets": 2, "transport": "udp", "last_frame": 14646, "first_frame": 14641, "initiator_ip": "10.3.11.119", "responder_ip": "224.0.0.252", "initiator_port": 49999, "responder_port": 5355, "initiator_bytes": 128, "last_seen_epoch": "1583962218.251867", "responder_bytes": 0, "first_seen_epoch": "1583962217.84215" }, { "bytes": 252, "stream": 377, "flow_id": "flow-8fc34c3345ebf4c85884270c", "packets": 4, "transport": "tcp", "last_frame": 14682, "first_frame": 14675, "initiator_ip": "10.3.11.194", "responder_ip": "185.141.27.238", "initiator_port": 49781, "responder_port": 443, "initiator_bytes": 198, "last_seen_epoch": "1583962254.056609", "responder_bytes": 54, "first_seen_epoch": "1583962247.867721" }, { "bytes": 120, "stream": 378, "flow_id": "flow-97d95a3a97a024107c7965a1", "packets": 2, "transport": "tcp", "last_frame": 14692, "first_frame": 14683, "initiator_ip": "10.3.11.194", "responder_ip": "185.141.27.238", "initiator_port": 49781, "responder_port": 443, "initiator_bytes": 66, "last_seen_epoch": "1583962260.22678", "responder_bytes": 54, "first_seen_epoch": "1583962254.570988" }, { "bytes": 120, "stream": 379, "flow_id": "flow-c6b6ffd6e8fce24a69ba8889", "packets": 2, "transport": "tcp", "last_frame": 14717, "first_frame": 14693, "initiator_ip": "10.3.11.194", "responder_ip": "185.141.27.238", "initiator_port": 49781, "responder_port": 443, "initiator_bytes": 66, "last_seen_epoch": "1583962266.71483", "responder_bytes": 54, "first_seen_epoch": "1583962260.727552" }, { "bytes": 168, "stream": 223, "flow_id": "flow-1ef6d4b5f790a1735bb6ae39", "packets": 2, "transport": "udp", "last_frame": 14725, "first_frame": 14724, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 62192, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1583962275.929534", "responder_bytes": 92, "first_seen_epoch": "1583962275.915845" }, { "bytes": 352, "stream": 224, "flow_id": "flow-07eb3c5c9530c091cc6ee39d", "packets": 3, "transport": "udp", "last_frame": 14741, "first_frame": 14738, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 60201, "responder_port": 53, "initiator_bytes": 164, "last_seen_epoch": "1583962291.242182", "responder_bytes": 188, "first_seen_epoch": "1583962291.158736" }, { "bytes": 393, "stream": 225, "flow_id": "flow-41c86a48b26a6193ef4caf88", "packets": 3, "transport": "udp", "last_frame": 14744, "first_frame": 14740, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 50819, "responder_port": 53, "initiator_bytes": 166, "last_seen_epoch": "1583962291.265084", "responder_bytes": 227, "first_seen_epoch": "1583962291.232047" }, { "bytes": 8515, "stream": 380, "flow_id": "flow-b9d7043ea33dd7f031528d10", "packets": 30, "transport": "tcp", "last_frame": 16108, "first_frame": 14742, "initiator_ip": "10.3.11.119", "responder_ip": "52.242.211.89", "initiator_port": 49808, "responder_port": 443, "initiator_bytes": 2904, "last_seen_epoch": "1583962433.674508", "responder_bytes": 5611, "first_seen_epoch": "1583962291.244691" }, { "bytes": 10581, "stream": 381, "flow_id": "flow-072514522b008c6e62d29925", "packets": 29, "transport": "tcp", "last_frame": 14798, "first_frame": 14745, "initiator_ip": "10.3.11.119", "responder_ip": "13.107.246.10", "initiator_port": 49809, "responder_port": 443, "initiator_bytes": 2815, "last_seen_epoch": "1583962291.552896", "responder_bytes": 7766, "first_seen_epoch": "1583962291.267898" }, { "bytes": 252, "stream": 382, "flow_id": "flow-af886c412c6d1f696a0477fd", "packets": 4, "transport": "tcp", "last_frame": 14804, "first_frame": 14799, "initiator_ip": "10.3.11.194", "responder_ip": "185.141.27.238", "initiator_port": 49782, "responder_port": 443, "initiator_bytes": 198, "last_seen_epoch": "1583962303.292309", "responder_bytes": 54, "first_seen_epoch": "1583962297.745322" }, { "bytes": 120, "stream": 383, "flow_id": "flow-03874daf7bd1f218faacca7b", "packets": 2, "transport": "tcp", "last_frame": 14830, "first_frame": 14805, "initiator_ip": "10.3.11.194", "responder_ip": "185.141.27.238", "initiator_port": 49782, "responder_port": 443, "initiator_bytes": 66, "last_seen_epoch": "1583962310.146829", "responder_bytes": 54, "first_seen_epoch": "1583962303.806101" }, { "bytes": 120, "stream": 384, "flow_id": "flow-07d30fddac619951b00c4a28", "packets": 2, "transport": "tcp", "last_frame": 14833, "first_frame": 14831, "initiator_ip": "10.3.11.194", "responder_ip": "185.141.27.238", "initiator_port": 49782, "responder_port": 443, "initiator_bytes": 66, "last_seen_epoch": "1583962316.747074", "responder_bytes": 54, "first_seen_epoch": "1583962310.650685" }, { "bytes": 62330, "stream": 385, "flow_id": "flow-c627a78ad5aab3ba2d2be8fb", "packets": 68, "transport": "tcp", "last_frame": 14901, "first_frame": 14834, "initiator_ip": "10.3.11.194", "responder_ip": "45.148.120.153", "initiator_port": 49783, "responder_port": 443, "initiator_bytes": 1736, "last_seen_epoch": "1583962319.415409", "responder_bytes": 60594, "first_seen_epoch": "1583962318.213276" }, { "bytes": 61538, "stream": 386, "flow_id": "flow-ccc5a5cf5e6069e2f6a908b5", "packets": 107, "transport": "tcp", "last_frame": 15859, "first_frame": 14902, "initiator_ip": "10.3.11.194", "responder_ip": "51.254.164.244", "initiator_port": 49784, "responder_port": 443, "initiator_bytes": 52312, "last_seen_epoch": "1583962390.165012", "responder_bytes": 9226, "first_seen_epoch": "1583962319.417356" }, { "bytes": 270, "stream": 226, "flow_id": "flow-3224e03fcec563392afe997b", "packets": 2, "transport": "udp", "last_frame": 14921, "first_frame": 14913, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 55214, "responder_port": 53, "initiator_bytes": 82, "last_seen_epoch": "1583962319.96375", "responder_bytes": 188, "first_seen_epoch": "1583962319.845278" }, { "bytes": 310, "stream": 227, "flow_id": "flow-2458137c8915671375f2f979", "packets": 2, "transport": "udp", "last_frame": 14919, "first_frame": 14918, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 63483, "responder_port": 53, "initiator_bytes": 83, "last_seen_epoch": "1583962319.940114", "responder_bytes": 227, "first_seen_epoch": "1583962319.914672" }, { "bytes": 10628, "stream": 387, "flow_id": "flow-2fb0c58b27db445a8106bef6", "packets": 30, "transport": "tcp", "last_frame": 14986, "first_frame": 14920, "initiator_ip": "10.3.11.194", "responder_ip": "13.107.246.10", "initiator_port": 49785, "responder_port": 443, "initiator_bytes": 2862, "last_seen_epoch": "1583962320.254337", "responder_bytes": 7766, "first_seen_epoch": "1583962319.942539" }, { "bytes": 8514, "stream": 388, "flow_id": "flow-6cfd1dbb467d335ebcd7477c", "packets": 30, "transport": "tcp", "last_frame": 16379, "first_frame": 14922, "initiator_ip": "10.3.11.194", "responder_ip": "52.230.222.68", "initiator_port": 49786, "responder_port": 443, "initiator_bytes": 2904, "last_seen_epoch": "1583962545.180932", "responder_bytes": 5610, "first_seen_epoch": "1583962319.966128" }, { "bytes": 366, "stream": 228, "flow_id": "flow-6370ffdcc2e65a9e0f6d5e50", "packets": 2, "transport": "udp", "last_frame": 14974, "first_frame": 14966, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 60257, "responder_port": 53, "initiator_bytes": 81, "last_seen_epoch": "1583962320.197469", "responder_bytes": 285, "first_seen_epoch": "1583962320.148514" }, { "bytes": 950, "stream": 389, "flow_id": "flow-dde32a0f97cb62c7687cac94", "packets": 11, "transport": "tcp", "last_frame": 15385, "first_frame": 14975, "initiator_ip": "10.3.11.194", "responder_ip": "18.235.112.207", "initiator_port": 49787, "responder_port": 80, "initiator_bytes": 535, "last_seen_epoch": "1583962380.340263", "responder_bytes": 415, "first_seen_epoch": "1583962320.199294" }, { "bytes": 283, "stream": 390, "flow_id": "flow-baf42ec7500f396ace59e8fe", "packets": 2, "transport": "tcp", "last_frame": 14977, "first_frame": 14976, "initiator_ip": "52.242.211.89", "responder_ip": "10.3.11.194", "initiator_port": 443, "responder_port": 50355, "initiator_bytes": 229, "last_seen_epoch": "1583962320.235834", "responder_bytes": 54, "first_seen_epoch": "1583962320.235695" }, { "bytes": 7821, "stream": 391, "flow_id": "flow-55042926ec8c53acfc59ad96", "packets": 32, "transport": "tcp", "last_frame": 15873, "first_frame": 15088, "initiator_ip": "10.3.11.194", "responder_ip": "190.214.13.2", "initiator_port": 49788, "responder_port": 449, "initiator_bytes": 2932, "last_seen_epoch": "1583962396.146022", "responder_bytes": 4889, "first_seen_epoch": "1583962327.886727" }, { "bytes": 248, "stream": 229, "flow_id": "flow-1bdcddf4f32a49db707c4430", "packets": 2, "transport": "udp", "last_frame": 15110, "first_frame": 15109, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 55848, "responder_port": 53, "initiator_bytes": 92, "last_seen_epoch": "1583962330.571003", "responder_bytes": 156, "first_seen_epoch": "1583962330.537921" }, { "bytes": 255, "stream": 230, "flow_id": "flow-75b0eee56142430297e2627e", "packets": 2, "transport": "udp", "last_frame": 15113, "first_frame": 15111, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 60865, "responder_port": 53, "initiator_bytes": 91, "last_seen_epoch": "1583962330.620313", "responder_bytes": 164, "first_seen_epoch": "1583962330.571726" }, { "bytes": 256, "stream": 231, "flow_id": "flow-8ced3197955157d2365ee175", "packets": 2, "transport": "udp", "last_frame": 15115, "first_frame": 15114, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 58221, "responder_port": 53, "initiator_bytes": 98, "last_seen_epoch": "1583962330.679154", "responder_bytes": 158, "first_seen_epoch": "1583962330.620991" }, { "bytes": 264, "stream": 232, "flow_id": "flow-5ef559a93dbee30c3159de0d", "packets": 2, "transport": "udp", "last_frame": 15117, "first_frame": 15116, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 58119, "responder_port": 53, "initiator_bytes": 98, "last_seen_epoch": "1583962330.724772", "responder_bytes": 166, "first_seen_epoch": "1583962330.679973" }, { "bytes": 248, "stream": 233, "flow_id": "flow-a6b05aec8060bb3cdffb3130", "packets": 2, "transport": "udp", "last_frame": 15119, "first_frame": 15118, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 53205, "responder_port": 53, "initiator_bytes": 96, "last_seen_epoch": "1583962330.755632", "responder_bytes": 152, "first_seen_epoch": "1583962330.72552" }, { "bytes": 860, "stream": 234, "flow_id": "flow-a6432bfd799476d23348cd52", "packets": 4, "transport": "udp", "last_frame": 15127, "first_frame": 15124, "initiator_ip": "10.3.11.119", "responder_ip": "239.255.255.250", "initiator_port": 50820, "responder_port": 1900, "initiator_bytes": 860, "last_seen_epoch": "1583962334.730492", "responder_bytes": 0, "first_seen_epoch": "1583962331.726183" }, { "bytes": 352, "stream": 235, "flow_id": "flow-bcfdb7357f5ade1eb20e89a9", "packets": 3, "transport": "udp", "last_frame": 15136, "first_frame": 15134, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 49658, "responder_port": 53, "initiator_bytes": 164, "last_seen_epoch": "1583962351.740704", "responder_bytes": 188, "first_seen_epoch": "1583962351.651049" }, { "bytes": 9400, "stream": 392, "flow_id": "flow-b3ad2cf6e22d9691f8601cd9", "packets": 39, "transport": "tcp", "last_frame": 30145, "first_frame": 15137, "initiator_ip": "10.3.11.119", "responder_ip": "52.230.222.68", "initiator_port": 49810, "responder_port": 443, "initiator_bytes": 3216, "last_seen_epoch": "1583964034.742527", "responder_bytes": 6184, "first_seen_epoch": "1583962351.741562" }, { "bytes": 325, "stream": 236, "flow_id": "flow-b863193b69b3b5f93f4912c5", "packets": 3, "transport": "udp", "last_frame": 15204, "first_frame": 15202, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 57200, "responder_port": 53, "initiator_bytes": 172, "last_seen_epoch": "1583962359.660989", "responder_bytes": 153, "first_seen_epoch": "1583962359.615054" }, { "bytes": 63130, "stream": 393, "flow_id": "flow-a79f345bf1976e155a86d79a", "packets": 108, "transport": "tcp", "last_frame": 15312, "first_frame": 15205, "initiator_ip": "10.3.11.218", "responder_ip": "52.230.220.159", "initiator_port": 49806, "responder_port": 443, "initiator_bytes": 32105, "last_seen_epoch": "1583962360.78537", "responder_bytes": 31025, "first_seen_epoch": "1583962359.663942" }, { "bytes": 364, "stream": 237, "flow_id": "flow-16df6ad51eff9e7d8682a23c", "packets": 3, "transport": "udp", "last_frame": 15315, "first_frame": 15313, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 50220, "responder_port": 53, "initiator_bytes": 182, "last_seen_epoch": "1583962360.863226", "responder_bytes": 182, "first_seen_epoch": "1583962360.827395" }, { "bytes": 19310, "stream": 394, "flow_id": "flow-145c0504a39209d511deb522", "packets": 47, "transport": "tcp", "last_frame": 15362, "first_frame": 15316, "initiator_ip": "10.3.11.218", "responder_ip": "111.221.29.40", "initiator_port": 49807, "responder_port": 443, "initiator_bytes": 12939, "last_seen_epoch": "1583962363.797771", "responder_bytes": 6371, "first_seen_epoch": "1583962360.863942" }, { "bytes": 270, "stream": 238, "flow_id": "flow-834601c7f80e63dd5fb434c1", "packets": 2, "transport": "udp", "last_frame": 15376, "first_frame": 15375, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 58473, "responder_port": 53, "initiator_bytes": 82, "last_seen_epoch": "1583962380.292101", "responder_bytes": 188, "first_seen_epoch": "1583962380.291791" }, { "bytes": 8305, "stream": 395, "flow_id": "flow-9a0313af965237746df5ac00", "packets": 29, "transport": "tcp", "last_frame": 16376, "first_frame": 15377, "initiator_ip": "10.3.11.194", "responder_ip": "52.230.222.68", "initiator_port": 49789, "responder_port": 443, "initiator_bytes": 2640, "last_seen_epoch": "1583962545.170663", "responder_bytes": 5665, "first_seen_epoch": "1583962380.292572" }, { "bytes": 245, "stream": 239, "flow_id": "flow-3c8e1ad9a026a9118b539181", "packets": 2, "transport": "udp", "last_frame": 15393, "first_frame": 15386, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 54609, "responder_port": 53, "initiator_bytes": 91, "last_seen_epoch": "1583962380.441417", "responder_bytes": 154, "first_seen_epoch": "1583962380.401914" }, { "bytes": 6339, "stream": 396, "flow_id": "flow-f9304192222a15eb546ad237", "packets": 27, "transport": "tcp", "last_frame": 15433, "first_frame": 15394, "initiator_ip": "10.3.11.218", "responder_ip": "40.119.2.214", "initiator_port": 49808, "responder_port": 443, "initiator_bytes": 1348, "last_seen_epoch": "1583962380.634834", "responder_bytes": 4991, "first_seen_epoch": "1583962380.447871" }, { "bytes": 373, "stream": 240, "flow_id": "flow-6d466c03ba4a241b5e7f87e0", "packets": 3, "transport": "udp", "last_frame": 15441, "first_frame": 15439, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 61563, "responder_port": 53, "initiator_bytes": 148, "last_seen_epoch": "1583962381.378143", "responder_bytes": 225, "first_seen_epoch": "1583962381.34421" }, { "bytes": 26514, "stream": 397, "flow_id": "flow-a9bab894a0d327555e66ef6f", "packets": 45, "transport": "tcp", "last_frame": 15488, "first_frame": 15442, "initiator_ip": "10.3.11.218", "responder_ip": "40.90.22.187", "initiator_port": 49811, "responder_port": 443, "initiator_bytes": 6526, "last_seen_epoch": "1583962381.943286", "responder_bytes": 19988, "first_seen_epoch": "1583962381.382733" }, { "bytes": 380, "stream": 241, "flow_id": "flow-b9195aac7fea27504cca2200", "packets": 3, "transport": "udp", "last_frame": 15489, "first_frame": 15485, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 49608, "responder_port": 53, "initiator_bytes": 172, "last_seen_epoch": "1583962381.966088", "responder_bytes": 208, "first_seen_epoch": "1583962381.913145" }, { "bytes": 23173, "stream": 398, "flow_id": "flow-630dde6af9c00e7c5cbfe4a3", "packets": 36, "transport": "tcp", "last_frame": 15525, "first_frame": 15490, "initiator_ip": "10.3.11.218", "responder_ip": "40.91.76.238", "initiator_port": 49812, "responder_port": 443, "initiator_bytes": 7245, "last_seen_epoch": "1583962382.624389", "responder_bytes": 15928, "first_seen_epoch": "1583962381.970216" }, { "bytes": 1292, "stream": 399, "flow_id": "flow-8cd4e9973be5a3ed0fb23b19", "packets": 12, "transport": "tcp", "last_frame": 15892, "first_frame": 15527, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 49814, "responder_port": 135, "initiator_bytes": 730, "last_seen_epoch": "1583962399.320035", "responder_bytes": 562, "first_seen_epoch": "1583962384.913702" }, { "bytes": 2066, "stream": 400, "flow_id": "flow-0a57138e98cb6666ee63bd32", "packets": 14, "transport": "tcp", "last_frame": 15891, "first_frame": 15534, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 49815, "responder_port": 49667, "initiator_bytes": 1234, "last_seen_epoch": "1583962399.319904", "responder_bytes": 832, "first_seen_epoch": "1583962384.915225" }, { "bytes": 358, "stream": 242, "flow_id": "flow-bb8e487d522902e45239c7ed", "packets": 3, "transport": "udp", "last_frame": 15547, "first_frame": 15545, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 64144, "responder_port": 53, "initiator_bytes": 188, "last_seen_epoch": "1583962385.041155", "responder_bytes": 170, "first_seen_epoch": "1583962384.970159" }, { "bytes": 279, "stream": 243, "flow_id": "flow-f2840e1cb454ae92c0b2e8d0", "packets": 2, "transport": "udp", "last_frame": 15551, "first_frame": 15550, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 53381, "responder_port": 53, "initiator_bytes": 86, "last_seen_epoch": "1583962385.535429", "responder_bytes": 193, "first_seen_epoch": "1583962385.391674" }, { "bytes": 5170, "stream": 401, "flow_id": "flow-674bd536c5d8b33aec681e02", "packets": 24, "transport": "tcp", "last_frame": 15597, "first_frame": 15552, "initiator_ip": "10.3.11.194", "responder_ip": "13.78.168.230", "initiator_port": 49790, "responder_port": 443, "initiator_bytes": 1294, "last_seen_epoch": "1583962385.77474", "responder_bytes": 3876, "first_seen_epoch": "1583962385.53633" }, { "bytes": 452, "stream": 244, "flow_id": "flow-29cd0671efbe99e94113402d", "packets": 3, "transport": "udp", "last_frame": 15571, "first_frame": 15562, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 58786, "responder_port": 53, "initiator_bytes": 218, "last_seen_epoch": "1583962385.663937", "responder_bytes": 234, "first_seen_epoch": "1583962385.634946" }, { "bytes": 8309, "stream": 402, "flow_id": "flow-5097dd0f907b2e77bed6c644", "packets": 21, "transport": "tcp", "last_frame": 15599, "first_frame": 15572, "initiator_ip": "10.3.11.218", "responder_ip": "23.206.213.111", "initiator_port": 49816, "responder_port": 443, "initiator_bytes": 1018, "last_seen_epoch": "1583962385.775347", "responder_bytes": 7291, "first_seen_epoch": "1583962385.664542" }, { "bytes": 239, "stream": 245, "flow_id": "flow-28e683fda30772beeb3ca229", "packets": 2, "transport": "udp", "last_frame": 15601, "first_frame": 15600, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 50486, "responder_port": 53, "initiator_bytes": 86, "last_seen_epoch": "1583962385.972448", "responder_bytes": 153, "first_seen_epoch": "1583962385.972164" }, { "bytes": 41581, "stream": 403, "flow_id": "flow-146862a3545fa5f3f62308de", "packets": 78, "transport": "tcp", "last_frame": 15714, "first_frame": 15602, "initiator_ip": "10.3.11.194", "responder_ip": "52.230.220.159", "initiator_port": 49791, "responder_port": 443, "initiator_bytes": 30223, "last_seen_epoch": "1583962387.226025", "responder_bytes": 11358, "first_seen_epoch": "1583962385.973078" }, { "bytes": 340, "stream": 246, "flow_id": "flow-8fa4cc9063ea7374638a3518", "packets": 4, "transport": "udp", "last_frame": 15656, "first_frame": 15649, "initiator_ip": "10.3.11.218", "responder_ip": "224.0.0.251", "initiator_port": 5353, "responder_port": 5353, "initiator_bytes": 340, "last_seen_epoch": "1583962386.735984", "responder_bytes": 0, "first_seen_epoch": "1583962386.721736" }, { "bytes": 74, "stream": 247, "flow_id": "flow-8e9bcc39aed697838748d2d9", "packets": 1, "transport": "udp", "last_frame": 15651, "first_frame": 15651, "initiator_ip": "10.3.11.218", "responder_ip": "224.0.0.252", "initiator_port": 54529, "responder_port": 5355, "initiator_bytes": 74, "last_seen_epoch": "1583962386.722172", "responder_bytes": 0, "first_seen_epoch": "1583962386.722172" }, { "bytes": 74, "stream": 248, "flow_id": "flow-66ad277e86ffcb1e332949ad", "packets": 1, "transport": "udp", "last_frame": 15657, "first_frame": 15657, "initiator_ip": "10.3.11.218", "responder_ip": "224.0.0.252", "initiator_port": 63575, "responder_port": 5355, "initiator_bytes": 74, "last_seen_epoch": "1583962386.736182", "responder_bytes": 0, "first_seen_epoch": "1583962386.736182" }, { "bytes": 255, "stream": 249, "flow_id": "flow-ca78bae2eef20be1eaed141a", "packets": 2, "transport": "udp", "last_frame": 15660, "first_frame": 15659, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 63694, "responder_port": 53, "initiator_bytes": 89, "last_seen_epoch": "1583962386.740438", "responder_bytes": 166, "first_seen_epoch": "1583962386.740038" }, { "bytes": 310, "stream": 250, "flow_id": "flow-1e0663a5b777fe38e61e8940", "packets": 2, "transport": "udp", "last_frame": 15662, "first_frame": 15661, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 60705, "responder_port": 53, "initiator_bytes": 155, "last_seen_epoch": "1583962386.751686", "responder_bytes": 155, "first_seen_epoch": "1583962386.750583" }, { "bytes": 192, "stream": 251, "flow_id": "flow-4adc95dcdcf6eb67562fac12", "packets": 2, "transport": "udp", "last_frame": 15668, "first_frame": 15667, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 58759, "responder_port": 53, "initiator_bytes": 88, "last_seen_epoch": "1583962386.798154", "responder_bytes": 104, "first_seen_epoch": "1583962386.797821" }, { "bytes": 2782, "stream": 404, "flow_id": "flow-dda8677c17a375de2df20722", "packets": 11, "transport": "tcp", "last_frame": 15679, "first_frame": 15669, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 49817, "responder_port": 389, "initiator_bytes": 2290, "last_seen_epoch": "1583962386.803997", "responder_bytes": 492, "first_seen_epoch": "1583962386.798967" }, { "bytes": 6100, "stream": 405, "flow_id": "flow-64f5bd83e4290f38efe57677", "packets": 25, "transport": "tcp", "last_frame": 15748, "first_frame": 15712, "initiator_ip": "10.3.11.218", "responder_ip": "40.119.2.214", "initiator_port": 49818, "responder_port": 443, "initiator_bytes": 1294, "last_seen_epoch": "1583962387.507079", "responder_bytes": 4806, "first_seen_epoch": "1583962387.219349" }, { "bytes": 273, "stream": 252, "flow_id": "flow-e1389f73d327308cfc6203da", "packets": 2, "transport": "udp", "last_frame": 15726, "first_frame": 15725, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 53824, "responder_port": 53, "initiator_bytes": 91, "last_seen_epoch": "1583962387.327849", "responder_bytes": 182, "first_seen_epoch": "1583962387.327521" }, { "bytes": 19406, "stream": 406, "flow_id": "flow-62a2821e04ee8fa2e8b14a02", "packets": 49, "transport": "tcp", "last_frame": 15861, "first_frame": 15727, "initiator_ip": "10.3.11.194", "responder_ip": "111.221.29.40", "initiator_port": 49792, "responder_port": 443, "initiator_bytes": 12973, "last_seen_epoch": "1583962390.389799", "responder_bytes": 6433, "first_seen_epoch": "1583962387.32855" }, { "bytes": 233, "stream": 253, "flow_id": "flow-edcdf49ca483fd63569a00b0", "packets": 2, "transport": "udp", "last_frame": 15739, "first_frame": 15738, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 61157, "responder_port": 53, "initiator_bytes": 79, "last_seen_epoch": "1583962387.445546", "responder_bytes": 154, "first_seen_epoch": "1583962387.445268" }, { "bytes": 6101, "stream": 407, "flow_id": "flow-21ba292f678a17a2d973f0ae", "packets": 25, "transport": "tcp", "last_frame": 15799, "first_frame": 15742, "initiator_ip": "10.3.11.218", "responder_ip": "40.119.2.214", "initiator_port": 49819, "responder_port": 443, "initiator_bytes": 1293, "last_seen_epoch": "1583962387.769731", "responder_bytes": 4808, "first_seen_epoch": "1583962387.454467" }, { "bytes": 270, "stream": 254, "flow_id": "flow-756352fbbcb0f7839957a565", "packets": 2, "transport": "udp", "last_frame": 15744, "first_frame": 15743, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 64395, "responder_port": 53, "initiator_bytes": 82, "last_seen_epoch": "1583962387.466826", "responder_bytes": 188, "first_seen_epoch": "1583962387.466379" }, { "bytes": 9694, "stream": 408, "flow_id": "flow-74a8379f3bb91ca833a3435e", "packets": 37, "transport": "tcp", "last_frame": 30231, "first_frame": 15745, "initiator_ip": "10.3.11.218", "responder_ip": "52.230.222.68", "initiator_port": 49820, "responder_port": 443, "initiator_bytes": 3416, "last_seen_epoch": "1583964317.350369", "responder_bytes": 6278, "first_seen_epoch": "1583962387.467369" }, { "bytes": 233, "stream": 255, "flow_id": "flow-b51d952ee610a4cf51405b3e", "packets": 2, "transport": "udp", "last_frame": 15904, "first_frame": 15903, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 53909, "responder_port": 53, "initiator_bytes": 79, "last_seen_epoch": "1583962405.460973", "responder_bytes": 154, "first_seen_epoch": "1583962405.460442" }, { "bytes": 239, "stream": 256, "flow_id": "flow-cd33a73bece5e9472453cc18", "packets": 2, "transport": "udp", "last_frame": 15923, "first_frame": 15922, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 64431, "responder_port": 53, "initiator_bytes": 86, "last_seen_epoch": "1583962416.97456", "responder_bytes": 153, "first_seen_epoch": "1583962416.974187" }, { "bytes": 62857, "stream": 409, "flow_id": "flow-92defcccc9fe9043ef57f71a", "packets": 103, "transport": "tcp", "last_frame": 16026, "first_frame": 15924, "initiator_ip": "10.3.11.119", "responder_ip": "52.230.220.159", "initiator_port": 49811, "responder_port": 443, "initiator_bytes": 31993, "last_seen_epoch": "1583962418.282803", "responder_bytes": 30864, "first_seen_epoch": "1583962416.977361" }, { "bytes": 273, "stream": 257, "flow_id": "flow-60ff3c61e13f3e6d52b36e72", "packets": 2, "transport": "udp", "last_frame": 16028, "first_frame": 16027, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 55452, "responder_port": 53, "initiator_bytes": 91, "last_seen_epoch": "1583962418.344091", "responder_bytes": 182, "first_seen_epoch": "1583962418.343766" }, { "bytes": 19353, "stream": 410, "flow_id": "flow-97ec2411752996b0dc6e0978", "packets": 48, "transport": "tcp", "last_frame": 16078, "first_frame": 16029, "initiator_ip": "10.3.11.119", "responder_ip": "111.221.29.40", "initiator_port": 49812, "responder_port": 443, "initiator_bytes": 12919, "last_seen_epoch": "1583962421.035383", "responder_bytes": 6434, "first_seen_epoch": "1583962418.34467" }, { "bytes": 255, "stream": 258, "flow_id": "flow-8651cf4a3e7e2373b18f9b90", "packets": 2, "transport": "udp", "last_frame": 16084, "first_frame": 16083, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 56189, "responder_port": 53, "initiator_bytes": 89, "last_seen_epoch": "1583962433.370632", "responder_bytes": 166, "first_seen_epoch": "1583962433.37042" }, { "bytes": 74, "stream": 259, "flow_id": "flow-d71d637333e528b6daa97d46", "packets": 1, "transport": "udp", "last_frame": 16089, "first_frame": 16089, "initiator_ip": "10.3.11.119", "responder_ip": "224.0.0.252", "initiator_port": 54309, "responder_port": 5355, "initiator_bytes": 74, "last_seen_epoch": "1583962433.373692", "responder_bytes": 0, "first_seen_epoch": "1583962433.373692" }, { "bytes": 310, "stream": 260, "flow_id": "flow-b3d7672b03c9426081c1f0a1", "packets": 2, "transport": "udp", "last_frame": 16091, "first_frame": 16090, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 50256, "responder_port": 53, "initiator_bytes": 155, "last_seen_epoch": "1583962433.392824", "responder_bytes": 155, "first_seen_epoch": "1583962433.391674" }, { "bytes": 192, "stream": 261, "flow_id": "flow-b35b3076d52d1216078561bd", "packets": 2, "transport": "udp", "last_frame": 16093, "first_frame": 16092, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 53886, "responder_port": 53, "initiator_bytes": 88, "last_seen_epoch": "1583962433.464217", "responder_bytes": 104, "first_seen_epoch": "1583962433.46395" }, { "bytes": 2782, "stream": 411, "flow_id": "flow-ecf78610130b8935632657ed", "packets": 11, "transport": "tcp", "last_frame": 16104, "first_frame": 16094, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 49813, "responder_port": 389, "initiator_bytes": 2290, "last_seen_epoch": "1583962433.469637", "responder_bytes": 492, "first_seen_epoch": "1583962433.464807" }, { "bytes": 352, "stream": 262, "flow_id": "flow-4f39404961db2c56c5344a66", "packets": 3, "transport": "udp", "last_frame": 16114, "first_frame": 16109, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 55332, "responder_port": 53, "initiator_bytes": 164, "last_seen_epoch": "1583962434.184347", "responder_bytes": 188, "first_seen_epoch": "1583962433.733151" }, { "bytes": 233, "stream": 263, "flow_id": "flow-d553605a42efbb7c188c13f3", "packets": 2, "transport": "udp", "last_frame": 16113, "first_frame": 16112, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 58950, "responder_port": 53, "initiator_bytes": 79, "last_seen_epoch": "1583962434.138674", "responder_bytes": 154, "first_seen_epoch": "1583962434.138425" }, { "bytes": 8781, "stream": 412, "flow_id": "flow-4377464287c7f54c76982057", "packets": 30, "transport": "tcp", "last_frame": 29955, "first_frame": 16115, "initiator_ip": "10.3.11.119", "responder_ip": "52.230.222.68", "initiator_port": 49814, "responder_port": 443, "initiator_bytes": 3002, "last_seen_epoch": "1583963609.631992", "responder_bytes": 5779, "first_seen_epoch": "1583962434.185053" }, { "bytes": 233, "stream": 264, "flow_id": "flow-97979b00a187625291a7f8f2", "packets": 2, "transport": "udp", "last_frame": 16201, "first_frame": 16200, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 61440, "responder_port": 53, "initiator_bytes": 79, "last_seen_epoch": "1583962438.367679", "responder_bytes": 154, "first_seen_epoch": "1583962438.36742" }, { "bytes": 128, "stream": 265, "flow_id": "flow-f050a6be8a0acedbead932e9", "packets": 2, "transport": "udp", "last_frame": 16210, "first_frame": 16204, "initiator_ip": "10.3.11.119", "responder_ip": "224.0.0.252", "initiator_port": 50384, "responder_port": 5355, "initiator_bytes": 128, "last_seen_epoch": "1583962438.779431", "responder_bytes": 0, "first_seen_epoch": "1583962438.368942" }, { "bytes": 233, "stream": 266, "flow_id": "flow-fdab652f7d7e5d67e3ca423e", "packets": 2, "transport": "udp", "last_frame": 16206, "first_frame": 16205, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 54721, "responder_port": 53, "initiator_bytes": 79, "last_seen_epoch": "1583962438.371476", "responder_bytes": 154, "first_seen_epoch": "1583962438.371244" }, { "bytes": 128, "stream": 267, "flow_id": "flow-8bdafbfa67d886e2bd78be10", "packets": 2, "transport": "udp", "last_frame": 16211, "first_frame": 16209, "initiator_ip": "10.3.11.119", "responder_ip": "224.0.0.252", "initiator_port": 55780, "responder_port": 5355, "initiator_bytes": 128, "last_seen_epoch": "1583962438.783452", "responder_bytes": 0, "first_seen_epoch": "1583962438.372548" }, { "bytes": 860, "stream": 268, "flow_id": "flow-4f8ee2c26b2e713f62605608", "packets": 4, "transport": "udp", "last_frame": 16253, "first_frame": 16212, "initiator_ip": "10.3.11.119", "responder_ip": "239.255.255.250", "initiator_port": 55781, "responder_port": 1900, "initiator_bytes": 860, "last_seen_epoch": "1583962441.876571", "responder_bytes": 0, "first_seen_epoch": "1583962438.87402" }, { "bytes": 243, "stream": 269, "flow_id": "flow-db5e0dc3e60e46c1f8723b3f", "packets": 2, "transport": "udp", "last_frame": 16219, "first_frame": 16218, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 58512, "responder_port": 53, "initiator_bytes": 84, "last_seen_epoch": "1583962439.873745", "responder_bytes": 159, "first_seen_epoch": "1583962439.873489" }, { "bytes": 253, "stream": 270, "flow_id": "flow-951a6779c3d2850ae196ca91", "packets": 2, "transport": "udp", "last_frame": 16222, "first_frame": 16220, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 53321, "responder_port": 53, "initiator_bytes": 89, "last_seen_epoch": "1583962439.874349", "responder_bytes": 164, "first_seen_epoch": "1583962439.874056" }, { "bytes": 245, "stream": 271, "flow_id": "flow-474048bd461c9e02ec72214d", "packets": 2, "transport": "udp", "last_frame": 16224, "first_frame": 16221, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 54097, "responder_port": 53, "initiator_bytes": 85, "last_seen_epoch": "1583962439.874418", "responder_bytes": 160, "first_seen_epoch": "1583962439.874196" }, { "bytes": 138, "stream": 272, "flow_id": "flow-72789d17306395545709e282", "packets": 2, "transport": "udp", "last_frame": 16238, "first_frame": 16228, "initiator_ip": "10.3.11.119", "responder_ip": "224.0.0.252", "initiator_port": 65141, "responder_port": 5355, "initiator_bytes": 138, "last_seen_epoch": "1583962440.286488", "responder_bytes": 0, "first_seen_epoch": "1583962439.875185" }, { "bytes": 148, "stream": 273, "flow_id": "flow-6b5af63e08e19945e0eb3f05", "packets": 2, "transport": "udp", "last_frame": 16237, "first_frame": 16232, "initiator_ip": "10.3.11.119", "responder_ip": "224.0.0.252", "initiator_port": 49795, "responder_port": 5355, "initiator_bytes": 148, "last_seen_epoch": "1583962440.286332", "responder_bytes": 0, "first_seen_epoch": "1583962439.875948" }, { "bytes": 140, "stream": 274, "flow_id": "flow-a064c29fa819c971ee730858", "packets": 2, "transport": "udp", "last_frame": 16236, "first_frame": 16233, "initiator_ip": "10.3.11.119", "responder_ip": "224.0.0.252", "initiator_port": 53758, "responder_port": 5355, "initiator_bytes": 140, "last_seen_epoch": "1583962440.286201", "responder_bytes": 0, "first_seen_epoch": "1583962439.876069" }, { "bytes": 233, "stream": 275, "flow_id": "flow-3a6886dce8f4201241bd2846", "packets": 2, "transport": "udp", "last_frame": 16261, "first_frame": 16260, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 52435, "responder_port": 53, "initiator_bytes": 79, "last_seen_epoch": "1583962447.371328", "responder_bytes": 154, "first_seen_epoch": "1583962447.371082" }, { "bytes": 128, "stream": 276, "flow_id": "flow-da084d83a8170f5f45239265", "packets": 2, "transport": "udp", "last_frame": 16270, "first_frame": 16264, "initiator_ip": "10.3.11.119", "responder_ip": "224.0.0.252", "initiator_port": 64485, "responder_port": 5355, "initiator_bytes": 128, "last_seen_epoch": "1583962447.782827", "responder_bytes": 0, "first_seen_epoch": "1583962447.372461" }, { "bytes": 233, "stream": 277, "flow_id": "flow-f289488cd583c65533745e69", "packets": 2, "transport": "udp", "last_frame": 16266, "first_frame": 16265, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 50188, "responder_port": 53, "initiator_bytes": 79, "last_seen_epoch": "1583962447.375845", "responder_bytes": 154, "first_seen_epoch": "1583962447.375652" }, { "bytes": 128, "stream": 278, "flow_id": "flow-747525e44a155b8170e9f2ac", "packets": 2, "transport": "udp", "last_frame": 16271, "first_frame": 16269, "initiator_ip": "10.3.11.119", "responder_ip": "224.0.0.252", "initiator_port": 63596, "responder_port": 5355, "initiator_bytes": 128, "last_seen_epoch": "1583962447.787763", "responder_bytes": 0, "first_seen_epoch": "1583962447.37685" }, { "bytes": 233, "stream": 279, "flow_id": "flow-4caa1499b5dc67f72dac3a97", "packets": 2, "transport": "udp", "last_frame": 16280, "first_frame": 16279, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 49447, "responder_port": 53, "initiator_bytes": 79, "last_seen_epoch": "1583962452.150409", "responder_bytes": 154, "first_seen_epoch": "1583962452.150148" }, { "bytes": 233, "stream": 280, "flow_id": "flow-86f8998e6788380e236d8a36", "packets": 2, "transport": "udp", "last_frame": 16282, "first_frame": 16281, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 63641, "responder_port": 53, "initiator_bytes": 79, "last_seen_epoch": "1583962455.343753", "responder_bytes": 154, "first_seen_epoch": "1583962455.343446" }, { "bytes": 180, "stream": 281, "flow_id": "flow-32336d0842002a8ac2e5bcba", "packets": 2, "transport": "udp", "last_frame": 16284, "first_frame": 16283, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 61413, "responder_port": 53, "initiator_bytes": 74, "last_seen_epoch": "1583962457.871573", "responder_bytes": 106, "first_seen_epoch": "1583962457.841813" }, { "bytes": 12053, "stream": 413, "flow_id": "flow-50ca16960a5e7768f41e7d92", "packets": 41, "transport": "tcp", "last_frame": 27251, "first_frame": 16285, "initiator_ip": "10.3.11.119", "responder_ip": "54.153.98.238", "initiator_port": 49815, "responder_port": 443, "initiator_bytes": 2455, "last_seen_epoch": "1583962694.394186", "responder_bytes": 9598, "first_seen_epoch": "1583962457.872733" }, { "bytes": 233, "stream": 282, "flow_id": "flow-a1a131d86e7681da40cb73da", "packets": 2, "transport": "udp", "last_frame": 16308, "first_frame": 16307, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 58707, "responder_port": 53, "initiator_bytes": 79, "last_seen_epoch": "1583962465.462886", "responder_bytes": 154, "first_seen_epoch": "1583962465.462576" }, { "bytes": 233, "stream": 283, "flow_id": "flow-3ab0770ee666b09cd064cc17", "packets": 2, "transport": "udp", "last_frame": 16321, "first_frame": 16320, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 63948, "responder_port": 53, "initiator_bytes": 79, "last_seen_epoch": "1583962512.155592", "responder_bytes": 154, "first_seen_epoch": "1583962512.155261" }, { "bytes": 384, "stream": 414, "flow_id": "flow-eccec541d17e1dee5359dc15", "packets": 6, "transport": "tcp", "last_frame": 18592, "first_frame": 16322, "initiator_ip": "10.3.11.194", "responder_ip": "185.180.198.50", "initiator_port": 49793, "responder_port": 447, "initiator_bytes": 330, "last_seen_epoch": "1583962606.481851", "responder_bytes": 54, "first_seen_epoch": "1583962531.249089" }, { "bytes": 336, "stream": 284, "flow_id": "flow-2ff4ff75568ab836bd53270e", "packets": 3, "transport": "udp", "last_frame": 16329, "first_frame": 16327, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 57646, "responder_port": 53, "initiator_bytes": 182, "last_seen_epoch": "1583962544.824732", "responder_bytes": 154, "first_seen_epoch": "1583962544.765052" }, { "bytes": 5576, "stream": 415, "flow_id": "flow-7fdef4795e7e71e81ebe4d96", "packets": 20, "transport": "tcp", "last_frame": 16394, "first_frame": 16330, "initiator_ip": "10.3.11.194", "responder_ip": "40.119.2.214", "initiator_port": 49794, "responder_port": 443, "initiator_bytes": 801, "last_seen_epoch": "1583962545.389437", "responder_bytes": 4775, "first_seen_epoch": "1583962544.827262" }, { "bytes": 74, "stream": 285, "flow_id": "flow-52a423502b3f5d17402ab5da", "packets": 1, "transport": "udp", "last_frame": 16346, "first_frame": 16346, "initiator_ip": "10.3.11.194", "responder_ip": "224.0.0.252", "initiator_port": 52240, "responder_port": 5355, "initiator_bytes": 74, "last_seen_epoch": "1583962544.958531", "responder_bytes": 0, "first_seen_epoch": "1583962544.958531" }, { "bytes": 74, "stream": 286, "flow_id": "flow-6a49f641257a7ee919e92d6e", "packets": 1, "transport": "udp", "last_frame": 16351, "first_frame": 16351, "initiator_ip": "10.3.11.194", "responder_ip": "224.0.0.252", "initiator_port": 56562, "responder_port": 5355, "initiator_bytes": 74, "last_seen_epoch": "1583962544.990762", "responder_bytes": 0, "first_seen_epoch": "1583962544.990762" }, { "bytes": 255, "stream": 287, "flow_id": "flow-7f3489f2cb1951e363c55b37", "packets": 2, "transport": "udp", "last_frame": 16353, "first_frame": 16352, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 61855, "responder_port": 53, "initiator_bytes": 89, "last_seen_epoch": "1583962544.993657", "responder_bytes": 166, "first_seen_epoch": "1583962544.993385" }, { "bytes": 310, "stream": 288, "flow_id": "flow-1bb0a9e468933c155c6a0b1a", "packets": 2, "transport": "udp", "last_frame": 16355, "first_frame": 16354, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 63570, "responder_port": 53, "initiator_bytes": 155, "last_seen_epoch": "1583962544.99599", "responder_bytes": 155, "first_seen_epoch": "1583962544.995048" }, { "bytes": 192, "stream": 289, "flow_id": "flow-3f9e055feef8a536b72ab077", "packets": 2, "transport": "udp", "last_frame": 16358, "first_frame": 16357, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 55277, "responder_port": 53, "initiator_bytes": 88, "last_seen_epoch": "1583962545.037705", "responder_bytes": 104, "first_seen_epoch": "1583962545.037411" }, { "bytes": 2782, "stream": 416, "flow_id": "flow-3c813bd8e9773a0e6d1bbbfe", "packets": 11, "transport": "tcp", "last_frame": 16369, "first_frame": 16359, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 49795, "responder_port": 389, "initiator_bytes": 2290, "last_seen_epoch": "1583962545.041925", "responder_bytes": 492, "first_seen_epoch": "1583962545.038795" }, { "bytes": 352, "stream": 290, "flow_id": "flow-e3bcfc01436076aac558a4a4", "packets": 3, "transport": "udp", "last_frame": 16404, "first_frame": 16380, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 61273, "responder_port": 53, "initiator_bytes": 164, "last_seen_epoch": "1583962545.440932", "responder_bytes": 188, "first_seen_epoch": "1583962545.186625" }, { "bytes": 294, "stream": 291, "flow_id": "flow-c7b0dcfcf2ec0d45e6a0eddc", "packets": 2, "transport": "udp", "last_frame": 16385, "first_frame": 16384, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 65134, "responder_port": 53, "initiator_bytes": 86, "last_seen_epoch": "1583962545.300426", "responder_bytes": 208, "first_seen_epoch": "1583962545.300032" }, { "bytes": 23223, "stream": 417, "flow_id": "flow-38c6e061a5be6b5d9fc4b804", "packets": 37, "transport": "tcp", "last_frame": 16477, "first_frame": 16386, "initiator_ip": "10.3.11.194", "responder_ip": "40.91.76.238", "initiator_port": 49796, "responder_port": 443, "initiator_bytes": 7300, "last_seen_epoch": "1583962545.969292", "responder_bytes": 15923, "first_seen_epoch": "1583962545.303584" }, { "bytes": 8522, "stream": 418, "flow_id": "flow-793ff96c1b1c8e1b42284f26", "packets": 29, "transport": "tcp", "last_frame": 29871, "first_frame": 16405, "initiator_ip": "10.3.11.194", "responder_ip": "52.230.222.68", "initiator_port": 49797, "responder_port": 443, "initiator_bytes": 2739, "last_seen_epoch": "1583963506.007445", "responder_bytes": 5783, "first_seen_epoch": "1583962545.441489" }, { "bytes": 233, "stream": 292, "flow_id": "flow-3bd970396c1da2954469fb7e", "packets": 2, "transport": "udp", "last_frame": 16422, "first_frame": 16421, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 53490, "responder_port": 53, "initiator_bytes": 79, "last_seen_epoch": "1583962545.49927", "responder_bytes": 154, "first_seen_epoch": "1583962545.498982" }, { "bytes": 3043, "stream": 293, "flow_id": "flow-9e70ab8282960634c930ee47", "packets": 17, "transport": "udp", "last_frame": 29233, "first_frame": 16442, "initiator_ip": "10.3.11.194", "responder_ip": "239.255.255.250", "initiator_port": 53492, "responder_port": 1900, "initiator_bytes": 3043, "last_seen_epoch": "1583963092.293061", "responder_bytes": 0, "first_seen_epoch": "1583962545.710392" }, { "bytes": 9749, "stream": 419, "flow_id": "flow-9eff52ac1d68649c08585bbc", "packets": 38, "transport": "tcp", "last_frame": 30108, "first_frame": 16445, "initiator_ip": "10.3.11.194", "responder_ip": "52.230.222.68", "initiator_port": 49798, "responder_port": 443, "initiator_bytes": 3416, "last_seen_epoch": "1583963995.521211", "responder_bytes": 6333, "first_seen_epoch": "1583962545.752605" }, { "bytes": 337, "stream": 294, "flow_id": "flow-140278b1829ed3d180c6f2f7", "packets": 3, "transport": "udp", "last_frame": 16489, "first_frame": 16487, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 65460, "responder_port": 53, "initiator_bytes": 144, "last_seen_epoch": "1583962547.149148", "responder_bytes": 193, "first_seen_epoch": "1583962547.110221" }, { "bytes": 10652, "stream": 420, "flow_id": "flow-7c9a9e74ed73faf3ab17a3d2", "packets": 27, "transport": "tcp", "last_frame": 26636, "first_frame": 16490, "initiator_ip": "10.3.11.194", "responder_ip": "204.79.197.200", "initiator_port": 49801, "responder_port": 443, "initiator_bytes": 3076, "last_seen_epoch": "1583962665.644582", "responder_bytes": 7576, "first_seen_epoch": "1583962547.150686" }, { "bytes": 452, "stream": 295, "flow_id": "flow-52644c660191a9c862ccba7b", "packets": 3, "transport": "udp", "last_frame": 16524, "first_frame": 16522, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 52038, "responder_port": 53, "initiator_bytes": 218, "last_seen_epoch": "1583962549.023492", "responder_bytes": 234, "first_seen_epoch": "1583962548.988295" }, { "bytes": 8309, "stream": 421, "flow_id": "flow-6844102a5ae20b49442ef795", "packets": 21, "transport": "tcp", "last_frame": 16545, "first_frame": 16525, "initiator_ip": "10.3.11.194", "responder_ip": "23.206.213.111", "initiator_port": 49803, "responder_port": 443, "initiator_bytes": 1018, "last_seen_epoch": "1583962549.195607", "responder_bytes": 7291, "first_seen_epoch": "1583962549.024268" }, { "bytes": 1292, "stream": 422, "flow_id": "flow-0ba404e0a3d9306e5f750884", "packets": 12, "transport": "tcp", "last_frame": 17611, "first_frame": 16546, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 49804, "responder_port": 135, "initiator_bytes": 730, "last_seen_epoch": "1583962564.110149", "responder_bytes": 562, "first_seen_epoch": "1583962549.894911" }, { "bytes": 2012, "stream": 423, "flow_id": "flow-9484c4b9b2ded61daaa9384c", "packets": 13, "transport": "tcp", "last_frame": 17610, "first_frame": 16553, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 49805, "responder_port": 49667, "initiator_bytes": 1234, "last_seen_epoch": "1583962564.110042", "responder_bytes": 778, "first_seen_epoch": "1583962549.897085" }, { "bytes": 358, "stream": 296, "flow_id": "flow-7883d9c1aae145232962c525", "packets": 3, "transport": "udp", "last_frame": 16566, "first_frame": 16564, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 55884, "responder_port": 53, "initiator_bytes": 188, "last_seen_epoch": "1583962549.969823", "responder_bytes": 170, "first_seen_epoch": "1583962549.947731" }, { "bytes": 6102, "stream": 424, "flow_id": "flow-b123aa90a3b57a288d3a0014", "packets": 25, "transport": "tcp", "last_frame": 16593, "first_frame": 16567, "initiator_ip": "10.3.11.194", "responder_ip": "40.119.2.214", "initiator_port": 49806, "responder_port": 443, "initiator_bytes": 1294, "last_seen_epoch": "1583962551.125833", "responder_bytes": 4808, "first_seen_epoch": "1583962550.956764" }, { "bytes": 6143, "stream": 425, "flow_id": "flow-65b2bae61f313be06ccf67ae", "packets": 25, "transport": "tcp", "last_frame": 16616, "first_frame": 16590, "initiator_ip": "10.3.11.194", "responder_ip": "40.119.2.214", "initiator_port": 49807, "responder_port": 443, "initiator_bytes": 1293, "last_seen_epoch": "1583962551.248878", "responder_bytes": 4850, "first_seen_epoch": "1583962551.096098" }, { "bytes": 2139108, "stream": 426, "flow_id": "flow-8818a96971fa9ca22ac92c06", "packets": 1666, "transport": "tcp", "last_frame": 27272, "first_frame": 16620, "initiator_ip": "10.3.11.194", "responder_ip": "185.14.31.98", "initiator_port": 49808, "responder_port": 447, "initiator_bytes": 13970, "last_seen_epoch": "1583962694.489084", "responder_bytes": 2125138, "first_seen_epoch": "1583962553.328219" }, { "bytes": 27788, "stream": 427, "flow_id": "flow-b15629f328394dd378f39ba3", "packets": 136, "transport": "tcp", "last_frame": 27411, "first_frame": 17526, "initiator_ip": "10.3.11.194", "responder_ip": "190.214.13.2", "initiator_port": 49809, "responder_port": 449, "initiator_bytes": 16658, "last_seen_epoch": "1583962777.03733", "responder_bytes": 11130, "first_seen_epoch": "1583962555.863454" }, { "bytes": 22607, "stream": 428, "flow_id": "flow-c14ebd8054a3219564ffdc93", "packets": 117, "transport": "tcp", "last_frame": 27405, "first_frame": 17546, "initiator_ip": "10.3.11.194", "responder_ip": "190.214.13.2", "initiator_port": 49810, "responder_port": 449, "initiator_bytes": 14272, "last_seen_epoch": "1583962771.299223", "responder_bytes": 8335, "first_seen_epoch": "1583962558.077582" }, { "bytes": 860, "stream": 297, "flow_id": "flow-2a65b5e9e59a118b11f1f338", "packets": 4, "transport": "udp", "last_frame": 17602, "first_frame": 17586, "initiator_ip": "10.3.11.119", "responder_ip": "239.255.255.250", "initiator_port": 63949, "responder_port": 1900, "initiator_bytes": 860, "last_seen_epoch": "1583962561.881352", "responder_bytes": 0, "first_seen_epoch": "1583962558.877982" }, { "bytes": 233, "stream": 298, "flow_id": "flow-6000d2e7cb7ea53ccd036624", "packets": 2, "transport": "udp", "last_frame": 17604, "first_frame": 17603, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 53108, "responder_port": 53, "initiator_bytes": 79, "last_seen_epoch": "1583962563.502714", "responder_bytes": 154, "first_seen_epoch": "1583962563.502331" }, { "bytes": 104, "stream": 299, "flow_id": "flow-e91e1e813e652ecf496dbcad", "packets": 1, "transport": "udp", "last_frame": 17614, "first_frame": 17614, "initiator_ip": "10.3.11.3", "responder_ip": "10.3.11.194", "initiator_port": 137, "responder_port": 137, "initiator_bytes": 104, "last_seen_epoch": "1583962579.212807", "responder_bytes": 0, "first_seen_epoch": "1583962579.212807" }, { "bytes": 4536, "stream": 300, "flow_id": "flow-3f02ba9ec8514790bea496a2", "packets": 21, "transport": "udp", "last_frame": 21086, "first_frame": 17615, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 138, "responder_port": 138, "initiator_bytes": 4536, "last_seen_epoch": "1583962639.188823", "responder_bytes": 0, "first_seen_epoch": "1583962579.212967" }, { "bytes": 1388, "stream": 429, "flow_id": "flow-4a74073d3ae5f5d1526de84c", "packets": 12, "transport": "tcp", "last_frame": 19183, "first_frame": 18370, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 49811, "responder_port": 135, "initiator_bytes": 730, "last_seen_epoch": "1583962614.110618", "responder_bytes": 658, "first_seen_epoch": "1583962599.255086" }, { "bytes": 3062, "stream": 430, "flow_id": "flow-aca49721350ef128629f0f24", "packets": 12, "transport": "tcp", "last_frame": 19181, "first_frame": 18377, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 49812, "responder_port": 49671, "initiator_bytes": 1652, "last_seen_epoch": "1583962614.110492", "responder_bytes": 1410, "first_seen_epoch": "1583962599.257498" }, { "bytes": 890, "stream": 431, "flow_id": "flow-99f4b26c828516ddcc86913b", "packets": 8, "transport": "tcp", "last_frame": 18405, "first_frame": 18398, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 49813, "responder_port": 88, "initiator_bytes": 464, "last_seen_epoch": "1583962605.425352", "responder_bytes": 426, "first_seen_epoch": "1583962605.422244" }, { "bytes": 2529, "stream": 432, "flow_id": "flow-815342caaf293edc0fc13e1c", "packets": 10, "transport": "tcp", "last_frame": 18415, "first_frame": 18406, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 49814, "responder_port": 88, "initiator_bytes": 598, "last_seen_epoch": "1583962605.435975", "responder_bytes": 1931, "first_seen_epoch": "1583962605.430328" }, { "bytes": 3811, "stream": 433, "flow_id": "flow-d78ce0bf0d2b2e336974035d", "packets": 12, "transport": "tcp", "last_frame": 18427, "first_frame": 18416, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 49815, "responder_port": 88, "initiator_bytes": 1890, "last_seen_epoch": "1583962605.438328", "responder_bytes": 1921, "first_seen_epoch": "1583962605.436158" }, { "bytes": 1218352, "stream": 434, "flow_id": "flow-6d3e92bc34371e0e16b4fd1b", "packets": 979, "transport": "tcp", "last_frame": 26682, "first_frame": 18428, "initiator_ip": "10.3.11.194", "responder_ip": "64.44.133.131", "initiator_port": 49816, "responder_port": 80, "initiator_bytes": 9396, "last_seen_epoch": "1583962675.107561", "responder_bytes": 1208956, "first_seen_epoch": "1583962605.617067" }, { "bytes": 120, "stream": 435, "flow_id": "flow-40a4a80d368e9df341535d85", "packets": 2, "transport": "tcp", "last_frame": 18935, "first_frame": 18934, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.1", "initiator_port": 49818, "responder_port": 445, "initiator_bytes": 66, "last_seen_epoch": "1583962607.303721", "responder_bytes": 54, "first_seen_epoch": "1583962607.303647" }, { "bytes": 348, "stream": 436, "flow_id": "flow-a4e8012279f595048493a33c", "packets": 6, "transport": "tcp", "last_frame": 18941, "first_frame": 18936, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 49819, "responder_port": 445, "initiator_bytes": 174, "last_seen_epoch": "1583962607.304657", "responder_bytes": 174, "first_seen_epoch": "1583962607.303836" }, { "bytes": 345, "stream": 437, "flow_id": "flow-b066647073acf2363f849587", "packets": 5, "transport": "tcp", "last_frame": 18946, "first_frame": 18942, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 49821, "responder_port": 445, "initiator_bytes": 225, "last_seen_epoch": "1583962607.305602", "responder_bytes": 120, "first_seen_epoch": "1583962607.304778" }, { "bytes": 345, "stream": 438, "flow_id": "flow-0540b08dc3021fee0d18b531", "packets": 5, "transport": "tcp", "last_frame": 18951, "first_frame": 18947, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 49824, "responder_port": 445, "initiator_bytes": 225, "last_seen_epoch": "1583962607.30713", "responder_bytes": 120, "first_seen_epoch": "1583962607.306138" }, { "bytes": 348, "stream": 439, "flow_id": "flow-76dc4ab44e9c6fcbeaf5ea6c", "packets": 6, "transport": "tcp", "last_frame": 18957, "first_frame": 18952, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.218", "initiator_port": 49919, "responder_port": 445, "initiator_bytes": 174, "last_seen_epoch": "1583962607.326573", "responder_bytes": 174, "first_seen_epoch": "1583962607.325811" }, { "bytes": 345, "stream": 440, "flow_id": "flow-57baa47a564fe566981ebd59", "packets": 5, "transport": "tcp", "last_frame": 18962, "first_frame": 18958, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.218", "initiator_port": 49921, "responder_port": 445, "initiator_bytes": 225, "last_seen_epoch": "1583962607.328027", "responder_bytes": 120, "first_seen_epoch": "1583962607.326622" }, { "bytes": 345, "stream": 441, "flow_id": "flow-a86b3bd54860ae8d3f75a77a", "packets": 5, "transport": "tcp", "last_frame": 18968, "first_frame": 18963, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.218", "initiator_port": 49923, "responder_port": 445, "initiator_bytes": 225, "last_seen_epoch": "1583962607.329742", "responder_bytes": 120, "first_seen_epoch": "1583962607.328407" }, { "bytes": 348, "stream": 442, "flow_id": "flow-e2d95bebd2e1301e8b3fd2c2", "packets": 6, "transport": "tcp", "last_frame": 18973, "first_frame": 18967, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.119", "initiator_port": 49925, "responder_port": 445, "initiator_bytes": 174, "last_seen_epoch": "1583962607.330648", "responder_bytes": 174, "first_seen_epoch": "1583962607.329727" }, { "bytes": 345, "stream": 443, "flow_id": "flow-fb1dbfcd37ee9e9f9d364f11", "packets": 5, "transport": "tcp", "last_frame": 18978, "first_frame": 18974, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.119", "initiator_port": 49927, "responder_port": 445, "initiator_bytes": 225, "last_seen_epoch": "1583962607.33187", "responder_bytes": 120, "first_seen_epoch": "1583962607.330746" }, { "bytes": 345, "stream": 444, "flow_id": "flow-0951d67cc16e3eec1e4cc984", "packets": 5, "transport": "tcp", "last_frame": 18983, "first_frame": 18979, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.119", "initiator_port": 49929, "responder_port": 445, "initiator_bytes": 225, "last_seen_epoch": "1583962607.333598", "responder_bytes": 120, "first_seen_epoch": "1583962607.332162" }, { "bytes": 66, "stream": 445, "flow_id": "flow-e346a88b43c534db66f0054a", "packets": 1, "transport": "tcp", "last_frame": 18984, "first_frame": 18984, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.131", "initiator_port": 49955, "responder_port": 445, "initiator_bytes": 66, "last_seen_epoch": "1583962607.337749", "responder_bytes": 0, "first_seen_epoch": "1583962607.337749" }, { "bytes": 66, "stream": 446, "flow_id": "flow-56637a08a012a0bba6179bad", "packets": 1, "transport": "tcp", "last_frame": 18985, "first_frame": 18985, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.254", "initiator_port": 50078, "responder_port": 445, "initiator_bytes": 66, "last_seen_epoch": "1583962607.355615", "responder_bytes": 0, "first_seen_epoch": "1583962607.355615" }, { "bytes": 120, "stream": 447, "flow_id": "flow-504575648ac357feaa2080fb", "packets": 2, "transport": "tcp", "last_frame": 18990, "first_frame": 18989, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.1", "initiator_port": 49818, "responder_port": 445, "initiator_bytes": 66, "last_seen_epoch": "1583962607.829015", "responder_bytes": 54, "first_seen_epoch": "1583962607.828937" }, { "bytes": 1396, "stream": 448, "flow_id": "flow-6d905a6b003df6bba247bfa6", "packets": 11, "transport": "tcp", "last_frame": 19490, "first_frame": 19029, "initiator_ip": "10.3.11.194", "responder_ip": "203.176.135.102", "initiator_port": 50080, "responder_port": 8082, "initiator_bytes": 983, "last_seen_epoch": "1583962614.758926", "responder_bytes": 413, "first_seen_epoch": "1583962612.816786" }, { "bytes": 1673, "stream": 449, "flow_id": "flow-63b7bfa46659e9ec0c296d33", "packets": 11, "transport": "tcp", "last_frame": 19556, "first_frame": 19538, "initiator_ip": "10.3.11.194", "responder_ip": "203.176.135.102", "initiator_port": 50081, "responder_port": 8082, "initiator_bytes": 1260, "last_seen_epoch": "1583962616.819709", "responder_bytes": 413, "first_seen_epoch": "1583962615.282016" }, { "bytes": 611579, "stream": 450, "flow_id": "flow-1323ea4219d424e062c98e03", "packets": 540, "transport": "tcp", "last_frame": 21113, "first_frame": 19559, "initiator_ip": "10.3.11.194", "responder_ip": "64.44.133.131", "initiator_port": 50082, "responder_port": 80, "initiator_bytes": 7382, "last_seen_epoch": "1583962648.36262", "responder_bytes": 604197, "first_seen_epoch": "1583962617.138043" }, { "bytes": 1740, "stream": 451, "flow_id": "flow-a2f5c53e6e04461dd12495b9", "packets": 14, "transport": "tcp", "last_frame": 26699, "first_frame": 20104, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 50083, "responder_port": 135, "initiator_bytes": 952, "last_seen_epoch": "1583962679.246795", "responder_bytes": 788, "first_seen_epoch": "1583962619.253466" }, { "bytes": 6859, "stream": 452, "flow_id": "flow-bbb40a2347526dd116337605", "packets": 26, "transport": "tcp", "last_frame": 26698, "first_frame": 20112, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 50084, "responder_port": 49667, "initiator_bytes": 4362, "last_seen_epoch": "1583962679.246673", "responder_bytes": 2497, "first_seen_epoch": "1583962619.257406" }, { "bytes": 922, "stream": 453, "flow_id": "flow-c685d004702bad70197c1c25", "packets": 8, "transport": "tcp", "last_frame": 20123, "first_frame": 20115, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 50085, "responder_port": 88, "initiator_bytes": 473, "last_seen_epoch": "1583962619.259637", "responder_bytes": 449, "first_seen_epoch": "1583962619.258265" }, { "bytes": 2538, "stream": 454, "flow_id": "flow-4c6a42a665a2f39020a01ab6", "packets": 10, "transport": "tcp", "last_frame": 20132, "first_frame": 20122, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 50086, "responder_port": 88, "initiator_bytes": 607, "last_seen_epoch": "1583962619.26154", "responder_bytes": 1931, "first_seen_epoch": "1583962619.259627" }, { "bytes": 4103, "stream": 455, "flow_id": "flow-7edc32afbb8b72d6e79126ba", "packets": 12, "transport": "tcp", "last_frame": 20144, "first_frame": 20133, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 50087, "responder_port": 88, "initiator_bytes": 2062, "last_seen_epoch": "1583962619.263601", "responder_bytes": 2041, "first_seen_epoch": "1583962619.261715" }, { "bytes": 327229, "stream": 456, "flow_id": "flow-ffbbde3a741be4a407a6f2f1", "packets": 251, "transport": "tcp", "last_frame": 20650, "first_frame": 20165, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 50088, "responder_port": 3268, "initiator_bytes": 4925, "last_seen_epoch": "1583962619.528857", "responder_bytes": 322304, "first_seen_epoch": "1583962619.286255" }, { "bytes": 4071, "stream": 457, "flow_id": "flow-bbfe775af8e23a53e6df5686", "packets": 12, "transport": "tcp", "last_frame": 20183, "first_frame": 20172, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 50089, "responder_port": 88, "initiator_bytes": 2046, "last_seen_epoch": "1583962619.290508", "responder_bytes": 2025, "first_seen_epoch": "1583962619.288713" }, { "bytes": 335, "stream": 301, "flow_id": "flow-0b49346f994e0fa75ad19bd8", "packets": 2, "transport": "udp", "last_frame": 20430, "first_frame": 20429, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 63274, "responder_port": 53, "initiator_bytes": 130, "last_seen_epoch": "1583962619.346051", "responder_bytes": 205, "first_seen_epoch": "1583962619.345766" }, { "bytes": 273, "stream": 302, "flow_id": "flow-9aa41d482ee7476a81bcca30", "packets": 2, "transport": "udp", "last_frame": 20432, "first_frame": 20431, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 59264, "responder_port": 53, "initiator_bytes": 99, "last_seen_epoch": "1583962619.346816", "responder_bytes": 174, "first_seen_epoch": "1583962619.346638" }, { "bytes": 538, "stream": 303, "flow_id": "flow-a270ea961e2ec9f5ce492423", "packets": 2, "transport": "udp", "last_frame": 20434, "first_frame": 20433, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 59265, "responder_port": 389, "initiator_bytes": 306, "last_seen_epoch": "1583962619.34761", "responder_bytes": 232, "first_seen_epoch": "1583962619.347329" }, { "bytes": 70354, "stream": 458, "flow_id": "flow-c6c7b31e01203b5c6fc90093", "packets": 215, "transport": "tcp", "last_frame": 29517, "first_frame": 20436, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 50090, "responder_port": 389, "initiator_bytes": 21202, "last_seen_epoch": "1583963166.916122", "responder_bytes": 49152, "first_seen_epoch": "1583962619.471148" }, { "bytes": 6771, "stream": 459, "flow_id": "flow-ce478ff3699f246288fe79dd", "packets": 19, "transport": "tcp", "last_frame": 27308, "first_frame": 20651, "initiator_ip": "10.3.11.194", "responder_ip": "203.176.135.102", "initiator_port": 50091, "responder_port": 8082, "initiator_bytes": 6161, "last_seen_epoch": "1583962729.520584", "responder_bytes": 610, "first_seen_epoch": "1583962619.547657" }, { "bytes": 7801, "stream": 460, "flow_id": "flow-a9805bd31c421f27918c7acc", "packets": 48, "transport": "tcp", "last_frame": 27425, "first_frame": 20681, "initiator_ip": "10.3.11.194", "responder_ip": "190.214.13.2", "initiator_port": 50092, "responder_port": 449, "initiator_bytes": 5080, "last_seen_epoch": "1583962797.409826", "responder_bytes": 2721, "first_seen_epoch": "1583962621.299027" }, { "bytes": 233, "stream": 304, "flow_id": "flow-93f33557812b10261aa57667", "packets": 2, "transport": "udp", "last_frame": 20703, "first_frame": 20702, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 63731, "responder_port": 53, "initiator_bytes": 79, "last_seen_epoch": "1583962623.503009", "responder_bytes": 154, "first_seen_epoch": "1583962623.502662" }, { "bytes": 327937, "stream": 461, "flow_id": "flow-e5c6de3a040f1d03a21e3941", "packets": 254, "transport": "tcp", "last_frame": 21080, "first_frame": 20806, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 50093, "responder_port": 3268, "initiator_bytes": 5081, "last_seen_epoch": "1583962637.224831", "responder_bytes": 322856, "first_seen_epoch": "1583962637.170294" }, { "bytes": 192, "stream": 305, "flow_id": "flow-70b8945d5b7a4d06a13c8624", "packets": 2, "transport": "udp", "last_frame": 21057, "first_frame": 21056, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 57400, "responder_port": 53, "initiator_bytes": 88, "last_seen_epoch": "1583962637.214931", "responder_bytes": 104, "first_seen_epoch": "1583962637.214633" }, { "bytes": 345, "stream": 462, "flow_id": "flow-8fbfaebaa83ce9caff9636e2", "packets": 5, "transport": "tcp", "last_frame": 21062, "first_frame": 21058, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 50094, "responder_port": 445, "initiator_bytes": 225, "last_seen_epoch": "1583962637.216157", "responder_bytes": 120, "first_seen_epoch": "1583962637.215463" }, { "bytes": 194, "stream": 306, "flow_id": "flow-a690641c430bf99e05f92c8f", "packets": 2, "transport": "udp", "last_frame": 21064, "first_frame": 21063, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 54422, "responder_port": 53, "initiator_bytes": 89, "last_seen_epoch": "1583962637.217396", "responder_bytes": 105, "first_seen_epoch": "1583962637.217205" }, { "bytes": 345, "stream": 463, "flow_id": "flow-3085ceb0a0f392fc58abb6fc", "packets": 5, "transport": "tcp", "last_frame": 21069, "first_frame": 21065, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.218", "initiator_port": 50095, "responder_port": 445, "initiator_bytes": 225, "last_seen_epoch": "1583962637.218729", "responder_bytes": 120, "first_seen_epoch": "1583962637.217886" }, { "bytes": 194, "stream": 307, "flow_id": "flow-5c873472715911aaa685a12d", "packets": 2, "transport": "udp", "last_frame": 21071, "first_frame": 21070, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 58602, "responder_port": 53, "initiator_bytes": 89, "last_seen_epoch": "1583962637.221413", "responder_bytes": 105, "first_seen_epoch": "1583962637.221006" }, { "bytes": 345, "stream": 464, "flow_id": "flow-2fd72eccd17894e6aa7f5f51", "packets": 5, "transport": "tcp", "last_frame": 21076, "first_frame": 21072, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.119", "initiator_port": 50097, "responder_port": 445, "initiator_bytes": 225, "last_seen_epoch": "1583962637.223858", "responder_bytes": 120, "first_seen_epoch": "1583962637.222158" }, { "bytes": 1341, "stream": 465, "flow_id": "flow-9846bce43c2b19cb915d8353", "packets": 11, "transport": "tcp", "last_frame": 21104, "first_frame": 21087, "initiator_ip": "10.3.11.194", "responder_ip": "203.176.135.102", "initiator_port": 50098, "responder_port": 8082, "initiator_bytes": 928, "last_seen_epoch": "1583962640.726867", "responder_bytes": 413, "first_seen_epoch": "1583962639.345379" }, { "bytes": 226, "stream": 308, "flow_id": "flow-8c15171f06a06454e5c7a704", "packets": 3, "transport": "udp", "last_frame": 21133, "first_frame": 21114, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 53423, "responder_port": 53, "initiator_bytes": 140, "last_seen_epoch": "1583962650.349973", "responder_bytes": 86, "first_seen_epoch": "1583962650.283852" }, { "bytes": 342, "stream": 309, "flow_id": "flow-743fb1683f4ee3e533ebb771", "packets": 3, "transport": "udp", "last_frame": 21127, "first_frame": 21115, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 51518, "responder_port": 53, "initiator_bytes": 146, "last_seen_epoch": "1583962650.340042", "responder_bytes": 196, "first_seen_epoch": "1583962650.283918" }, { "bytes": 288, "stream": 310, "flow_id": "flow-ec01eac3549d6a4209b37ef5", "packets": 3, "transport": "udp", "last_frame": 21130, "first_frame": 21116, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 56355, "responder_port": 53, "initiator_bytes": 160, "last_seen_epoch": "1583962650.341046", "responder_bytes": 128, "first_seen_epoch": "1583962650.284728" }, { "bytes": 254, "stream": 311, "flow_id": "flow-88c35d5ff3ea3deb564b57ad", "packets": 3, "transport": "udp", "last_frame": 21128, "first_frame": 21117, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 55270, "responder_port": 53, "initiator_bytes": 148, "last_seen_epoch": "1583962650.3401", "responder_bytes": 106, "first_seen_epoch": "1583962650.284771" }, { "bytes": 233, "stream": 312, "flow_id": "flow-5542c43d445523912904cb47", "packets": 2, "transport": "udp", "last_frame": 21119, "first_frame": 21118, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 63456, "responder_port": 53, "initiator_bytes": 79, "last_seen_epoch": "1583962650.285771", "responder_bytes": 154, "first_seen_epoch": "1583962650.285566" }, { "bytes": 128, "stream": 313, "flow_id": "flow-6776a9cf672ec5bb2035be56", "packets": 2, "transport": "udp", "last_frame": 21223, "first_frame": 21122, "initiator_ip": "10.3.11.119", "responder_ip": "224.0.0.252", "initiator_port": 61635, "responder_port": 5355, "initiator_bytes": 128, "last_seen_epoch": "1583962650.696699", "responder_bytes": 0, "first_seen_epoch": "1583962650.286974" }, { "bytes": 9722, "stream": 466, "flow_id": "flow-3c3ec145ac64bcaaab65f656", "packets": 27, "transport": "tcp", "last_frame": 27010, "first_frame": 21129, "initiator_ip": "10.3.11.119", "responder_ip": "72.246.84.150", "initiator_port": 49816, "responder_port": 443, "initiator_bytes": 3156, "last_seen_epoch": "1583962690.728097", "responder_bytes": 6566, "first_seen_epoch": "1583962650.340825" }, { "bytes": 242, "stream": 314, "flow_id": "flow-0574cb9fbd6b94429255725f", "packets": 3, "transport": "udp", "last_frame": 21145, "first_frame": 21131, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 54141, "responder_port": 53, "initiator_bytes": 140, "last_seen_epoch": "1583962650.385341", "responder_bytes": 102, "first_seen_epoch": "1583962650.341897" }, { "bytes": 256, "stream": 315, "flow_id": "flow-81d11c72f87cb8d4121a1b1b", "packets": 3, "transport": "udp", "last_frame": 21139, "first_frame": 21132, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 56582, "responder_port": 53, "initiator_bytes": 160, "last_seen_epoch": "1583962650.374617", "responder_bytes": 96, "first_seen_epoch": "1583962650.343191" }, { "bytes": 1201, "stream": 467, "flow_id": "flow-38e115605a7d7884880848bd", "packets": 11, "transport": "tcp", "last_frame": 27225, "first_frame": 21134, "initiator_ip": "10.3.11.119", "responder_ip": "23.199.252.214", "initiator_port": 49817, "responder_port": 80, "initiator_bytes": 758, "last_seen_epoch": "1583962694.366382", "responder_bytes": 443, "first_seen_epoch": "1583962650.350628" }, { "bytes": 394, "stream": 468, "flow_id": "flow-308e52cb51a5fd8e3e118c9a", "packets": 7, "transport": "tcp", "last_frame": 26488, "first_frame": 21135, "initiator_ip": "10.3.11.119", "responder_ip": "23.199.252.214", "initiator_port": 49818, "responder_port": 80, "initiator_bytes": 228, "last_seen_epoch": "1583962661.182507", "responder_bytes": 166, "first_seen_epoch": "1583962650.350971" }, { "bytes": 283, "stream": 316, "flow_id": "flow-e35024730990608c0cfdbb57", "packets": 3, "transport": "udp", "last_frame": 21142, "first_frame": 21136, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 50427, "responder_port": 53, "initiator_bytes": 154, "last_seen_epoch": "1583962650.383619", "responder_bytes": 129, "first_seen_epoch": "1583962650.35218" }, { "bytes": 322, "stream": 317, "flow_id": "flow-863b10c54297a43c108b07c9", "packets": 3, "transport": "udp", "last_frame": 21160, "first_frame": 21140, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 60835, "responder_port": 53, "initiator_bytes": 148, "last_seen_epoch": "1583962650.459266", "responder_bytes": 174, "first_seen_epoch": "1583962650.376392" }, { "bytes": 322, "stream": 318, "flow_id": "flow-8264d45206249d8744722fe4", "packets": 3, "transport": "udp", "last_frame": 21159, "first_frame": 21148, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 61619, "responder_port": 53, "initiator_bytes": 148, "last_seen_epoch": "1583962650.459214", "responder_bytes": 174, "first_seen_epoch": "1583962650.385872" }, { "bytes": 322, "stream": 319, "flow_id": "flow-c883369146f05cc59dde9f1f", "packets": 3, "transport": "udp", "last_frame": 21161, "first_frame": 21149, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 62359, "responder_port": 53, "initiator_bytes": 148, "last_seen_epoch": "1583962650.459342", "responder_bytes": 174, "first_seen_epoch": "1583962650.387061" }, { "bytes": 321, "stream": 320, "flow_id": "flow-62ec0cefd114ce4d8eb61edc", "packets": 3, "transport": "udp", "last_frame": 21185, "first_frame": 21162, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 61173, "responder_port": 53, "initiator_bytes": 152, "last_seen_epoch": "1583962650.504416", "responder_bytes": 169, "first_seen_epoch": "1583962650.461201" }, { "bytes": 415, "stream": 321, "flow_id": "flow-1e6fbca6fc54a1693e682381", "packets": 3, "transport": "udp", "last_frame": 21194, "first_frame": 21163, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 65247, "responder_port": 53, "initiator_bytes": 160, "last_seen_epoch": "1583962650.527524", "responder_bytes": 255, "first_seen_epoch": "1583962650.461396" }, { "bytes": 331, "stream": 322, "flow_id": "flow-5b5aebd078bb6f4028af6436", "packets": 3, "transport": "udp", "last_frame": 21187, "first_frame": 21164, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 57606, "responder_port": 53, "initiator_bytes": 148, "last_seen_epoch": "1583962650.507613", "responder_bytes": 183, "first_seen_epoch": "1583962650.46162" }, { "bytes": 307, "stream": 323, "flow_id": "flow-b97ab2c0c7526543f6cb2da5", "packets": 3, "transport": "udp", "last_frame": 21195, "first_frame": 21179, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 62981, "responder_port": 53, "initiator_bytes": 148, "last_seen_epoch": "1583962650.527591", "responder_bytes": 159, "first_seen_epoch": "1583962650.483652" }, { "bytes": 327, "stream": 324, "flow_id": "flow-5412a79e3af53189a87c7626", "packets": 3, "transport": "udp", "last_frame": 21204, "first_frame": 21190, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 58852, "responder_port": 53, "initiator_bytes": 156, "last_seen_epoch": "1583962650.557545", "responder_bytes": 171, "first_seen_epoch": "1583962650.507885" }, { "bytes": 273, "stream": 325, "flow_id": "flow-a7922d39ba73c5a78cab4276", "packets": 3, "transport": "udp", "last_frame": 21205, "first_frame": 21191, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 58019, "responder_port": 53, "initiator_bytes": 152, "last_seen_epoch": "1583962650.557596", "responder_bytes": 121, "first_seen_epoch": "1583962650.509056" }, { "bytes": 1272, "stream": 469, "flow_id": "flow-03ae4ea988250224870a8ab2", "packets": 11, "transport": "tcp", "last_frame": 27227, "first_frame": 21196, "initiator_ip": "10.3.11.119", "responder_ip": "72.246.84.229", "initiator_port": 49819, "responder_port": 80, "initiator_bytes": 762, "last_seen_epoch": "1583962694.366486", "responder_bytes": 510, "first_seen_epoch": "1583962650.528623" }, { "bytes": 288, "stream": 326, "flow_id": "flow-e23700ada8e7f0ce56fb9c8a", "packets": 3, "transport": "udp", "last_frame": 21211, "first_frame": 21197, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 65305, "responder_port": 53, "initiator_bytes": 172, "last_seen_epoch": "1583962650.607967", "responder_bytes": 116, "first_seen_epoch": "1583962650.53017" }, { "bytes": 315, "stream": 327, "flow_id": "flow-dd4ce2f8d0646863bcac8162", "packets": 3, "transport": "udp", "last_frame": 21212, "first_frame": 21206, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 53158, "responder_port": 53, "initiator_bytes": 146, "last_seen_epoch": "1583962650.608017", "responder_bytes": 169, "first_seen_epoch": "1583962650.558947" }, { "bytes": 2495948, "stream": 470, "flow_id": "flow-21a3a11004af857075482ae6", "packets": 2281, "transport": "tcp", "last_frame": 27185, "first_frame": 21209, "initiator_ip": "10.3.11.119", "responder_ip": "72.246.84.229", "initiator_port": 49820, "responder_port": 443, "initiator_bytes": 51265, "last_seen_epoch": "1583962694.358785", "responder_bytes": 2444683, "first_seen_epoch": "1583962650.587697" }, { "bytes": 255, "stream": 328, "flow_id": "flow-308a4e7c2de211e10379c265", "packets": 2, "transport": "udp", "last_frame": 21288, "first_frame": 21274, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 63162, "responder_port": 53, "initiator_bytes": 79, "last_seen_epoch": "1583962650.943602", "responder_bytes": 176, "first_seen_epoch": "1583962650.898819" }, { "bytes": 247, "stream": 329, "flow_id": "flow-f65966eb81da2e8e082899b7", "packets": 2, "transport": "udp", "last_frame": 21290, "first_frame": 21281, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 65272, "responder_port": 53, "initiator_bytes": 81, "last_seen_epoch": "1583962650.943765", "responder_bytes": 166, "first_seen_epoch": "1583962650.89942" }, { "bytes": 429, "stream": 330, "flow_id": "flow-cb116a2d1e3200d150761278", "packets": 4, "transport": "udp", "last_frame": 26006, "first_frame": 21282, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 50155, "responder_port": 53, "initiator_bytes": 164, "last_seen_epoch": "1583962656.958202", "responder_bytes": 265, "first_seen_epoch": "1583962650.899589" }, { "bytes": 8394, "stream": 471, "flow_id": "flow-039bf0d943cbcc9c6bc918f5", "packets": 19, "transport": "tcp", "last_frame": 26484, "first_frame": 21291, "initiator_ip": "10.3.11.119", "responder_ip": "72.246.84.229", "initiator_port": 49821, "responder_port": 443, "initiator_bytes": 1087, "last_seen_epoch": "1583962661.170633", "responder_bytes": 7307, "first_seen_epoch": "1583962650.948046" }, { "bytes": 8394, "stream": 472, "flow_id": "flow-1fe10c33fd21b3411e843e78", "packets": 19, "transport": "tcp", "last_frame": 26475, "first_frame": 21292, "initiator_ip": "10.3.11.119", "responder_ip": "72.246.84.229", "initiator_port": 49822, "responder_port": 443, "initiator_bytes": 1087, "last_seen_epoch": "1583962661.166818", "responder_bytes": 7307, "first_seen_epoch": "1583962650.948834" }, { "bytes": 322, "stream": 331, "flow_id": "flow-bbb68acdc3656d568682e100", "packets": 3, "transport": "udp", "last_frame": 21376, "first_frame": 21294, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 57957, "responder_port": 53, "initiator_bytes": 158, "last_seen_epoch": "1583962651.053207", "responder_bytes": 164, "first_seen_epoch": "1583962650.958089" }, { "bytes": 6336, "stream": 473, "flow_id": "flow-d3a33fe6567c9636d1cd5b7c", "packets": 17, "transport": "tcp", "last_frame": 26472, "first_frame": 21295, "initiator_ip": "10.3.11.119", "responder_ip": "23.199.253.39", "initiator_port": 49823, "responder_port": 443, "initiator_bytes": 1041, "last_seen_epoch": "1583962661.166591", "responder_bytes": 5295, "first_seen_epoch": "1583962650.95892" }, { "bytes": 203, "stream": 332, "flow_id": "flow-f4b7a1a5cdcd896412267ad9", "packets": 2, "transport": "udp", "last_frame": 21318, "first_frame": 21296, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 56081, "responder_port": 53, "initiator_bytes": 75, "last_seen_epoch": "1583962650.986719", "responder_bytes": 128, "first_seen_epoch": "1583962650.959746" }, { "bytes": 316, "stream": 333, "flow_id": "flow-1d49250c3d654a3580f738fb", "packets": 3, "transport": "udp", "last_frame": 21364, "first_frame": 21297, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 56487, "responder_port": 53, "initiator_bytes": 154, "last_seen_epoch": "1583962651.000088", "responder_bytes": 162, "first_seen_epoch": "1583962650.96012" }, { "bytes": 325, "stream": 334, "flow_id": "flow-51f12606e9658814b943b8ad", "packets": 3, "transport": "udp", "last_frame": 21479, "first_frame": 21306, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 59947, "responder_port": 53, "initiator_bytes": 160, "last_seen_epoch": "1583962651.129702", "responder_bytes": 165, "first_seen_epoch": "1583962650.967564" }, { "bytes": 264436, "stream": 474, "flow_id": "flow-f99d0ea65a3abf48ad93eb68", "packets": 348, "transport": "tcp", "last_frame": 27174, "first_frame": 21311, "initiator_ip": "10.3.11.119", "responder_ip": "72.246.84.229", "initiator_port": 49824, "responder_port": 443, "initiator_bytes": 13017, "last_seen_epoch": "1583962694.357837", "responder_bytes": 251419, "first_seen_epoch": "1583962650.96941" }, { "bytes": 8394, "stream": 475, "flow_id": "flow-7eac5eb0e52919f78ee3dfe8", "packets": 19, "transport": "tcp", "last_frame": 21622, "first_frame": 21312, "initiator_ip": "10.3.11.119", "responder_ip": "72.246.84.229", "initiator_port": 49825, "responder_port": 443, "initiator_bytes": 1087, "last_seen_epoch": "1583962651.197912", "responder_bytes": 7307, "first_seen_epoch": "1583962650.969826" }, { "bytes": 8394, "stream": 476, "flow_id": "flow-5b35f5f9e0f1d3ce68d28db9", "packets": 19, "transport": "tcp", "last_frame": 21623, "first_frame": 21313, "initiator_ip": "10.3.11.119", "responder_ip": "72.246.84.229", "initiator_port": 49826, "responder_port": 443, "initiator_bytes": 1087, "last_seen_epoch": "1583962651.197964", "responder_bytes": 7307, "first_seen_epoch": "1583962650.970203" }, { "bytes": 8340, "stream": 477, "flow_id": "flow-92ee46b9000c7fc2c189a29c", "packets": 18, "transport": "tcp", "last_frame": 21619, "first_frame": 21314, "initiator_ip": "10.3.11.119", "responder_ip": "72.246.84.229", "initiator_port": 49827, "responder_port": 443, "initiator_bytes": 1087, "last_seen_epoch": "1583962651.197605", "responder_bytes": 7253, "first_seen_epoch": "1583962650.970604" }, { "bytes": 8340, "stream": 478, "flow_id": "flow-a74506702c0fc1e64b3b15d6", "packets": 18, "transport": "tcp", "last_frame": 21620, "first_frame": 21315, "initiator_ip": "10.3.11.119", "responder_ip": "72.246.84.229", "initiator_port": 49828, "responder_port": 443, "initiator_bytes": 1087, "last_seen_epoch": "1583962651.197695", "responder_bytes": 7253, "first_seen_epoch": "1583962650.970993" }, { "bytes": 8286, "stream": 479, "flow_id": "flow-b1269d1b74d49d10a66b33bb", "packets": 17, "transport": "tcp", "last_frame": 21621, "first_frame": 21316, "initiator_ip": "10.3.11.119", "responder_ip": "72.246.84.229", "initiator_port": 49829, "responder_port": 443, "initiator_bytes": 1033, "last_seen_epoch": "1583962651.197785", "responder_bytes": 7253, "first_seen_epoch": "1583962650.971378" }, { "bytes": 311, "stream": 335, "flow_id": "flow-9535b7b47fb18fcb5710b567", "packets": 3, "transport": "udp", "last_frame": 21451, "first_frame": 21317, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 59946, "responder_port": 53, "initiator_bytes": 150, "last_seen_epoch": "1583962651.128381", "responder_bytes": 161, "first_seen_epoch": "1583962650.97353" }, { "bytes": 38723, "stream": 480, "flow_id": "flow-603e1d3a36fc34ecce6c000b", "packets": 74, "transport": "tcp", "last_frame": 27184, "first_frame": 21319, "initiator_ip": "10.3.11.119", "responder_ip": "152.199.4.210", "initiator_port": 49830, "responder_port": 443, "initiator_bytes": 3946, "last_seen_epoch": "1583962694.358724", "responder_bytes": 34777, "first_seen_epoch": "1583962650.987599" }, { "bytes": 5875, "stream": 481, "flow_id": "flow-304c55fe6a5aa7baa0f9c97e", "packets": 17, "transport": "tcp", "last_frame": 26486, "first_frame": 21320, "initiator_ip": "10.3.11.119", "responder_ip": "216.58.194.131", "initiator_port": 49831, "responder_port": 443, "initiator_bytes": 1025, "last_seen_epoch": "1583962661.181974", "responder_bytes": 4850, "first_seen_epoch": "1583962650.988377" }, { "bytes": 321, "stream": 336, "flow_id": "flow-82063fdc9348efe1a248dc14", "packets": 3, "transport": "udp", "last_frame": 21384, "first_frame": 21322, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 51241, "responder_port": 53, "initiator_bytes": 154, "last_seen_epoch": "1583962651.09208", "responder_bytes": 167, "first_seen_epoch": "1583962650.989158" }, { "bytes": 8448, "stream": 482, "flow_id": "flow-f5fa9f0dfec0ba320b97c774", "packets": 20, "transport": "tcp", "last_frame": 26522, "first_frame": 21365, "initiator_ip": "10.3.11.119", "responder_ip": "72.246.84.229", "initiator_port": 49832, "responder_port": 443, "initiator_bytes": 1141, "last_seen_epoch": "1583962661.413033", "responder_bytes": 7307, "first_seen_epoch": "1583962651.00177" }, { "bytes": 310, "stream": 337, "flow_id": "flow-66eb39579bf63b06a64dda80", "packets": 3, "transport": "udp", "last_frame": 21385, "first_frame": 21366, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 54281, "responder_port": 53, "initiator_bytes": 150, "last_seen_epoch": "1583962651.092134", "responder_bytes": 160, "first_seen_epoch": "1583962651.002847" }, { "bytes": 8448, "stream": 483, "flow_id": "flow-aa36d50f8b4c0ff8a4c87ef8", "packets": 20, "transport": "tcp", "last_frame": 26519, "first_frame": 21377, "initiator_ip": "10.3.11.119", "responder_ip": "72.246.84.229", "initiator_port": 49833, "responder_port": 443, "initiator_bytes": 1141, "last_seen_epoch": "1583962661.412661", "responder_bytes": 7307, "first_seen_epoch": "1583962651.054587" }, { "bytes": 346, "stream": 338, "flow_id": "flow-bccc0193f24a320949dc7d27", "packets": 3, "transport": "udp", "last_frame": 21482, "first_frame": 21378, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 61059, "responder_port": 53, "initiator_bytes": 168, "last_seen_epoch": "1583962651.129952", "responder_bytes": 178, "first_seen_epoch": "1583962651.055367" }, { "bytes": 19661, "stream": 484, "flow_id": "flow-331cd5c5afd965252bfd0974", "packets": 57, "transport": "tcp", "last_frame": 26604, "first_frame": 21386, "initiator_ip": "10.3.11.119", "responder_ip": "3.219.244.74", "initiator_port": 49834, "responder_port": 443, "initiator_bytes": 8769, "last_seen_epoch": "1583962662.763181", "responder_bytes": 10892, "first_seen_epoch": "1583962651.093461" }, { "bytes": 319, "stream": 339, "flow_id": "flow-31146a7359e80c1aa7d7dcca", "packets": 3, "transport": "udp", "last_frame": 21566, "first_frame": 21387, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 52037, "responder_port": 53, "initiator_bytes": 156, "last_seen_epoch": "1583962651.194645", "responder_bytes": 163, "first_seen_epoch": "1583962651.094883" }, { "bytes": 8448, "stream": 485, "flow_id": "flow-420f538d0b47c688549a3caa", "packets": 20, "transport": "tcp", "last_frame": 26517, "first_frame": 21388, "initiator_ip": "10.3.11.119", "responder_ip": "72.246.84.229", "initiator_port": 49835, "responder_port": 443, "initiator_bytes": 1141, "last_seen_epoch": "1583962661.412368", "responder_bytes": 7307, "first_seen_epoch": "1583962651.09576" }, { "bytes": 304, "stream": 340, "flow_id": "flow-91e725f06e503998706626ea", "packets": 3, "transport": "udp", "last_frame": 21486, "first_frame": 21389, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 52214, "responder_port": 53, "initiator_bytes": 146, "last_seen_epoch": "1583962651.132407", "responder_bytes": 158, "first_seen_epoch": "1583962651.096911" }, { "bytes": 11289, "stream": 486, "flow_id": "flow-6ad98d0d363c9729f85ea155", "packets": 27, "transport": "tcp", "last_frame": 27236, "first_frame": 21493, "initiator_ip": "10.3.11.119", "responder_ip": "23.204.16.227", "initiator_port": 49836, "responder_port": 443, "initiator_bytes": 2318, "last_seen_epoch": "1583962694.372905", "responder_bytes": 8971, "first_seen_epoch": "1583962651.137754" }, { "bytes": 310, "stream": 341, "flow_id": "flow-68027f794c659a140ff18deb", "packets": 3, "transport": "udp", "last_frame": 21634, "first_frame": 21520, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 62654, "responder_port": 53, "initiator_bytes": 150, "last_seen_epoch": "1583962651.199027", "responder_bytes": 160, "first_seen_epoch": "1583962651.150243" }, { "bytes": 72599, "stream": 487, "flow_id": "flow-514b15b057ce1e451667094b", "packets": 83, "transport": "tcp", "last_frame": 27175, "first_frame": 21553, "initiator_ip": "10.3.11.119", "responder_ip": "104.117.242.71", "initiator_port": 49837, "responder_port": 443, "initiator_bytes": 2525, "last_seen_epoch": "1583962694.357915", "responder_bytes": 70074, "first_seen_epoch": "1583962651.154497" }, { "bytes": 8354, "stream": 488, "flow_id": "flow-1cb1d4a343637a265421fad0", "packets": 19, "transport": "tcp", "last_frame": 26533, "first_frame": 21554, "initiator_ip": "10.3.11.119", "responder_ip": "72.246.84.229", "initiator_port": 49838, "responder_port": 443, "initiator_bytes": 1087, "last_seen_epoch": "1583962661.434929", "responder_bytes": 7267, "first_seen_epoch": "1583962651.155464" }, { "bytes": 8448, "stream": 489, "flow_id": "flow-99537f2b47f0ad11e84d7c3e", "packets": 20, "transport": "tcp", "last_frame": 26515, "first_frame": 21626, "initiator_ip": "10.3.11.119", "responder_ip": "72.246.84.229", "initiator_port": 49839, "responder_port": 443, "initiator_bytes": 1141, "last_seen_epoch": "1583962661.41209", "responder_bytes": 7307, "first_seen_epoch": "1583962651.198297" }, { "bytes": 8448, "stream": 490, "flow_id": "flow-7a53055b55ec8e9b643757af", "packets": 20, "transport": "tcp", "last_frame": 26524, "first_frame": 21639, "initiator_ip": "10.3.11.119", "responder_ip": "72.246.84.229", "initiator_port": 49840, "responder_port": 443, "initiator_bytes": 1141, "last_seen_epoch": "1583962661.413172", "responder_bytes": 7307, "first_seen_epoch": "1583962651.206636" }, { "bytes": 344, "stream": 342, "flow_id": "flow-9297e93f9e3fc251a267a0ea", "packets": 3, "transport": "udp", "last_frame": 21898, "first_frame": 21822, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 51865, "responder_port": 53, "initiator_bytes": 158, "last_seen_epoch": "1583962651.3687", "responder_bytes": 186, "first_seen_epoch": "1583962651.315788" }, { "bytes": 1589, "stream": 491, "flow_id": "flow-b00ca6b36212fa0f0e83526d", "packets": 8, "transport": "tcp", "last_frame": 27237, "first_frame": 21900, "initiator_ip": "10.3.11.119", "responder_ip": "23.63.253.208", "initiator_port": 49841, "responder_port": 80, "initiator_bytes": 410, "last_seen_epoch": "1583962694.383465", "responder_bytes": 1179, "first_seen_epoch": "1583962651.379048" }, { "bytes": 460, "stream": 343, "flow_id": "flow-97a83bef6e0da9e6a3c698d1", "packets": 3, "transport": "udp", "last_frame": 21915, "first_frame": 21903, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 65012, "responder_port": 53, "initiator_bytes": 148, "last_seen_epoch": "1583962651.475025", "responder_bytes": 312, "first_seen_epoch": "1583962651.41937" }, { "bytes": 13881, "stream": 492, "flow_id": "flow-dd8584bbce9c4e5ce2ca3ac3", "packets": 36, "transport": "tcp", "last_frame": 27259, "first_frame": 21916, "initiator_ip": "10.3.11.119", "responder_ip": "34.208.131.21", "initiator_port": 49842, "responder_port": 443, "initiator_bytes": 4911, "last_seen_epoch": "1583962694.412958", "responder_bytes": 8970, "first_seen_epoch": "1583962651.476057" }, { "bytes": 22878, "stream": 493, "flow_id": "flow-6c9d916fe213f2c64f32bc1a", "packets": 41, "transport": "tcp", "last_frame": 27142, "first_frame": 22909, "initiator_ip": "10.3.11.119", "responder_ip": "216.58.194.131", "initiator_port": 49843, "responder_port": 443, "initiator_bytes": 2116, "last_seen_epoch": "1583962694.354725", "responder_bytes": 20762, "first_seen_epoch": "1583962651.722137" }, { "bytes": 2107, "stream": 494, "flow_id": "flow-9f78f4211cf748ab58a1fcf8", "packets": 12, "transport": "tcp", "last_frame": 23409, "first_frame": 23017, "initiator_ip": "10.3.11.119", "responder_ip": "216.58.194.131", "initiator_port": 49844, "responder_port": 443, "initiator_bytes": 987, "last_seen_epoch": "1583962651.823024", "responder_bytes": 1120, "first_seen_epoch": "1583962651.730925" }, { "bytes": 7030, "stream": 344, "flow_id": "flow-ee85f77d3809a992c9ae8317", "packets": 6, "transport": "udp", "last_frame": 23660, "first_frame": 23644, "initiator_ip": "10.3.11.119", "responder_ip": "216.58.194.131", "initiator_port": 65013, "responder_port": 443, "initiator_bytes": 2854, "last_seen_epoch": "1583962652.155704", "responder_bytes": 4176, "first_seen_epoch": "1583962652.084908" }, { "bytes": 332, "stream": 345, "flow_id": "flow-206cacb17def693a02b8aa19", "packets": 3, "transport": "udp", "last_frame": 23659, "first_frame": 23645, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 62050, "responder_port": 53, "initiator_bytes": 148, "last_seen_epoch": "1583962652.155462", "responder_bytes": 184, "first_seen_epoch": "1583962652.091134" }, { "bytes": 311, "stream": 346, "flow_id": "flow-89c5d8175ae6359224785420", "packets": 3, "transport": "udp", "last_frame": 23655, "first_frame": 23646, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 51146, "responder_port": 53, "initiator_bytes": 150, "last_seen_epoch": "1583962652.135603", "responder_bytes": 161, "first_seen_epoch": "1583962652.091185" }, { "bytes": 50281, "stream": 347, "flow_id": "flow-945c06ab06c703fd16b782bf", "packets": 59, "transport": "udp", "last_frame": 23746, "first_frame": 23652, "initiator_ip": "10.3.11.119", "responder_ip": "216.58.194.131", "initiator_port": 51147, "responder_port": 443, "initiator_bytes": 6309, "last_seen_epoch": "1583962652.299052", "responder_bytes": 43972, "first_seen_epoch": "1583962652.122809" }, { "bytes": 398, "stream": 348, "flow_id": "flow-5aec70081d3bba920d93afbe", "packets": 2, "transport": "udp", "last_frame": 23807, "first_frame": 23792, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 51707, "responder_port": 53, "initiator_bytes": 80, "last_seen_epoch": "1583962652.422875", "responder_bytes": 318, "first_seen_epoch": "1583962652.394288" }, { "bytes": 9115, "stream": 495, "flow_id": "flow-7a354c2c378fcae8a77da69e", "packets": 22, "transport": "tcp", "last_frame": 27263, "first_frame": 23808, "initiator_ip": "10.3.11.119", "responder_ip": "34.209.127.1", "initiator_port": 49845, "responder_port": 443, "initiator_bytes": 1792, "last_seen_epoch": "1583962694.415653", "responder_bytes": 7323, "first_seen_epoch": "1583962652.423622" }, { "bytes": 238, "stream": 349, "flow_id": "flow-c48be096756eea955cb21553", "packets": 2, "transport": "udp", "last_frame": 23849, "first_frame": 23844, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 61563, "responder_port": 53, "initiator_bytes": 78, "last_seen_epoch": "1583962652.620832", "responder_bytes": 160, "first_seen_epoch": "1583962652.593652" }, { "bytes": 290, "stream": 350, "flow_id": "flow-a37a56e08d98f17c9ed551b4", "packets": 3, "transport": "udp", "last_frame": 23890, "first_frame": 23846, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 55614, "responder_port": 53, "initiator_bytes": 156, "last_seen_epoch": "1583962652.656673", "responder_bytes": 134, "first_seen_epoch": "1583962652.619274" }, { "bytes": 9314, "stream": 496, "flow_id": "flow-d6c04b595fcf223be468cbd8", "packets": 27, "transport": "tcp", "last_frame": 27233, "first_frame": 23854, "initiator_ip": "10.3.11.119", "responder_ip": "13.107.6.158", "initiator_port": 49846, "responder_port": 443, "initiator_bytes": 1727, "last_seen_epoch": "1583962694.367972", "responder_bytes": 7587, "first_seen_epoch": "1583962652.621796" }, { "bytes": 5740, "stream": 497, "flow_id": "flow-117e3f31ccd65f45783943ce", "packets": 19, "transport": "tcp", "last_frame": 27265, "first_frame": 23891, "initiator_ip": "10.3.11.119", "responder_ip": "192.243.232.58", "initiator_port": 49847, "responder_port": 443, "initiator_bytes": 1890, "last_seen_epoch": "1583962694.419259", "responder_bytes": 3850, "first_seen_epoch": "1583962652.657453" }, { "bytes": 9140, "stream": 498, "flow_id": "flow-5d337d6b2ff88e9d85e489ce", "packets": 29, "transport": "tcp", "last_frame": 26463, "first_frame": 23895, "initiator_ip": "10.3.11.119", "responder_ip": "3.219.244.74", "initiator_port": 49848, "responder_port": 443, "initiator_bytes": 3784, "last_seen_epoch": "1583962660.964492", "responder_bytes": 5356, "first_seen_epoch": "1583962652.677261" }, { "bytes": 290, "stream": 351, "flow_id": "flow-157f9ed57363fa274c282d81", "packets": 3, "transport": "udp", "last_frame": 24065, "first_frame": 24051, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 64697, "responder_port": 53, "initiator_bytes": 164, "last_seen_epoch": "1583962652.905991", "responder_bytes": 126, "first_seen_epoch": "1583962652.857426" }, { "bytes": 311, "stream": 352, "flow_id": "flow-ebfff308727ce15dac5039d2", "packets": 3, "transport": "udp", "last_frame": 24064, "first_frame": 24058, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 54997, "responder_port": 53, "initiator_bytes": 170, "last_seen_epoch": "1583962652.905894", "responder_bytes": 141, "first_seen_epoch": "1583962652.858903" }, { "bytes": 25140, "stream": 499, "flow_id": "flow-977dac3d1e76ba06cff992c2", "packets": 43, "transport": "tcp", "last_frame": 27199, "first_frame": 24067, "initiator_ip": "10.3.11.119", "responder_ip": "172.217.14.162", "initiator_port": 49849, "responder_port": 443, "initiator_bytes": 2358, "last_seen_epoch": "1583962694.361545", "responder_bytes": 22782, "first_seen_epoch": "1583962652.906972" }, { "bytes": 8190, "stream": 500, "flow_id": "flow-96ba1870836d53584a26df33", "packets": 27, "transport": "tcp", "last_frame": 27203, "first_frame": 24102, "initiator_ip": "10.3.11.119", "responder_ip": "172.217.6.174", "initiator_port": 49850, "responder_port": 443, "initiator_bytes": 1688, "last_seen_epoch": "1583962694.361634", "responder_bytes": 6502, "first_seen_epoch": "1583962652.9086" }, { "bytes": 11578, "stream": 501, "flow_id": "flow-51c241367786e1dc1370081d", "packets": 33, "transport": "tcp", "last_frame": 27134, "first_frame": 24103, "initiator_ip": "10.3.11.119", "responder_ip": "34.211.22.199", "initiator_port": 49851, "responder_port": 443, "initiator_bytes": 4118, "last_seen_epoch": "1583962694.354203", "responder_bytes": 7460, "first_seen_epoch": "1583962652.915907" }, { "bytes": 238, "stream": 353, "flow_id": "flow-d0eac22b45731b642727042e", "packets": 3, "transport": "udp", "last_frame": 24231, "first_frame": 24218, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 61444, "responder_port": 53, "initiator_bytes": 148, "last_seen_epoch": "1583962653.141149", "responder_bytes": 90, "first_seen_epoch": "1583962653.09303" }, { "bytes": 296, "stream": 354, "flow_id": "flow-951fe50ef3503e0f5e449039", "packets": 3, "transport": "udp", "last_frame": 24232, "first_frame": 24221, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 56975, "responder_port": 53, "initiator_bytes": 160, "last_seen_epoch": "1583962653.141217", "responder_bytes": 136, "first_seen_epoch": "1583962653.095219" }, { "bytes": 312, "stream": 355, "flow_id": "flow-f539f51f280e537edeb447f8", "packets": 3, "transport": "udp", "last_frame": 24226, "first_frame": 24222, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 62209, "responder_port": 53, "initiator_bytes": 180, "last_seen_epoch": "1583962653.139608", "responder_bytes": 132, "first_seen_epoch": "1583962653.095819" }, { "bytes": 72187, "stream": 502, "flow_id": "flow-798e6d9acf656c7229a81f15", "packets": 74, "transport": "tcp", "last_frame": 27177, "first_frame": 24233, "initiator_ip": "10.3.11.119", "responder_ip": "216.58.194.98", "initiator_port": 49852, "responder_port": 443, "initiator_bytes": 1969, "last_seen_epoch": "1583962694.358102", "responder_bytes": 70218, "first_seen_epoch": "1583962653.149151" }, { "bytes": 13789, "stream": 503, "flow_id": "flow-da7c1d8ddca3c9d917f18b78", "packets": 29, "transport": "tcp", "last_frame": 27163, "first_frame": 24234, "initiator_ip": "10.3.11.119", "responder_ip": "172.217.9.4", "initiator_port": 49853, "responder_port": 443, "initiator_bytes": 1803, "last_seen_epoch": "1583962694.356481", "responder_bytes": 11986, "first_seen_epoch": "1583962653.15038" }, { "bytes": 8050, "stream": 504, "flow_id": "flow-8f3402d562612ea0dd23349c", "packets": 27, "transport": "tcp", "last_frame": 27165, "first_frame": 24235, "initiator_ip": "10.3.11.119", "responder_ip": "172.217.14.162", "initiator_port": 49854, "responder_port": 443, "initiator_bytes": 1695, "last_seen_epoch": "1583962694.356594", "responder_bytes": 6355, "first_seen_epoch": "1583962653.150924" }, { "bytes": 262, "stream": 356, "flow_id": "flow-b5d25b846bf4b39f3f298f9a", "packets": 3, "transport": "udp", "last_frame": 24523, "first_frame": 24434, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 61809, "responder_port": 53, "initiator_bytes": 150, "last_seen_epoch": "1583962654.493084", "responder_bytes": 112, "first_seen_epoch": "1583962654.458457" }, { "bytes": 5009, "stream": 505, "flow_id": "flow-e2bb376c274a397dd48dd29a", "packets": 17, "transport": "tcp", "last_frame": 27128, "first_frame": 24439, "initiator_ip": "10.3.11.119", "responder_ip": "34.211.22.199", "initiator_port": 49855, "responder_port": 443, "initiator_bytes": 1087, "last_seen_epoch": "1583962694.353717", "responder_bytes": 3922, "first_seen_epoch": "1583962654.464157" }, { "bytes": 2684, "stream": 506, "flow_id": "flow-956589f93cb8db20d063d9fe", "packets": 18, "transport": "tcp", "last_frame": 27135, "first_frame": 24440, "initiator_ip": "10.3.11.119", "responder_ip": "34.211.22.199", "initiator_port": 49856, "responder_port": 443, "initiator_bytes": 1778, "last_seen_epoch": "1583962694.354309", "responder_bytes": 906, "first_seen_epoch": "1583962654.464411" }, { "bytes": 5009, "stream": 507, "flow_id": "flow-bcd021d78bd4f92f626f5dee", "packets": 17, "transport": "tcp", "last_frame": 27126, "first_frame": 24441, "initiator_ip": "10.3.11.119", "responder_ip": "34.211.22.199", "initiator_port": 49857, "responder_port": 443, "initiator_bytes": 1087, "last_seen_epoch": "1583962694.353551", "responder_bytes": 3922, "first_seen_epoch": "1583962654.464719" }, { "bytes": 36919, "stream": 357, "flow_id": "flow-29d028e7088e08773ee56c69", "packets": 42, "transport": "udp", "last_frame": 27109, "first_frame": 24443, "initiator_ip": "10.3.11.119", "responder_ip": "216.58.194.98", "initiator_port": 61810, "responder_port": 443, "initiator_bytes": 4782, "last_seen_epoch": "1583962694.352041", "responder_bytes": 32137, "first_seen_epoch": "1583962654.469043" }, { "bytes": 186, "stream": 358, "flow_id": "flow-8af4c354646a92b8c6536c02", "packets": 2, "transport": "udp", "last_frame": 24531, "first_frame": 24519, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 60213, "responder_port": 53, "initiator_bytes": 85, "last_seen_epoch": "1583962654.503997", "responder_bytes": 101, "first_seen_epoch": "1583962654.479483" }, { "bytes": 12848, "stream": 508, "flow_id": "flow-1604dd72845bf97a27b38e7d", "packets": 32, "transport": "tcp", "last_frame": 27206, "first_frame": 24524, "initiator_ip": "10.3.11.119", "responder_ip": "172.217.6.142", "initiator_port": 49858, "responder_port": 443, "initiator_bytes": 1723, "last_seen_epoch": "1583962694.361964", "responder_bytes": 11125, "first_seen_epoch": "1583962654.493678" }, { "bytes": 9709, "stream": 509, "flow_id": "flow-c96c0de88a44c39a99823685", "packets": 28, "transport": "tcp", "last_frame": 27207, "first_frame": 24532, "initiator_ip": "10.3.11.119", "responder_ip": "172.217.14.161", "initiator_port": 49859, "responder_port": 443, "initiator_bytes": 1741, "last_seen_epoch": "1583962694.362023", "responder_bytes": 7968, "first_seen_epoch": "1583962654.504868" }, { "bytes": 228, "stream": 359, "flow_id": "flow-7be0dab4e0c822698f62efd4", "packets": 2, "transport": "udp", "last_frame": 24672, "first_frame": 24663, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 54273, "responder_port": 53, "initiator_bytes": 84, "last_seen_epoch": "1583962654.604448", "responder_bytes": 144, "first_seen_epoch": "1583962654.581676" }, { "bytes": 4720, "stream": 360, "flow_id": "flow-d0d0af22082181c733c93607", "packets": 9, "transport": "udp", "last_frame": 24780, "first_frame": 24677, "initiator_ip": "10.3.11.119", "responder_ip": "216.58.193.142", "initiator_port": 54274, "responder_port": 443, "initiator_bytes": 2274, "last_seen_epoch": "1583962654.701329", "responder_bytes": 2446, "first_seen_epoch": "1583962654.612217" }, { "bytes": 335, "stream": 361, "flow_id": "flow-50010c2825406d2c44c886e0", "packets": 3, "transport": "udp", "last_frame": 24784, "first_frame": 24769, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 65237, "responder_port": 53, "initiator_bytes": 166, "last_seen_epoch": "1583962654.705612", "responder_bytes": 169, "first_seen_epoch": "1583962654.673446" }, { "bytes": 64133, "stream": 362, "flow_id": "flow-c8867ceaaabd6e1e40cd634a", "packets": 73, "transport": "udp", "last_frame": 27108, "first_frame": 24770, "initiator_ip": "10.3.11.119", "responder_ip": "172.217.6.142", "initiator_port": 65238, "responder_port": 443, "initiator_bytes": 6554, "last_seen_epoch": "1583962694.351771", "responder_bytes": 57579, "first_seen_epoch": "1583962654.675881" }, { "bytes": 8131, "stream": 510, "flow_id": "flow-303c92c4012a0ebcdb226378", "packets": 31, "transport": "tcp", "last_frame": 27232, "first_frame": 24821, "initiator_ip": "10.3.11.119", "responder_ip": "173.194.223.154", "initiator_port": 49860, "responder_port": 443, "initiator_bytes": 2191, "last_seen_epoch": "1583962694.367959", "responder_bytes": 5940, "first_seen_epoch": "1583962654.708389" }, { "bytes": 120912, "stream": 363, "flow_id": "flow-5fb2bfde1d328494a9a1916e", "packets": 150, "transport": "udp", "last_frame": 27110, "first_frame": 24960, "initiator_ip": "10.3.11.119", "responder_ip": "172.217.9.4", "initiator_port": 65239, "responder_port": 443, "initiator_bytes": 10767, "last_seen_epoch": "1583962694.352265", "responder_bytes": 110145, "first_seen_epoch": "1583962654.830224" }, { "bytes": 241, "stream": 364, "flow_id": "flow-d5d8dc6feea7cfe5a3c10b04", "packets": 3, "transport": "udp", "last_frame": 25130, "first_frame": 25127, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 56203, "responder_port": 53, "initiator_bytes": 150, "last_seen_epoch": "1583962655.290011", "responder_bytes": 91, "first_seen_epoch": "1583962655.240794" }, { "bytes": 9783, "stream": 511, "flow_id": "flow-86f3b57a443e2d4395f53acf", "packets": 29, "transport": "tcp", "last_frame": 27208, "first_frame": 25135, "initiator_ip": "10.3.11.119", "responder_ip": "172.217.1.142", "initiator_port": 49861, "responder_port": 443, "initiator_bytes": 3236, "last_seen_epoch": "1583962694.36208", "responder_bytes": 6547, "first_seen_epoch": "1583962655.291586" }, { "bytes": 222, "stream": 365, "flow_id": "flow-3b4aa9b18c72f7c47318114b", "packets": 2, "transport": "udp", "last_frame": 25148, "first_frame": 25141, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 49244, "responder_port": 53, "initiator_bytes": 84, "last_seen_epoch": "1583962655.347719", "responder_bytes": 138, "first_seen_epoch": "1583962655.316585" }, { "bytes": 17986, "stream": 512, "flow_id": "flow-b3e31b16d3c07e71bd28af53", "packets": 37, "transport": "tcp", "last_frame": 27210, "first_frame": 25172, "initiator_ip": "10.3.11.119", "responder_ip": "172.217.2.226", "initiator_port": 49862, "responder_port": 443, "initiator_bytes": 1794, "last_seen_epoch": "1583962694.362557", "responder_bytes": 16192, "first_seen_epoch": "1583962655.349363" }, { "bytes": 262, "stream": 366, "flow_id": "flow-8d933df4b728b3c8819e87b8", "packets": 3, "transport": "udp", "last_frame": 25242, "first_frame": 25216, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 60709, "responder_port": 53, "initiator_bytes": 164, "last_seen_epoch": "1583962655.49652", "responder_bytes": 98, "first_seen_epoch": "1583962655.4337" }, { "bytes": 156500, "stream": 513, "flow_id": "flow-af6cebd4c0d5b6123ea42f19", "packets": 142, "transport": "tcp", "last_frame": 27226, "first_frame": 25217, "initiator_ip": "10.3.11.119", "responder_ip": "31.13.65.7", "initiator_port": 49863, "responder_port": 443, "initiator_bytes": 2431, "last_seen_epoch": "1583962694.366395", "responder_bytes": 154069, "first_seen_epoch": "1583962655.434281" }, { "bytes": 271, "stream": 367, "flow_id": "flow-3b3e488f2d1a9d7a3e50eb37", "packets": 3, "transport": "udp", "last_frame": 25243, "first_frame": 25218, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 64699, "responder_port": 53, "initiator_bytes": 170, "last_seen_epoch": "1583962655.496736", "responder_bytes": 101, "first_seen_epoch": "1583962655.435019" }, { "bytes": 312, "stream": 368, "flow_id": "flow-a25a2ea2b49c72d07485fe73", "packets": 3, "transport": "udp", "last_frame": 25254, "first_frame": 25221, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 60660, "responder_port": 53, "initiator_bytes": 168, "last_seen_epoch": "1583962655.506747", "responder_bytes": 144, "first_seen_epoch": "1583962655.435607" }, { "bytes": 253, "stream": 369, "flow_id": "flow-0ff04fa74e3e77d81c9f2257", "packets": 3, "transport": "udp", "last_frame": 25241, "first_frame": 25222, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 50114, "responder_port": 53, "initiator_bytes": 158, "last_seen_epoch": "1583962655.49645", "responder_bytes": 95, "first_seen_epoch": "1583962655.435701" }, { "bytes": 235, "stream": 370, "flow_id": "flow-bd9b24a52069c1e92bf34a05", "packets": 3, "transport": "udp", "last_frame": 25244, "first_frame": 25223, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 55143, "responder_port": 53, "initiator_bytes": 146, "last_seen_epoch": "1583962655.49679", "responder_bytes": 89, "first_seen_epoch": "1583962655.435951" }, { "bytes": 25534, "stream": 514, "flow_id": "flow-7d9bca75e3e53806cf9d090e", "packets": 36, "transport": "tcp", "last_frame": 27254, "first_frame": 25245, "initiator_ip": "10.3.11.119", "responder_ip": "63.148.46.76", "initiator_port": 49864, "responder_port": 443, "initiator_bytes": 1749, "last_seen_epoch": "1583962694.397912", "responder_bytes": 23785, "first_seen_epoch": "1583962655.497573" }, { "bytes": 33596, "stream": 515, "flow_id": "flow-5e3c657737186e469e751ba1", "packets": 48, "transport": "tcp", "last_frame": 27178, "first_frame": 25246, "initiator_ip": "10.3.11.119", "responder_ip": "172.217.12.84", "initiator_port": 49865, "responder_port": 443, "initiator_bytes": 1902, "last_seen_epoch": "1583962694.358174", "responder_bytes": 31694, "first_seen_epoch": "1583962655.497765" }, { "bytes": 32247, "stream": 516, "flow_id": "flow-68d66bb7bda5062b4bb2e697", "packets": 49, "transport": "tcp", "last_frame": 27176, "first_frame": 25249, "initiator_ip": "10.3.11.119", "responder_ip": "34.102.147.248", "initiator_port": 49866, "responder_port": 443, "initiator_bytes": 2055, "last_seen_epoch": "1583962694.357987", "responder_bytes": 30192, "first_seen_epoch": "1583962655.498632" }, { "bytes": 11595, "stream": 517, "flow_id": "flow-a00bffe09e9c9627cd503185", "packets": 21, "transport": "tcp", "last_frame": 25481, "first_frame": 25250, "initiator_ip": "10.3.11.119", "responder_ip": "169.60.153.61", "initiator_port": 49867, "responder_port": 443, "initiator_bytes": 1602, "last_seen_epoch": "1583962655.804663", "responder_bytes": 9993, "first_seen_epoch": "1583962655.498797" }, { "bytes": 37137, "stream": 518, "flow_id": "flow-d3868b22e6b9cbb387c791c5", "packets": 50, "transport": "tcp", "last_frame": 27218, "first_frame": 25257, "initiator_ip": "10.3.11.119", "responder_ip": "216.58.194.104", "initiator_port": 49868, "responder_port": 443, "initiator_bytes": 1856, "last_seen_epoch": "1583962694.362841", "responder_bytes": 35281, "first_seen_epoch": "1583962655.508725" }, { "bytes": 331, "stream": 371, "flow_id": "flow-d5addec5ad2677b998edd708", "packets": 3, "transport": "udp", "last_frame": 25284, "first_frame": 25262, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 52438, "responder_port": 53, "initiator_bytes": 162, "last_seen_epoch": "1583962655.597976", "responder_bytes": 169, "first_seen_epoch": "1583962655.53112" }, { "bytes": 302, "stream": 372, "flow_id": "flow-99075956af6f39451b83be57", "packets": 3, "transport": "udp", "last_frame": 25283, "first_frame": 25263, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 58921, "responder_port": 53, "initiator_bytes": 174, "last_seen_epoch": "1583962655.597916", "responder_bytes": 128, "first_seen_epoch": "1583962655.532578" }, { "bytes": 11891, "stream": 373, "flow_id": "flow-3a3fd083dbabafe14439cef5", "packets": 20, "transport": "udp", "last_frame": 25608, "first_frame": 25391, "initiator_ip": "10.3.11.119", "responder_ip": "172.217.14.162", "initiator_port": 58922, "responder_port": 443, "initiator_bytes": 4682, "last_seen_epoch": "1583962656.007008", "responder_bytes": 7209, "first_seen_epoch": "1583962655.750773" }, { "bytes": 180, "stream": 374, "flow_id": "flow-08f3892bfb8a5fc993a1beca", "packets": 2, "transport": "udp", "last_frame": 25499, "first_frame": 25497, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 63814, "responder_port": 53, "initiator_bytes": 82, "last_seen_epoch": "1583962655.863798", "responder_bytes": 98, "first_seen_epoch": "1583962655.83821" }, { "bytes": 6678, "stream": 519, "flow_id": "flow-ec104b09d09037879e1812c7", "packets": 25, "transport": "tcp", "last_frame": 27191, "first_frame": 25500, "initiator_ip": "10.3.11.119", "responder_ip": "216.58.194.112", "initiator_port": 49869, "responder_port": 443, "initiator_bytes": 1632, "last_seen_epoch": "1583962694.360141", "responder_bytes": 5046, "first_seen_epoch": "1583962655.864646" }, { "bytes": 259, "stream": 375, "flow_id": "flow-37af93acd13750905c7496cc", "packets": 3, "transport": "udp", "last_frame": 25539, "first_frame": 25507, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 64754, "responder_port": 53, "initiator_bytes": 162, "last_seen_epoch": "1583962655.936347", "responder_bytes": 97, "first_seen_epoch": "1583962655.894777" }, { "bytes": 292, "stream": 376, "flow_id": "flow-5105b668b67f54c6abf0ef2a", "packets": 3, "transport": "udp", "last_frame": 25538, "first_frame": 25508, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 62712, "responder_port": 53, "initiator_bytes": 166, "last_seen_epoch": "1583962655.936276", "responder_bytes": 126, "first_seen_epoch": "1583962655.895642" }, { "bytes": 265, "stream": 377, "flow_id": "flow-fa3c7ba7e76b77e59c3ebab4", "packets": 3, "transport": "udp", "last_frame": 25648, "first_frame": 25509, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 58194, "responder_port": 53, "initiator_bytes": 166, "last_seen_epoch": "1583962656.14033", "responder_bytes": 99, "first_seen_epoch": "1583962655.895821" }, { "bytes": 247, "stream": 378, "flow_id": "flow-7ade0702e6a0766a7bb995f2", "packets": 3, "transport": "udp", "last_frame": 25540, "first_frame": 25510, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 50983, "responder_port": 53, "initiator_bytes": 154, "last_seen_epoch": "1583962655.936451", "responder_bytes": 93, "first_seen_epoch": "1583962655.895972" }, { "bytes": 262, "stream": 379, "flow_id": "flow-802d0e862588967ad9d0d696", "packets": 3, "transport": "udp", "last_frame": 25542, "first_frame": 25511, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 56354, "responder_port": 53, "initiator_bytes": 164, "last_seen_epoch": "1583962655.936624", "responder_bytes": 98, "first_seen_epoch": "1583962655.896684" }, { "bytes": 244, "stream": 380, "flow_id": "flow-52ab6f8b10c3405f2be1cf71", "packets": 3, "transport": "udp", "last_frame": 25541, "first_frame": 25512, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 53792, "responder_port": 53, "initiator_bytes": 152, "last_seen_epoch": "1583962655.936519", "responder_bytes": 92, "first_seen_epoch": "1583962655.896748" }, { "bytes": 6910, "stream": 520, "flow_id": "flow-1a75a107f500f9d509158ec8", "packets": 27, "transport": "tcp", "last_frame": 27179, "first_frame": 25543, "initiator_ip": "10.3.11.119", "responder_ip": "35.241.23.116", "initiator_port": 49870, "responder_port": 443, "initiator_bytes": 1917, "last_seen_epoch": "1583962694.358256", "responder_bytes": 4993, "first_seen_epoch": "1583962655.937741" }, { "bytes": 176, "stream": 381, "flow_id": "flow-789d517242637cd2cf8305e5", "packets": 2, "transport": "udp", "last_frame": 25557, "first_frame": 25544, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 63763, "responder_port": 53, "initiator_bytes": 80, "last_seen_epoch": "1583962655.958527", "responder_bytes": 96, "first_seen_epoch": "1583962655.937905" }, { "bytes": 49058, "stream": 521, "flow_id": "flow-5a20ef5dbc4bfe599581f859", "packets": 81, "transport": "tcp", "last_frame": 27180, "first_frame": 25545, "initiator_ip": "10.3.11.119", "responder_ip": "34.98.67.3", "initiator_port": 49871, "responder_port": 443, "initiator_bytes": 3633, "last_seen_epoch": "1583962694.358327", "responder_bytes": 45425, "first_seen_epoch": "1583962655.937995" }, { "bytes": 7563, "stream": 522, "flow_id": "flow-4b282ccf9179021d7d1ab04c", "packets": 29, "transport": "tcp", "last_frame": 27193, "first_frame": 25546, "initiator_ip": "10.3.11.119", "responder_ip": "35.241.23.116", "initiator_port": 49872, "responder_port": 443, "initiator_bytes": 2272, "last_seen_epoch": "1583962694.360313", "responder_bytes": 5291, "first_seen_epoch": "1583962655.938478" }, { "bytes": 7040, "stream": 523, "flow_id": "flow-46406708bcbfa72b9a3638c5", "packets": 27, "transport": "tcp", "last_frame": 27194, "first_frame": 25547, "initiator_ip": "10.3.11.119", "responder_ip": "35.241.23.116", "initiator_port": 49873, "responder_port": 443, "initiator_bytes": 1917, "last_seen_epoch": "1583962694.360386", "responder_bytes": 5123, "first_seen_epoch": "1583962655.938896" }, { "bytes": 6836, "stream": 524, "flow_id": "flow-df3a211e5b43e6524f462d3d", "packets": 25, "transport": "tcp", "last_frame": 27204, "first_frame": 25548, "initiator_ip": "10.3.11.119", "responder_ip": "35.241.23.116", "initiator_port": 49874, "responder_port": 443, "initiator_bytes": 1866, "last_seen_epoch": "1583962694.361783", "responder_bytes": 4970, "first_seen_epoch": "1583962655.939398" }, { "bytes": 7851, "stream": 525, "flow_id": "flow-5a543ed787488a01c898e416", "packets": 32, "transport": "tcp", "last_frame": 27205, "first_frame": 25563, "initiator_ip": "10.3.11.119", "responder_ip": "35.241.23.116", "initiator_port": 49875, "responder_port": 443, "initiator_bytes": 2335, "last_seen_epoch": "1583962694.361852", "responder_bytes": 5516, "first_seen_epoch": "1583962655.96032" }, { "bytes": 7097, "stream": 526, "flow_id": "flow-e2106810d223ff0754a135f7", "packets": 24, "transport": "tcp", "last_frame": 26641, "first_frame": 25568, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 49821, "responder_port": 445, "initiator_bytes": 5009, "last_seen_epoch": "1583962666.794142", "responder_bytes": 2088, "first_seen_epoch": "1583962655.985471" }, { "bytes": 6952, "stream": 527, "flow_id": "flow-09e1f93180b1febb96ee9032", "packets": 27, "transport": "tcp", "last_frame": 27192, "first_frame": 25692, "initiator_ip": "10.3.11.119", "responder_ip": "35.241.23.116", "initiator_port": 49876, "responder_port": 443, "initiator_bytes": 1922, "last_seen_epoch": "1583962694.360232", "responder_bytes": 5030, "first_seen_epoch": "1583962656.141432" }, { "bytes": 5061, "stream": 528, "flow_id": "flow-d6a526f319cabc6236249b16", "packets": 15, "transport": "tcp", "last_frame": 25800, "first_frame": 25724, "initiator_ip": "10.3.11.119", "responder_ip": "35.241.23.116", "initiator_port": 49877, "responder_port": 443, "initiator_bytes": 1000, "last_seen_epoch": "1583962656.337539", "responder_bytes": 4061, "first_seen_epoch": "1583962656.147335" }, { "bytes": 7074, "stream": 529, "flow_id": "flow-af4abbd1ec4cb3494a207115", "packets": 22, "transport": "tcp", "last_frame": 27255, "first_frame": 25743, "initiator_ip": "10.3.11.119", "responder_ip": "63.148.46.76", "initiator_port": 49878, "responder_port": 443, "initiator_bytes": 1676, "last_seen_epoch": "1583962694.397992", "responder_bytes": 5398, "first_seen_epoch": "1583962656.160457" }, { "bytes": 8927, "stream": 530, "flow_id": "flow-e64e1d8c46d473eb474a913d", "packets": 35, "transport": "tcp", "last_frame": 27234, "first_frame": 25888, "initiator_ip": "10.3.11.119", "responder_ip": "31.13.65.36", "initiator_port": 49879, "responder_port": 443, "initiator_bytes": 3513, "last_seen_epoch": "1583962694.369899", "responder_bytes": 5414, "first_seen_epoch": "1583962656.669662" }, { "bytes": 335, "stream": 382, "flow_id": "flow-a1b0add384603651b51d45f3", "packets": 3, "transport": "udp", "last_frame": 25928, "first_frame": 25903, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 54599, "responder_port": 53, "initiator_bytes": 158, "last_seen_epoch": "1583962656.834296", "responder_bytes": 177, "first_seen_epoch": "1583962656.768455" }, { "bytes": 168, "stream": 383, "flow_id": "flow-fcd7d62295c62eb7960315c8", "packets": 2, "transport": "udp", "last_frame": 25912, "first_frame": 25904, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 61961, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1583962656.790277", "responder_bytes": 92, "first_seen_epoch": "1583962656.769038" }, { "bytes": 10174, "stream": 531, "flow_id": "flow-46971b683dbfa00b1c2a9d57", "packets": 38, "transport": "tcp", "last_frame": 27156, "first_frame": 25913, "initiator_ip": "10.3.11.119", "responder_ip": "35.190.72.21", "initiator_port": 49880, "responder_port": 443, "initiator_bytes": 2499, "last_seen_epoch": "1583962694.355957", "responder_bytes": 7675, "first_seen_epoch": "1583962656.791323" }, { "bytes": 170, "stream": 384, "flow_id": "flow-b3fdaeab3638a56f5722f3ee", "packets": 2, "transport": "udp", "last_frame": 25919, "first_frame": 25914, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 50804, "responder_port": 53, "initiator_bytes": 77, "last_seen_epoch": "1583962656.815109", "responder_bytes": 93, "first_seen_epoch": "1583962656.791774" }, { "bytes": 10721, "stream": 532, "flow_id": "flow-11404d29f0643a494d6fafae", "packets": 30, "transport": "tcp", "last_frame": 27186, "first_frame": 25931, "initiator_ip": "10.3.11.119", "responder_ip": "139.178.81.9", "initiator_port": 49881, "responder_port": 443, "initiator_bytes": 2096, "last_seen_epoch": "1583962694.358895", "responder_bytes": 8625, "first_seen_epoch": "1583962656.834918" }, { "bytes": 337, "stream": 385, "flow_id": "flow-94f5dbb09380815b21b7bb1d", "packets": 2, "transport": "udp", "last_frame": 26007, "first_frame": 25995, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 56974, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1583962656.958475", "responder_bytes": 261, "first_seen_epoch": "1583962656.929467" }, { "bytes": 343, "stream": 386, "flow_id": "flow-db07afc4872d13ace7870ee3", "packets": 2, "transport": "udp", "last_frame": 26010, "first_frame": 25998, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 56845, "responder_port": 53, "initiator_bytes": 78, "last_seen_epoch": "1583962656.960973", "responder_bytes": 265, "first_seen_epoch": "1583962656.931409" }, { "bytes": 8420, "stream": 533, "flow_id": "flow-3ae512e57ef216cf907ec03d", "packets": 28, "transport": "tcp", "last_frame": 27158, "first_frame": 26008, "initiator_ip": "10.3.11.119", "responder_ip": "130.211.21.54", "initiator_port": 49882, "responder_port": 443, "initiator_bytes": 1917, "last_seen_epoch": "1583962694.356064", "responder_bytes": 6503, "first_seen_epoch": "1583962656.958958" }, { "bytes": 10435, "stream": 534, "flow_id": "flow-8aace39950f8fde33f33228a", "packets": 35, "transport": "tcp", "last_frame": 27247, "first_frame": 26009, "initiator_ip": "10.3.11.119", "responder_ip": "3.225.102.19", "initiator_port": 49883, "responder_port": 443, "initiator_bytes": 2504, "last_seen_epoch": "1583962694.391322", "responder_bytes": 7931, "first_seen_epoch": "1583962656.959164" }, { "bytes": 6899, "stream": 535, "flow_id": "flow-f924aa3dd3ed7918e010d36d", "packets": 24, "transport": "tcp", "last_frame": 27239, "first_frame": 26011, "initiator_ip": "10.3.11.119", "responder_ip": "18.213.117.209", "initiator_port": 49884, "responder_port": 443, "initiator_bytes": 1777, "last_seen_epoch": "1583962694.38795", "responder_bytes": 5122, "first_seen_epoch": "1583962656.961539" }, { "bytes": 291, "stream": 387, "flow_id": "flow-f6216a881cf07f5cce78e200", "packets": 3, "transport": "udp", "last_frame": 26089, "first_frame": 26056, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 51185, "responder_port": 53, "initiator_bytes": 158, "last_seen_epoch": "1583962657.131237", "responder_bytes": 133, "first_seen_epoch": "1583962657.099368" }, { "bytes": 238, "stream": 388, "flow_id": "flow-65a24f92010589773ac07847", "packets": 3, "transport": "udp", "last_frame": 26097, "first_frame": 26057, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 55664, "responder_port": 53, "initiator_bytes": 148, "last_seen_epoch": "1583962657.136998", "responder_bytes": 90, "first_seen_epoch": "1583962657.102978" }, { "bytes": 459, "stream": 389, "flow_id": "flow-6d51278db11d21752e42ee15", "packets": 3, "transport": "udp", "last_frame": 26098, "first_frame": 26058, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 53590, "responder_port": 53, "initiator_bytes": 162, "last_seen_epoch": "1583962657.13708", "responder_bytes": 297, "first_seen_epoch": "1583962657.103947" }, { "bytes": 249, "stream": 390, "flow_id": "flow-cbb2be07215827a2331935a0", "packets": 2, "transport": "udp", "last_frame": 26082, "first_frame": 26059, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 56269, "responder_port": 53, "initiator_bytes": 84, "last_seen_epoch": "1583962657.12586", "responder_bytes": 165, "first_seen_epoch": "1583962657.104542" }, { "bytes": 329, "stream": 391, "flow_id": "flow-d89e175de61d8f240c891bdd", "packets": 2, "transport": "udp", "last_frame": 26083, "first_frame": 26060, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 50978, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1583962657.125928", "responder_bytes": 253, "first_seen_epoch": "1583962657.105078" }, { "bytes": 199, "stream": 392, "flow_id": "flow-0f630f6729183503643db671", "packets": 2, "transport": "udp", "last_frame": 26090, "first_frame": 26061, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 54600, "responder_port": 53, "initiator_bytes": 80, "last_seen_epoch": "1583962657.131301", "responder_bytes": 119, "first_seen_epoch": "1583962657.105888" }, { "bytes": 6448, "stream": 536, "flow_id": "flow-5a1eda665498bddf675360f2", "packets": 20, "transport": "tcp", "last_frame": 27148, "first_frame": 26084, "initiator_ip": "10.3.11.119", "responder_ip": "8.43.72.97", "initiator_port": 49885, "responder_port": 443, "initiator_bytes": 1973, "last_seen_epoch": "1583962694.355144", "responder_bytes": 4475, "first_seen_epoch": "1583962657.126544" }, { "bytes": 351, "stream": 393, "flow_id": "flow-34c108e42b26f9f9ff883f7f", "packets": 3, "transport": "udp", "last_frame": 26147, "first_frame": 26085, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 51848, "responder_port": 53, "initiator_bytes": 168, "last_seen_epoch": "1583962657.208179", "responder_bytes": 183, "first_seen_epoch": "1583962657.127019" }, { "bytes": 13412, "stream": 537, "flow_id": "flow-19bcc154d2bc682469474e68", "packets": 32, "transport": "tcp", "last_frame": 27166, "first_frame": 26086, "initiator_ip": "10.3.11.119", "responder_ip": "104.254.148.166", "initiator_port": 49886, "responder_port": 443, "initiator_bytes": 4745, "last_seen_epoch": "1583962694.356653", "responder_bytes": 8667, "first_seen_epoch": "1583962657.127662" }, { "bytes": 349, "stream": 394, "flow_id": "flow-dce64f5c4a2b9472aaf7ddc7", "packets": 3, "transport": "udp", "last_frame": 26180, "first_frame": 26087, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 63298, "responder_port": 53, "initiator_bytes": 174, "last_seen_epoch": "1583962657.266607", "responder_bytes": 175, "first_seen_epoch": "1583962657.128132" }, { "bytes": 6805, "stream": 538, "flow_id": "flow-0a1de65c8363e471b489f16c", "packets": 24, "transport": "tcp", "last_frame": 27220, "first_frame": 26091, "initiator_ip": "10.3.11.119", "responder_ip": "89.187.164.37", "initiator_port": 49887, "responder_port": 443, "initiator_bytes": 1786, "last_seen_epoch": "1583962694.364885", "responder_bytes": 5019, "first_seen_epoch": "1583962657.13217" }, { "bytes": 401, "stream": 395, "flow_id": "flow-611701f88c995e31e1495cbd", "packets": 3, "transport": "udp", "last_frame": 26128, "first_frame": 26092, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 57992, "responder_port": 53, "initiator_bytes": 156, "last_seen_epoch": "1583962657.176778", "responder_bytes": 245, "first_seen_epoch": "1583962657.132574" }, { "bytes": 7431, "stream": 539, "flow_id": "flow-35623fd9b96bca4cfadc2a3f", "packets": 26, "transport": "tcp", "last_frame": 27216, "first_frame": 26093, "initiator_ip": "10.3.11.119", "responder_ip": "172.217.2.226", "initiator_port": 49888, "responder_port": 443, "initiator_bytes": 1904, "last_seen_epoch": "1583962694.362743", "responder_bytes": 5527, "first_seen_epoch": "1583962657.133148" }, { "bytes": 7020, "stream": 540, "flow_id": "flow-257602bb8a5fa733cb4ab250", "packets": 31, "transport": "tcp", "last_frame": 27217, "first_frame": 26099, "initiator_ip": "10.3.11.119", "responder_ip": "35.244.140.139", "initiator_port": 49889, "responder_port": 443, "initiator_bytes": 2175, "last_seen_epoch": "1583962694.362795", "responder_bytes": 4845, "first_seen_epoch": "1583962657.137742" }, { "bytes": 8509, "stream": 541, "flow_id": "flow-5a6f9fa1548cbdd23ddbfcbc", "packets": 28, "transport": "tcp", "last_frame": 27241, "first_frame": 26100, "initiator_ip": "10.3.11.119", "responder_ip": "3.215.9.190", "initiator_port": 49890, "responder_port": 443, "initiator_bytes": 1999, "last_seen_epoch": "1583962694.39105", "responder_bytes": 6510, "first_seen_epoch": "1583962657.137965" }, { "bytes": 9486, "stream": 542, "flow_id": "flow-c8611c9aa3cd64a3609c645d", "packets": 28, "transport": "tcp", "last_frame": 27249, "first_frame": 26143, "initiator_ip": "10.3.11.119", "responder_ip": "34.231.157.146", "initiator_port": 49891, "responder_port": 443, "initiator_bytes": 2047, "last_seen_epoch": "1583962694.391973", "responder_bytes": 7439, "first_seen_epoch": "1583962657.186673" }, { "bytes": 11094, "stream": 543, "flow_id": "flow-447cf0aa269eaa4ac41079d7", "packets": 26, "transport": "tcp", "last_frame": 27228, "first_frame": 26152, "initiator_ip": "10.3.11.119", "responder_ip": "23.199.253.53", "initiator_port": 49892, "responder_port": 443, "initiator_bytes": 2601, "last_seen_epoch": "1583962694.366533", "responder_bytes": 8493, "first_seen_epoch": "1583962657.209155" }, { "bytes": 6568, "stream": 544, "flow_id": "flow-cbc849d69e45cf9e7475dd07", "packets": 22, "transport": "tcp", "last_frame": 27246, "first_frame": 26199, "initiator_ip": "10.3.11.119", "responder_ip": "199.187.193.166", "initiator_port": 49893, "responder_port": 443, "initiator_bytes": 1819, "last_seen_epoch": "1583962694.391259", "responder_bytes": 4749, "first_seen_epoch": "1583962657.280223" }, { "bytes": 247, "stream": 396, "flow_id": "flow-e5e5ef12826639e1e95e5eb7", "packets": 3, "transport": "udp", "last_frame": 26217, "first_frame": 26212, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 50547, "responder_port": 53, "initiator_bytes": 154, "last_seen_epoch": "1583962657.348534", "responder_bytes": 93, "first_seen_epoch": "1583962657.289583" }, { "bytes": 8239, "stream": 545, "flow_id": "flow-d4c10ac1c08bd4246cbe768c", "packets": 32, "transport": "tcp", "last_frame": 27215, "first_frame": 26218, "initiator_ip": "10.3.11.119", "responder_ip": "130.211.28.134", "initiator_port": 49894, "responder_port": 443, "initiator_bytes": 2400, "last_seen_epoch": "1583962694.362688", "responder_bytes": 5839, "first_seen_epoch": "1583962657.349198" }, { "bytes": 225, "stream": 397, "flow_id": "flow-e035b0acff3d4015c39ce2f5", "packets": 2, "transport": "udp", "last_frame": 26254, "first_frame": 26221, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 54613, "responder_port": 53, "initiator_bytes": 79, "last_seen_epoch": "1583962657.367426", "responder_bytes": 146, "first_seen_epoch": "1583962657.352782" }, { "bytes": 5074, "stream": 546, "flow_id": "flow-dc6e8ee6672f6740bfaf0132", "packets": 19, "transport": "tcp", "last_frame": 27245, "first_frame": 26242, "initiator_ip": "10.3.11.119", "responder_ip": "199.187.193.166", "initiator_port": 49895, "responder_port": 443, "initiator_bytes": 1141, "last_seen_epoch": "1583962694.391194", "responder_bytes": 3933, "first_seen_epoch": "1583962657.358415" }, { "bytes": 7319, "stream": 547, "flow_id": "flow-d85875754bf46b117072d1a9", "packets": 20, "transport": "tcp", "last_frame": 27257, "first_frame": 26262, "initiator_ip": "10.3.11.119", "responder_ip": "104.36.113.17", "initiator_port": 49896, "responder_port": 443, "initiator_bytes": 1825, "last_seen_epoch": "1583962694.408573", "responder_bytes": 5494, "first_seen_epoch": "1583962657.369788" }, { "bytes": 387, "stream": 398, "flow_id": "flow-0fb17de1b50ed903554a3e28", "packets": 3, "transport": "udp", "last_frame": 26392, "first_frame": 26390, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 64649, "responder_port": 53, "initiator_bytes": 166, "last_seen_epoch": "1583962657.788154", "responder_bytes": 221, "first_seen_epoch": "1583962657.753969" }, { "bytes": 9443, "stream": 548, "flow_id": "flow-559a206f7a5d19aa014b226c", "packets": 26, "transport": "tcp", "last_frame": 26482, "first_frame": 26393, "initiator_ip": "10.3.11.119", "responder_ip": "52.45.33.138", "initiator_port": 49897, "responder_port": 443, "initiator_bytes": 2760, "last_seen_epoch": "1583962661.16739", "responder_bytes": 6683, "first_seen_epoch": "1583962657.789109" }, { "bytes": 199, "stream": 399, "flow_id": "flow-d4f752314e3d8f539963c775", "packets": 2, "transport": "udp", "last_frame": 26433, "first_frame": 26432, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 62904, "responder_port": 53, "initiator_bytes": 82, "last_seen_epoch": "1583962658.985207", "responder_bytes": 117, "first_seen_epoch": "1583962658.957656" }, { "bytes": 10255, "stream": 549, "flow_id": "flow-d6c6feeb0af0614c50b05fea", "packets": 20, "transport": "tcp", "last_frame": 26453, "first_frame": 26434, "initiator_ip": "10.3.11.119", "responder_ip": "169.46.74.216", "initiator_port": 49898, "responder_port": 443, "initiator_bytes": 2372, "last_seen_epoch": "1583962659.151825", "responder_bytes": 7883, "first_seen_epoch": "1583962658.985967" }, { "bytes": 426, "stream": 400, "flow_id": "flow-9f7228b55b15724833eaa2ea", "packets": 5, "transport": "udp", "last_frame": 26616, "first_frame": 26454, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 49360, "responder_port": 53, "initiator_bytes": 328, "last_seen_epoch": "1583962663.610644", "responder_bytes": 98, "first_seen_epoch": "1583962659.156343" }, { "bytes": 4703, "stream": 550, "flow_id": "flow-92315546983a8d5957f5050f", "packets": 15, "transport": "tcp", "last_frame": 26512, "first_frame": 26481, "initiator_ip": "10.3.11.119", "responder_ip": "169.46.74.216", "initiator_port": 49899, "responder_port": 443, "initiator_bytes": 2316, "last_seen_epoch": "1583962661.404898", "responder_bytes": 2387, "first_seen_epoch": "1583962661.16732" }, { "bytes": 362, "stream": 401, "flow_id": "flow-c02f96eea3196f703c2a7544", "packets": 3, "transport": "udp", "last_frame": 26535, "first_frame": 26527, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 63410, "responder_port": 53, "initiator_bytes": 156, "last_seen_epoch": "1583962661.464277", "responder_bytes": 206, "first_seen_epoch": "1583962661.413763" }, { "bytes": 9846, "stream": 551, "flow_id": "flow-edaed9b7b2e718753aab1536", "packets": 28, "transport": "tcp", "last_frame": 27144, "first_frame": 26536, "initiator_ip": "10.3.11.119", "responder_ip": "34.234.197.182", "initiator_port": 49900, "responder_port": 443, "initiator_bytes": 2461, "last_seen_epoch": "1583962694.354803", "responder_bytes": 7385, "first_seen_epoch": "1583962661.465247" }, { "bytes": 2650, "stream": 552, "flow_id": "flow-a321a55363fd05da3be685e1", "packets": 14, "transport": "tcp", "last_frame": 26569, "first_frame": 26539, "initiator_ip": "10.3.11.119", "responder_ip": "169.46.74.216", "initiator_port": 49901, "responder_port": 443, "initiator_bytes": 1702, "last_seen_epoch": "1583962661.672971", "responder_bytes": 948, "first_seen_epoch": "1583962661.470334" }, { "bytes": 407, "stream": 402, "flow_id": "flow-06b1dfaac9774b2cd1df2935", "packets": 3, "transport": "udp", "last_frame": 26577, "first_frame": 26574, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 58304, "responder_port": 53, "initiator_bytes": 208, "last_seen_epoch": "1583962661.873966", "responder_bytes": 199, "first_seen_epoch": "1583962661.807697" }, { "bytes": 8833, "stream": 553, "flow_id": "flow-a802542eee17a9bed6e75550", "packets": 25, "transport": "tcp", "last_frame": 27261, "first_frame": 26578, "initiator_ip": "10.3.11.119", "responder_ip": "54.244.36.123", "initiator_port": 49902, "responder_port": 443, "initiator_bytes": 1801, "last_seen_epoch": "1583962694.413599", "responder_bytes": 7032, "first_seen_epoch": "1583962661.874568" }, { "bytes": 8628, "stream": 554, "flow_id": "flow-34f2b6f5bd9ae9ebafce2f1d", "packets": 19, "transport": "tcp", "last_frame": 26635, "first_frame": 26617, "initiator_ip": "10.3.11.119", "responder_ip": "169.60.140.161", "initiator_port": 49903, "responder_port": 443, "initiator_bytes": 1567, "last_seen_epoch": "1583962663.791465", "responder_bytes": 7061, "first_seen_epoch": "1583962663.611536" }, { "bytes": 1332, "stream": 555, "flow_id": "flow-b1ecd454d946299ef21ff073", "packets": 11, "transport": "tcp", "last_frame": 26678, "first_frame": 26668, "initiator_ip": "10.3.11.194", "responder_ip": "203.176.135.102", "initiator_port": 50099, "responder_port": 8082, "initiator_bytes": 919, "last_seen_epoch": "1583962673.815398", "responder_bytes": 413, "first_seen_epoch": "1583962672.361621" }, { "bytes": 860, "stream": 403, "flow_id": "flow-112c66085df5442909e0c416", "packets": 4, "transport": "udp", "last_frame": 26721, "first_frame": 26691, "initiator_ip": "10.3.11.119", "responder_ip": "239.255.255.250", "initiator_port": 58306, "responder_port": 1900, "initiator_bytes": 860, "last_seen_epoch": "1583962681.89825", "responder_bytes": 0, "first_seen_epoch": "1583962678.87654" }, { "bytes": 7097, "stream": 556, "flow_id": "flow-a0ebba39a6bdf16dce6d9338", "packets": 24, "transport": "tcp", "last_frame": 27023, "first_frame": 26702, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 50100, "responder_port": 445, "initiator_bytes": 5009, "last_seen_epoch": "1583962692.336422", "responder_bytes": 2088, "first_seen_epoch": "1583962681.593994" }, { "bytes": 272, "stream": 404, "flow_id": "flow-e980e5c0572333692192f14d", "packets": 2, "transport": "udp", "last_frame": 26723, "first_frame": 26722, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 56144, "responder_port": 53, "initiator_bytes": 74, "last_seen_epoch": "1583962683.965713", "responder_bytes": 198, "first_seen_epoch": "1583962683.947152" }, { "bytes": 25468, "stream": 557, "flow_id": "flow-a65b55ef6b4797b5e1b455c4", "packets": 45, "transport": "tcp", "last_frame": 27417, "first_frame": 26724, "initiator_ip": "10.3.11.194", "responder_ip": "40.90.22.187", "initiator_port": 50101, "responder_port": 443, "initiator_bytes": 6385, "last_seen_epoch": "1583962794.153337", "responder_bytes": 19083, "first_seen_epoch": "1583962683.969559" }, { "bytes": 237, "stream": 405, "flow_id": "flow-0306b5b51f37fe63b2e3a57f", "packets": 2, "transport": "udp", "last_frame": 26766, "first_frame": 26765, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 53595, "responder_port": 53, "initiator_bytes": 90, "last_seen_epoch": "1583962684.331866", "responder_bytes": 147, "first_seen_epoch": "1583962684.318184" }, { "bytes": 11753, "stream": 558, "flow_id": "flow-e4aeb98b9384aca1142a9ddb", "packets": 27, "transport": "tcp", "last_frame": 26793, "first_frame": 26767, "initiator_ip": "10.3.11.194", "responder_ip": "20.44.86.43", "initiator_port": 50102, "responder_port": 443, "initiator_bytes": 6434, "last_seen_epoch": "1583962684.742262", "responder_bytes": 5319, "first_seen_epoch": "1583962684.334984" }, { "bytes": 211, "stream": 406, "flow_id": "flow-a65a6c381a5c14b88bdb8850", "packets": 2, "transport": "udp", "last_frame": 26795, "first_frame": 26794, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 53550, "responder_port": 53, "initiator_bytes": 81, "last_seen_epoch": "1583962685.586418", "responder_bytes": 130, "first_seen_epoch": "1583962685.572318" }, { "bytes": 31614, "stream": 559, "flow_id": "flow-1874e4a0b3cc4a5526cca772", "packets": 34, "transport": "tcp", "last_frame": 26832, "first_frame": 26796, "initiator_ip": "10.3.11.218", "responder_ip": "13.107.3.128", "initiator_port": 49822, "responder_port": 443, "initiator_bytes": 1480, "last_seen_epoch": "1583962685.84822", "responder_bytes": 30134, "first_seen_epoch": "1583962685.602736" }, { "bytes": 31550, "stream": 560, "flow_id": "flow-9103872bb024ba2ed4c56b10", "packets": 38, "transport": "tcp", "last_frame": 27011, "first_frame": 26829, "initiator_ip": "10.3.11.218", "responder_ip": "13.107.3.128", "initiator_port": 49823, "responder_port": 443, "initiator_bytes": 1696, "last_seen_epoch": "1583962690.740874", "responder_bytes": 29854, "first_seen_epoch": "1583962685.812849" }, { "bytes": 41937, "stream": 561, "flow_id": "flow-da654d82e9352e81d0758f51", "packets": 45, "transport": "tcp", "last_frame": 27012, "first_frame": 26835, "initiator_ip": "10.3.11.218", "responder_ip": "13.107.3.128", "initiator_port": 49824, "responder_port": 443, "initiator_bytes": 1676, "last_seen_epoch": "1583962690.74126", "responder_bytes": 40261, "first_seen_epoch": "1583962685.861847" }, { "bytes": 40218, "stream": 562, "flow_id": "flow-6bae9c9f227ab0bb222ec152", "packets": 50, "transport": "tcp", "last_frame": 27013, "first_frame": 26836, "initiator_ip": "10.3.11.218", "responder_ip": "13.107.3.128", "initiator_port": 49825, "responder_port": 443, "initiator_bytes": 1936, "last_seen_epoch": "1583962690.741409", "responder_bytes": 38282, "first_seen_epoch": "1583962685.862147" }, { "bytes": 46365, "stream": 563, "flow_id": "flow-2b78e5bd775d72941171b797", "packets": 48, "transport": "tcp", "last_frame": 27014, "first_frame": 26837, "initiator_ip": "10.3.11.218", "responder_ip": "13.107.3.128", "initiator_port": 49826, "responder_port": 443, "initiator_bytes": 1610, "last_seen_epoch": "1583962690.741523", "responder_bytes": 44755, "first_seen_epoch": "1583962685.86259" }, { "bytes": 7097, "stream": 564, "flow_id": "flow-aa8e13d03cdef0a5c4fe534a", "packets": 24, "transport": "tcp", "last_frame": 27306, "first_frame": 27283, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 49904, "responder_port": 445, "initiator_bytes": 5009, "last_seen_epoch": "1583962724.376747", "responder_bytes": 2088, "first_seen_epoch": "1583962713.584127" }, { "bytes": 211, "stream": 407, "flow_id": "flow-a1cfb594d2e91b343b881550", "packets": 2, "transport": "udp", "last_frame": 27314, "first_frame": 27313, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 61295, "responder_port": 53, "initiator_bytes": 81, "last_seen_epoch": "1583962732.810552", "responder_bytes": 130, "first_seen_epoch": "1583962732.810115" }, { "bytes": 31198, "stream": 565, "flow_id": "flow-0a25938435b555cc24dcdc74", "packets": 34, "transport": "tcp", "last_frame": 27382, "first_frame": 27315, "initiator_ip": "10.3.11.119", "responder_ip": "13.107.3.128", "initiator_port": 49905, "responder_port": 443, "initiator_bytes": 1432, "last_seen_epoch": "1583962733.982571", "responder_bytes": 29766, "first_seen_epoch": "1583962732.894496" }, { "bytes": 31531, "stream": 566, "flow_id": "flow-5ebae1216c742401f4ebeab3", "packets": 35, "transport": "tcp", "last_frame": 27383, "first_frame": 27320, "initiator_ip": "10.3.11.119", "responder_ip": "13.107.3.128", "initiator_port": 49906, "responder_port": 443, "initiator_bytes": 1432, "last_seen_epoch": "1583962737.836399", "responder_bytes": 30099, "first_seen_epoch": "1583962732.944827" }, { "bytes": 323, "stream": 408, "flow_id": "flow-58ce115b3d9af6db92f351de", "packets": 2, "transport": "udp", "last_frame": 27387, "first_frame": 27386, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 60724, "responder_port": 53, "initiator_bytes": 83, "last_seen_epoch": "1583962744.515705", "responder_bytes": 240, "first_seen_epoch": "1583962744.495077" }, { "bytes": 1722, "stream": 567, "flow_id": "flow-a316cc77ef00f47f345da916", "packets": 14, "transport": "tcp", "last_frame": 27429, "first_frame": 27388, "initiator_ip": "10.3.11.194", "responder_ip": "205.185.216.42", "initiator_port": 50103, "responder_port": 80, "initiator_bytes": 959, "last_seen_epoch": "1583962804.589919", "responder_bytes": 763, "first_seen_epoch": "1583962744.518646" }, { "bytes": 380, "stream": 409, "flow_id": "flow-6f0b84b3d5c09f5ca1de0318", "packets": 3, "transport": "udp", "last_frame": 27436, "first_frame": 27434, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 53486, "responder_port": 53, "initiator_bytes": 172, "last_seen_epoch": "1583962857.635043", "responder_bytes": 208, "first_seen_epoch": "1583962857.458795" }, { "bytes": 23229, "stream": 568, "flow_id": "flow-50517f80df8098c848a0fab4", "packets": 37, "transport": "tcp", "last_frame": 27473, "first_frame": 27437, "initiator_ip": "10.3.11.194", "responder_ip": "40.91.76.238", "initiator_port": 50104, "responder_port": 443, "initiator_bytes": 7300, "last_seen_epoch": "1583962858.346465", "responder_bytes": 15929, "first_seen_epoch": "1583962857.637844" }, { "bytes": 452, "stream": 410, "flow_id": "flow-ba2e577aa86407d66eb2fca0", "packets": 3, "transport": "udp", "last_frame": 27478, "first_frame": 27476, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 65286, "responder_port": 53, "initiator_bytes": 218, "last_seen_epoch": "1583962861.371315", "responder_bytes": 234, "first_seen_epoch": "1583962861.337942" }, { "bytes": 8363, "stream": 569, "flow_id": "flow-29c050d75b7dab21349c77b0", "packets": 22, "transport": "tcp", "last_frame": 27500, "first_frame": 27479, "initiator_ip": "10.3.11.194", "responder_ip": "23.206.213.111", "initiator_port": 50105, "responder_port": 443, "initiator_bytes": 1072, "last_seen_epoch": "1583962861.464", "responder_bytes": 7291, "first_seen_epoch": "1583962861.371903" }, { "bytes": 1292, "stream": 570, "flow_id": "flow-7ae779f7103fcf26d69a3d32", "packets": 12, "transport": "tcp", "last_frame": 27534, "first_frame": 27509, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 50109, "responder_port": 135, "initiator_bytes": 730, "last_seen_epoch": "1583962891.398185", "responder_bytes": 562, "first_seen_epoch": "1583962879.618248" }, { "bytes": 2066, "stream": 571, "flow_id": "flow-0a6166aa99843d0666678d5d", "packets": 14, "transport": "tcp", "last_frame": 27535, "first_frame": 27516, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 50110, "responder_port": 49667, "initiator_bytes": 1234, "last_seen_epoch": "1583962891.398294", "responder_bytes": 832, "first_seen_epoch": "1583962879.625505" }, { "bytes": 365, "stream": 411, "flow_id": "flow-2680420d6b2773a51b6c1212", "packets": 3, "transport": "udp", "last_frame": 27538, "first_frame": 27536, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 56438, "responder_port": 53, "initiator_bytes": 172, "last_seen_epoch": "1583962904.88194", "responder_bytes": 193, "first_seen_epoch": "1583962904.728695" }, { "bytes": 5173, "stream": 572, "flow_id": "flow-2ec4b14cdae87d83b3ba66f0", "packets": 24, "transport": "tcp", "last_frame": 27562, "first_frame": 27539, "initiator_ip": "10.3.11.194", "responder_ip": "13.78.168.230", "initiator_port": 50111, "responder_port": 443, "initiator_bytes": 1296, "last_seen_epoch": "1583962905.129383", "responder_bytes": 3877, "first_seen_epoch": "1583962904.882616" }, { "bytes": 11301, "stream": 573, "flow_id": "flow-86f68e559d8ccabff0c44db4", "packets": 52, "transport": "tcp", "last_frame": 29518, "first_frame": 27565, "initiator_ip": "10.3.11.194", "responder_ip": "190.214.13.2", "initiator_port": 50112, "responder_port": 449, "initiator_bytes": 5629, "last_seen_epoch": "1583963166.92005", "responder_bytes": 5672, "first_seen_epoch": "1583962932.524479" }, { "bytes": 24643, "stream": 574, "flow_id": "flow-801ee39f9de94bd1d400714e", "packets": 35, "transport": "tcp", "last_frame": 27727, "first_frame": 27577, "initiator_ip": "10.3.11.194", "responder_ip": "185.14.31.98", "initiator_port": 50113, "responder_port": 447, "initiator_bytes": 1220, "last_seen_epoch": "1583962999.529912", "responder_bytes": 23423, "first_seen_epoch": "1583962933.895658" }, { "bytes": 7964, "stream": 575, "flow_id": "flow-fef4d070305895741d8b27ce", "packets": 43, "transport": "tcp", "last_frame": 29519, "first_frame": 27608, "initiator_ip": "10.3.11.194", "responder_ip": "190.214.13.2", "initiator_port": 50114, "responder_port": 449, "initiator_bytes": 4717, "last_seen_epoch": "1583963166.92032", "responder_bytes": 3247, "first_seen_epoch": "1583962937.399372" }, { "bytes": 707, "stream": 576, "flow_id": "flow-f916c3fc69fed47f562d09c8", "packets": 9, "transport": "tcp", "last_frame": 27641, "first_frame": 27615, "initiator_ip": "10.3.11.194", "responder_ip": "172.245.249.117", "initiator_port": 50115, "responder_port": 443, "initiator_bytes": 291, "last_seen_epoch": "1583962950.096277", "responder_bytes": 416, "first_seen_epoch": "1583962937.855653" }, { "bytes": 511, "stream": 577, "flow_id": "flow-f5817becce6b61364e2eb919", "packets": 8, "transport": "tcp", "last_frame": 27649, "first_frame": 27638, "initiator_ip": "10.3.11.194", "responder_ip": "172.245.249.117", "initiator_port": 50116, "responder_port": 443, "initiator_bytes": 291, "last_seen_epoch": "1583962955.103825", "responder_bytes": 220, "first_seen_epoch": "1583962949.953116" }, { "bytes": 511, "stream": 578, "flow_id": "flow-6f8bc4325335c97958b874ab", "packets": 8, "transport": "tcp", "last_frame": 27664, "first_frame": 27646, "initiator_ip": "10.3.11.194", "responder_ip": "172.245.249.117", "initiator_port": 50117, "responder_port": 443, "initiator_bytes": 291, "last_seen_epoch": "1583962960.119317", "responder_bytes": 220, "first_seen_epoch": "1583962954.961692" }, { "bytes": 511, "stream": 579, "flow_id": "flow-cd144e2eb392a19777b5a187", "packets": 8, "transport": "tcp", "last_frame": 27672, "first_frame": 27661, "initiator_ip": "10.3.11.194", "responder_ip": "172.245.249.117", "initiator_port": 50118, "responder_port": 443, "initiator_bytes": 291, "last_seen_epoch": "1583962965.144017", "responder_bytes": 220, "first_seen_epoch": "1583962959.977565" }, { "bytes": 511, "stream": 580, "flow_id": "flow-25d7eeb39192c3762aebfdc6", "packets": 8, "transport": "tcp", "last_frame": 27680, "first_frame": 27669, "initiator_ip": "10.3.11.194", "responder_ip": "172.245.249.117", "initiator_port": 50119, "responder_port": 443, "initiator_bytes": 291, "last_seen_epoch": "1583962975.536192", "responder_bytes": 220, "first_seen_epoch": "1583962964.993273" }, { "bytes": 511, "stream": 581, "flow_id": "flow-055aedd43abe21ec0d80457a", "packets": 8, "transport": "tcp", "last_frame": 27692, "first_frame": 27677, "initiator_ip": "10.3.11.194", "responder_ip": "195.123.242.48", "initiator_port": 50120, "responder_port": 443, "initiator_bytes": 291, "last_seen_epoch": "1583962980.231571", "responder_bytes": 220, "first_seen_epoch": "1583962975.00924" }, { "bytes": 511, "stream": 582, "flow_id": "flow-2f205b3977b09bcc659570ae", "packets": 8, "transport": "tcp", "last_frame": 27705, "first_frame": 27689, "initiator_ip": "10.3.11.194", "responder_ip": "195.123.242.48", "initiator_port": 50121, "responder_port": 443, "initiator_bytes": 291, "last_seen_epoch": "1583962985.319774", "responder_bytes": 220, "first_seen_epoch": "1583962980.024956" }, { "bytes": 511, "stream": 583, "flow_id": "flow-6dfaa20b207f8816a934d4f4", "packets": 8, "transport": "tcp", "last_frame": 27715, "first_frame": 27702, "initiator_ip": "10.3.11.194", "responder_ip": "195.123.242.48", "initiator_port": 50122, "responder_port": 443, "initiator_bytes": 291, "last_seen_epoch": "1583962990.323085", "responder_bytes": 220, "first_seen_epoch": "1583962985.041737" }, { "bytes": 465, "stream": 584, "flow_id": "flow-b5b2101a65c25901c44a047c", "packets": 7, "transport": "tcp", "last_frame": 27730, "first_frame": 27712, "initiator_ip": "10.3.11.194", "responder_ip": "195.123.242.48", "initiator_port": 50123, "responder_port": 443, "initiator_bytes": 291, "last_seen_epoch": "1583963000.073062", "responder_bytes": 174, "first_seen_epoch": "1583962990.057305" }, { "bytes": 511, "stream": 585, "flow_id": "flow-77f0990c5e8612e700685e8d", "packets": 8, "transport": "tcp", "last_frame": 27742, "first_frame": 27731, "initiator_ip": "10.3.11.194", "responder_ip": "198.23.252.130", "initiator_port": 50124, "responder_port": 443, "initiator_bytes": 291, "last_seen_epoch": "1583963005.288122", "responder_bytes": 220, "first_seen_epoch": "1583963000.073303" }, { "bytes": 511, "stream": 586, "flow_id": "flow-74e1ac22c998a86694c0b2b5", "packets": 8, "transport": "tcp", "last_frame": 27747, "first_frame": 27737, "initiator_ip": "10.3.11.194", "responder_ip": "198.23.252.130", "initiator_port": 50125, "responder_port": 443, "initiator_bytes": 291, "last_seen_epoch": "1583963010.303251", "responder_bytes": 220, "first_seen_epoch": "1583963005.089555" }, { "bytes": 511, "stream": 587, "flow_id": "flow-b731d2331cf2cee49acc9d60", "packets": 8, "transport": "tcp", "last_frame": 27763, "first_frame": 27745, "initiator_ip": "10.3.11.194", "responder_ip": "198.23.252.130", "initiator_port": 50126, "responder_port": 443, "initiator_bytes": 291, "last_seen_epoch": "1583963015.316633", "responder_bytes": 220, "first_seen_epoch": "1583963010.105466" }, { "bytes": 511, "stream": 588, "flow_id": "flow-9915f3d4e630a2760854d289", "packets": 8, "transport": "tcp", "last_frame": 28300, "first_frame": 27758, "initiator_ip": "10.3.11.194", "responder_ip": "198.23.252.130", "initiator_port": 50127, "responder_port": 443, "initiator_bytes": 291, "last_seen_epoch": "1583963025.321575", "responder_bytes": 220, "first_seen_epoch": "1583963015.120165" }, { "bytes": 250, "stream": 412, "flow_id": "flow-2182786b644fed18f53faf25", "packets": 3, "transport": "udp", "last_frame": 27775, "first_frame": 27773, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 49943, "responder_port": 53, "initiator_bytes": 156, "last_seen_epoch": "1583963020.430853", "responder_bytes": 94, "first_seen_epoch": "1583963020.371821" }, { "bytes": 569667, "stream": 589, "flow_id": "flow-61d1e204142c52109c452826", "packets": 518, "transport": "tcp", "last_frame": 28310, "first_frame": 27776, "initiator_ip": "10.3.11.194", "responder_ip": "199.247.13.144", "initiator_port": 50128, "responder_port": 443, "initiator_bytes": 7796, "last_seen_epoch": "1583963026.215", "responder_bytes": 561871, "first_seen_epoch": "1583963020.431617" }, { "bytes": 511, "stream": 590, "flow_id": "flow-89ff1fbe344866adafedee07", "packets": 8, "transport": "tcp", "last_frame": 28315, "first_frame": 28295, "initiator_ip": "10.3.11.194", "responder_ip": "172.245.249.117", "initiator_port": 50129, "responder_port": 443, "initiator_bytes": 291, "last_seen_epoch": "1583963030.286059", "responder_bytes": 220, "first_seen_epoch": "1583963025.121605" }, { "bytes": 511, "stream": 591, "flow_id": "flow-d946853a468fd7ff298207cb", "packets": 8, "transport": "tcp", "last_frame": 28587, "first_frame": 28313, "initiator_ip": "10.3.11.194", "responder_ip": "172.245.249.117", "initiator_port": 50130, "responder_port": 443, "initiator_bytes": 291, "last_seen_epoch": "1583963035.565243", "responder_bytes": 220, "first_seen_epoch": "1583963030.135582" }, { "bytes": 262, "stream": 413, "flow_id": "flow-f3e998a0959c19412890c27c", "packets": 3, "transport": "udp", "last_frame": 28321, "first_frame": 28319, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 56810, "responder_port": 53, "initiator_bytes": 164, "last_seen_epoch": "1583963031.223332", "responder_bytes": 98, "first_seen_epoch": "1583963031.180089" }, { "bytes": 281286, "stream": 592, "flow_id": "flow-6514ece51205d30eefc9cbbd", "packets": 243, "transport": "tcp", "last_frame": 28564, "first_frame": 28322, "initiator_ip": "10.3.11.194", "responder_ip": "209.97.130.197", "initiator_port": 50131, "responder_port": 443, "initiator_bytes": 3008, "last_seen_epoch": "1583963032.337364", "responder_bytes": 278278, "first_seen_epoch": "1583963031.226347" }, { "bytes": 2172, "stream": 593, "flow_id": "flow-b5303027e2a6a4a8c7f4b300", "packets": 17, "transport": "tcp", "last_frame": 28581, "first_frame": 28565, "initiator_ip": "10.3.11.194", "responder_ip": "209.97.130.197", "initiator_port": 50132, "responder_port": 443, "initiator_bytes": 1279, "last_seen_epoch": "1583963033.041828", "responder_bytes": 893, "first_seen_epoch": "1583963032.341305" }, { "bytes": 511, "stream": 594, "flow_id": "flow-61fc7d11a58c1210cb143be7", "packets": 8, "transport": "tcp", "last_frame": 28611, "first_frame": 28584, "initiator_ip": "10.3.11.194", "responder_ip": "172.245.249.117", "initiator_port": 50133, "responder_port": 443, "initiator_bytes": 291, "last_seen_epoch": "1583963040.29992", "responder_bytes": 220, "first_seen_epoch": "1583963035.151927" }, { "bytes": 2172, "stream": 595, "flow_id": "flow-bca76c451dc535bbfb094f16", "packets": 17, "transport": "tcp", "last_frame": 28606, "first_frame": 28590, "initiator_ip": "10.3.11.194", "responder_ip": "209.97.130.197", "initiator_port": 50134, "responder_port": 443, "initiator_bytes": 1279, "last_seen_epoch": "1583963039.215072", "responder_bytes": 893, "first_seen_epoch": "1583963038.05943" }, { "bytes": 511, "stream": 596, "flow_id": "flow-9ec893a6f645cfb59d7677f2", "packets": 8, "transport": "tcp", "last_frame": 28773, "first_frame": 28609, "initiator_ip": "10.3.11.194", "responder_ip": "172.245.249.117", "initiator_port": 50135, "responder_port": 443, "initiator_bytes": 291, "last_seen_epoch": "1583963050.341741", "responder_bytes": 220, "first_seen_epoch": "1583963040.152995" }, { "bytes": 113511, "stream": 597, "flow_id": "flow-c1f6efce18ea61e5d5080e1b", "packets": 111, "transport": "tcp", "last_frame": 29316, "first_frame": 28622, "initiator_ip": "10.3.11.194", "responder_ip": "185.14.31.98", "initiator_port": 50136, "responder_port": 447, "initiator_bytes": 2185, "last_seen_epoch": "1583963108.982225", "responder_bytes": 111326, "first_seen_epoch": "1583963042.74362" }, { "bytes": 2172, "stream": 598, "flow_id": "flow-70f26ff62eac275dfc6d0117", "packets": 17, "transport": "tcp", "last_frame": 28744, "first_frame": 28728, "initiator_ip": "10.3.11.194", "responder_ip": "209.97.130.197", "initiator_port": 50137, "responder_port": 443, "initiator_bytes": 1279, "last_seen_epoch": "1583963044.890303", "responder_bytes": 893, "first_seen_epoch": "1583963044.230357" }, { "bytes": 2172, "stream": 599, "flow_id": "flow-c72d5ad769dd408cbaf9a134", "packets": 17, "transport": "tcp", "last_frame": 28788, "first_frame": 28751, "initiator_ip": "10.3.11.194", "responder_ip": "209.97.130.197", "initiator_port": 50138, "responder_port": 443, "initiator_bytes": 1279, "last_seen_epoch": "1583963050.544723", "responder_bytes": 893, "first_seen_epoch": "1583963049.902961" }, { "bytes": 511, "stream": 600, "flow_id": "flow-ac2fca2ffece37855462270e", "packets": 8, "transport": "tcp", "last_frame": 28793, "first_frame": 28764, "initiator_ip": "10.3.11.194", "responder_ip": "195.123.242.48", "initiator_port": 50139, "responder_port": 443, "initiator_bytes": 291, "last_seen_epoch": "1583963055.394934", "responder_bytes": 220, "first_seen_epoch": "1583963050.199017" }, { "bytes": 1303, "stream": 601, "flow_id": "flow-8d06b585b93327d77d5a461a", "packets": 14, "transport": "tcp", "last_frame": 29515, "first_frame": 28765, "initiator_ip": "10.3.11.194", "responder_ip": "198.23.252.135", "initiator_port": 50140, "responder_port": 443, "initiator_bytes": 913, "last_seen_epoch": "1583963166.913222", "responder_bytes": 390, "first_seen_epoch": "1583963050.247153" }, { "bytes": 465, "stream": 602, "flow_id": "flow-5c0cec994bf8f068aa251fcd", "packets": 7, "transport": "tcp", "last_frame": 28816, "first_frame": 28791, "initiator_ip": "10.3.11.194", "responder_ip": "195.123.242.48", "initiator_port": 50141, "responder_port": 443, "initiator_bytes": 291, "last_seen_epoch": "1583963060.215273", "responder_bytes": 174, "first_seen_epoch": "1583963055.20094" }, { "bytes": 2172, "stream": 603, "flow_id": "flow-0eafc77a727a246169ba988f", "packets": 17, "transport": "tcp", "last_frame": 28813, "first_frame": 28797, "initiator_ip": "10.3.11.194", "responder_ip": "209.97.130.197", "initiator_port": 50142, "responder_port": 443, "initiator_bytes": 1279, "last_seen_epoch": "1583963056.211188", "responder_bytes": 893, "first_seen_epoch": "1583963055.559562" }, { "bytes": 511, "stream": 604, "flow_id": "flow-cc78ff0a6de5e4e32dcee281", "packets": 8, "transport": "tcp", "last_frame": 28843, "first_frame": 28817, "initiator_ip": "10.3.11.194", "responder_ip": "195.123.242.48", "initiator_port": 50143, "responder_port": 443, "initiator_bytes": 291, "last_seen_epoch": "1583963065.426102", "responder_bytes": 220, "first_seen_epoch": "1583963060.215528" }, { "bytes": 2388, "stream": 605, "flow_id": "flow-683b11728f63ec7673b5a77c", "packets": 21, "transport": "tcp", "last_frame": 29136, "first_frame": 28821, "initiator_ip": "10.3.11.194", "responder_ip": "209.97.130.197", "initiator_port": 50144, "responder_port": 443, "initiator_bytes": 1441, "last_seen_epoch": "1583963082.076214", "responder_bytes": 947, "first_seen_epoch": "1583963061.215303" }, { "bytes": 511, "stream": 606, "flow_id": "flow-f7c998194531e0667d075622", "packets": 8, "transport": "tcp", "last_frame": 29100, "first_frame": 28840, "initiator_ip": "10.3.11.194", "responder_ip": "195.123.242.48", "initiator_port": 50145, "responder_port": 443, "initiator_bytes": 291, "last_seen_epoch": "1583963075.462532", "responder_bytes": 220, "first_seen_epoch": "1583963065.232272" }, { "bytes": 233, "stream": 414, "flow_id": "flow-c12ae23be8a8fd7055cfb3e9", "packets": 2, "transport": "udp", "last_frame": 28847, "first_frame": 28846, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 58264, "responder_port": 53, "initiator_bytes": 79, "last_seen_epoch": "1583963065.465635", "responder_bytes": 154, "first_seen_epoch": "1583963065.465244" }, { "bytes": 2250, "stream": 607, "flow_id": "flow-3a193bda8325d5ee1db79d4d", "packets": 17, "transport": "tcp", "last_frame": 28864, "first_frame": 28848, "initiator_ip": "10.3.11.194", "responder_ip": "209.97.130.197", "initiator_port": 50146, "responder_port": 443, "initiator_bytes": 1279, "last_seen_epoch": "1583963067.591069", "responder_bytes": 971, "first_seen_epoch": "1583963066.855421" }, { "bytes": 251720, "stream": 608, "flow_id": "flow-1d10ce8fb733b18a505a38bc", "packets": 225, "transport": "tcp", "last_frame": 29095, "first_frame": 28869, "initiator_ip": "10.3.11.194", "responder_ip": "209.97.130.197", "initiator_port": 50147, "responder_port": 443, "initiator_bytes": 3547, "last_seen_epoch": "1583963073.722957", "responder_bytes": 248173, "first_seen_epoch": "1583963072.605693" }, { "bytes": 511, "stream": 609, "flow_id": "flow-d073f3276129e48cded343d9", "packets": 8, "transport": "tcp", "last_frame": 29132, "first_frame": 29098, "initiator_ip": "10.3.11.194", "responder_ip": "198.23.252.130", "initiator_port": 50148, "responder_port": 443, "initiator_bytes": 291, "last_seen_epoch": "1583963080.473125", "responder_bytes": 220, "first_seen_epoch": "1583963075.262042" }, { "bytes": 3252, "stream": 610, "flow_id": "flow-62f44c1c078515bc53277b5a", "packets": 20, "transport": "tcp", "last_frame": 29409, "first_frame": 29106, "initiator_ip": "10.3.11.194", "responder_ip": "209.97.130.197", "initiator_port": 50150, "responder_port": 443, "initiator_bytes": 2303, "last_seen_epoch": "1583963123.597399", "responder_bytes": 949, "first_seen_epoch": "1583963076.437469" }, { "bytes": 511, "stream": 611, "flow_id": "flow-320c27e0d8c6be75a1d8c8f7", "packets": 8, "transport": "tcp", "last_frame": 29181, "first_frame": 29127, "initiator_ip": "10.3.11.194", "responder_ip": "198.23.252.130", "initiator_port": 50151, "responder_port": 443, "initiator_bytes": 291, "last_seen_epoch": "1583963085.470172", "responder_bytes": 220, "first_seen_epoch": "1583963080.263134" }, { "bytes": 2172, "stream": 612, "flow_id": "flow-cc245f0891f1d9668fe03486", "packets": 17, "transport": "tcp", "last_frame": 29153, "first_frame": 29137, "initiator_ip": "10.3.11.194", "responder_ip": "209.97.130.197", "initiator_port": 50152, "responder_port": 443, "initiator_bytes": 1279, "last_seen_epoch": "1583963082.70907", "responder_bytes": 893, "first_seen_epoch": "1583963082.076558" }, { "bytes": 3113, "stream": 613, "flow_id": "flow-8efd5c3b4c237bd661d5f922", "packets": 19, "transport": "tcp", "last_frame": 29172, "first_frame": 29154, "initiator_ip": "10.3.11.194", "responder_ip": "209.97.130.197", "initiator_port": 50153, "responder_port": 443, "initiator_bytes": 2164, "last_seen_epoch": "1583963083.408019", "responder_bytes": 949, "first_seen_epoch": "1583963082.709727" }, { "bytes": 511, "stream": 614, "flow_id": "flow-ac1261e2e36e1f1a95ed09be", "packets": 8, "transport": "tcp", "last_frame": 29224, "first_frame": 29178, "initiator_ip": "10.3.11.194", "responder_ip": "198.23.252.130", "initiator_port": 50154, "responder_port": 443, "initiator_bytes": 291, "last_seen_epoch": "1583963090.475535", "responder_bytes": 220, "first_seen_epoch": "1583963085.277533" }, { "bytes": 2172, "stream": 615, "flow_id": "flow-ee19f29126dd1338adbfc9a1", "packets": 17, "transport": "tcp", "last_frame": 29201, "first_frame": 29185, "initiator_ip": "10.3.11.194", "responder_ip": "209.97.130.197", "initiator_port": 50158, "responder_port": 443, "initiator_bytes": 1279, "last_seen_epoch": "1583963089.082021", "responder_bytes": 893, "first_seen_epoch": "1583963088.419265" }, { "bytes": 511, "stream": 616, "flow_id": "flow-3d9c80fc9879316527da5269", "packets": 8, "transport": "tcp", "last_frame": 29270, "first_frame": 29205, "initiator_ip": "10.3.11.194", "responder_ip": "198.23.252.130", "initiator_port": 50159, "responder_port": 443, "initiator_bytes": 291, "last_seen_epoch": "1583963100.570435", "responder_bytes": 220, "first_seen_epoch": "1583963090.278648" }, { "bytes": 1292, "stream": 617, "flow_id": "flow-27e9bada8948066ed5f0181f", "packets": 12, "transport": "tcp", "last_frame": 29284, "first_frame": 29206, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 50160, "responder_port": 135, "initiator_bytes": 730, "last_seen_epoch": "1583963102.982877", "responder_bytes": 562, "first_seen_epoch": "1583963090.453465" }, { "bytes": 2066, "stream": 618, "flow_id": "flow-ca0cb48b8b70449d8f9de0f8", "packets": 14, "transport": "tcp", "last_frame": 29285, "first_frame": 29213, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 50161, "responder_port": 49667, "initiator_bytes": 1234, "last_seen_epoch": "1583963102.983062", "responder_bytes": 832, "first_seen_epoch": "1583963090.455306" }, { "bytes": 2172, "stream": 619, "flow_id": "flow-a12891da465f28b69f19536d", "packets": 17, "transport": "tcp", "last_frame": 29250, "first_frame": 29234, "initiator_ip": "10.3.11.194", "responder_ip": "209.97.130.197", "initiator_port": 50162, "responder_port": 443, "initiator_bytes": 1279, "last_seen_epoch": "1583963094.67969", "responder_bytes": 893, "first_seen_epoch": "1583963094.090156" }, { "bytes": 2172, "stream": 620, "flow_id": "flow-dabb5dd826ec7f5bd1b30932", "packets": 17, "transport": "tcp", "last_frame": 29275, "first_frame": 29251, "initiator_ip": "10.3.11.194", "responder_ip": "209.97.130.197", "initiator_port": 50163, "responder_port": 443, "initiator_bytes": 1279, "last_seen_epoch": "1583963100.570838", "responder_bytes": 893, "first_seen_epoch": "1583963099.685827" }, { "bytes": 511, "stream": 621, "flow_id": "flow-3b51690d73c53244f90bfd1c", "packets": 8, "transport": "tcp", "last_frame": 29291, "first_frame": 29266, "initiator_ip": "10.3.11.194", "responder_ip": "172.245.249.117", "initiator_port": 50164, "responder_port": 443, "initiator_bytes": 291, "last_seen_epoch": "1583963105.452183", "responder_bytes": 220, "first_seen_epoch": "1583963100.29473" }, { "bytes": 511, "stream": 622, "flow_id": "flow-233d1b91cfc696d6e2ed4bc9", "packets": 8, "transport": "tcp", "last_frame": 29322, "first_frame": 29288, "initiator_ip": "10.3.11.194", "responder_ip": "172.245.249.117", "initiator_port": 50165, "responder_port": 443, "initiator_bytes": 291, "last_seen_epoch": "1583963110.45626", "responder_bytes": 220, "first_seen_epoch": "1583963105.309494" }, { "bytes": 2172, "stream": 623, "flow_id": "flow-7bd2d108dbc2658558e2e292", "packets": 17, "transport": "tcp", "last_frame": 29310, "first_frame": 29294, "initiator_ip": "10.3.11.194", "responder_ip": "209.97.130.197", "initiator_port": 50166, "responder_port": 443, "initiator_bytes": 1279, "last_seen_epoch": "1583963106.180258", "responder_bytes": 893, "first_seen_epoch": "1583963105.575746" }, { "bytes": 511, "stream": 624, "flow_id": "flow-39dc1789d38867bdb95df02e", "packets": 8, "transport": "tcp", "last_frame": 29352, "first_frame": 29319, "initiator_ip": "10.3.11.194", "responder_ip": "172.245.249.117", "initiator_port": 50167, "responder_port": 443, "initiator_bytes": 291, "last_seen_epoch": "1583963115.467294", "responder_bytes": 220, "first_seen_epoch": "1583963110.311333" }, { "bytes": 2172, "stream": 625, "flow_id": "flow-0f2c2806e418c0d733313f59", "packets": 17, "transport": "tcp", "last_frame": 29345, "first_frame": 29325, "initiator_ip": "10.3.11.194", "responder_ip": "209.97.130.197", "initiator_port": 50168, "responder_port": 443, "initiator_bytes": 1279, "last_seen_epoch": "1583963111.788247", "responder_bytes": 893, "first_seen_epoch": "1583963111.185054" }, { "bytes": 233, "stream": 415, "flow_id": "flow-18f51a6ff0b3828752e5ad1a", "packets": 2, "transport": "udp", "last_frame": 29347, "first_frame": 29346, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 59835, "responder_port": 53, "initiator_bytes": 79, "last_seen_epoch": "1583963112.169749", "responder_bytes": 154, "first_seen_epoch": "1583963112.169489" }, { "bytes": 465, "stream": 626, "flow_id": "flow-380489d4e51b3415299f6ca0", "packets": 7, "transport": "tcp", "last_frame": 29410, "first_frame": 29350, "initiator_ip": "10.3.11.194", "responder_ip": "172.245.249.117", "initiator_port": 50169, "responder_port": 443, "initiator_bytes": 291, "last_seen_epoch": "1583963125.358352", "responder_bytes": 174, "first_seen_epoch": "1583963115.325962" }, { "bytes": 2172, "stream": 627, "flow_id": "flow-8e8b65a8f4ee2198433156a1", "packets": 17, "transport": "tcp", "last_frame": 29372, "first_frame": 29356, "initiator_ip": "10.3.11.194", "responder_ip": "209.97.130.197", "initiator_port": 50170, "responder_port": 443, "initiator_bytes": 1279, "last_seen_epoch": "1583963117.40997", "responder_bytes": 893, "first_seen_epoch": "1583963116.810807" }, { "bytes": 2250, "stream": 628, "flow_id": "flow-bc57a77ef7e86da465e82453", "packets": 17, "transport": "tcp", "last_frame": 29391, "first_frame": 29375, "initiator_ip": "10.3.11.194", "responder_ip": "209.97.130.197", "initiator_port": 50171, "responder_port": 443, "initiator_bytes": 1279, "last_seen_epoch": "1583963123.006048", "responder_bytes": 971, "first_seen_epoch": "1583963122.421254" }, { "bytes": 2099, "stream": 629, "flow_id": "flow-ef4fae6ca91eeefeb241bbe2", "packets": 17, "transport": "tcp", "last_frame": 29408, "first_frame": 29392, "initiator_ip": "10.3.11.194", "responder_ip": "209.97.130.197", "initiator_port": 50172, "responder_port": 443, "initiator_bytes": 1204, "last_seen_epoch": "1583963123.589965", "responder_bytes": 895, "first_seen_epoch": "1583963123.007057" }, { "bytes": 511, "stream": 630, "flow_id": "flow-7e4b5d6ce3123e13add3f6c7", "packets": 8, "transport": "tcp", "last_frame": 29419, "first_frame": 29411, "initiator_ip": "10.3.11.194", "responder_ip": "195.123.242.48", "initiator_port": 50173, "responder_port": 443, "initiator_bytes": 291, "last_seen_epoch": "1583963130.569022", "responder_bytes": 220, "first_seen_epoch": "1583963125.358582" }, { "bytes": 511, "stream": 631, "flow_id": "flow-ba3732d3d6cb98c5fecd50fe", "packets": 8, "transport": "tcp", "last_frame": 29436, "first_frame": 29417, "initiator_ip": "10.3.11.194", "responder_ip": "195.123.242.48", "initiator_port": 50174, "responder_port": 443, "initiator_bytes": 291, "last_seen_epoch": "1583963135.587308", "responder_bytes": 220, "first_seen_epoch": "1583963130.373443" }, { "bytes": 511, "stream": 632, "flow_id": "flow-5f7d3861c049d5726a239185", "packets": 8, "transport": "tcp", "last_frame": 29441, "first_frame": 29431, "initiator_ip": "10.3.11.194", "responder_ip": "195.123.242.48", "initiator_port": 50175, "responder_port": 443, "initiator_bytes": 291, "last_seen_epoch": "1583963140.598594", "responder_bytes": 220, "first_seen_epoch": "1583963135.389626" }, { "bytes": 511, "stream": 633, "flow_id": "flow-18ad1b48f490bccf2b11669d", "packets": 8, "transport": "tcp", "last_frame": 29452, "first_frame": 29439, "initiator_ip": "10.3.11.194", "responder_ip": "195.123.242.48", "initiator_port": 50176, "responder_port": 443, "initiator_bytes": 291, "last_seen_epoch": "1583963150.631213", "responder_bytes": 220, "first_seen_epoch": "1583963140.405204" }, { "bytes": 511, "stream": 634, "flow_id": "flow-9a9c3cd53d471abba11ebd40", "packets": 8, "transport": "tcp", "last_frame": 29467, "first_frame": 29450, "initiator_ip": "10.3.11.194", "responder_ip": "198.23.252.130", "initiator_port": 50177, "responder_port": 443, "initiator_bytes": 291, "last_seen_epoch": "1583963155.648863", "responder_bytes": 220, "first_seen_epoch": "1583963150.436576" }, { "bytes": 511, "stream": 635, "flow_id": "flow-1c4b3372ac8b2a0257fced3b", "packets": 8, "transport": "tcp", "last_frame": 29472, "first_frame": 29462, "initiator_ip": "10.3.11.194", "responder_ip": "198.23.252.130", "initiator_port": 50178, "responder_port": 443, "initiator_bytes": 291, "last_seen_epoch": "1583963160.661572", "responder_bytes": 220, "first_seen_epoch": "1583963155.453382" }, { "bytes": 511, "stream": 636, "flow_id": "flow-f8b8532ccdd6c3b53bea2bb2", "packets": 8, "transport": "tcp", "last_frame": 29514, "first_frame": 29469, "initiator_ip": "10.3.11.194", "responder_ip": "198.23.252.130", "initiator_port": 50179, "responder_port": 443, "initiator_bytes": 291, "last_seen_epoch": "1583963165.679579", "responder_bytes": 220, "first_seen_epoch": "1583963160.468242" }, { "bytes": 10243, "stream": 637, "flow_id": "flow-bb8337f74e9fda83806a1ce7", "packets": 32, "transport": "tcp", "last_frame": 29520, "first_frame": 29476, "initiator_ip": "10.3.11.194", "responder_ip": "13.107.21.200", "initiator_port": 50180, "responder_port": 443, "initiator_bytes": 3591, "last_seen_epoch": "1583963172.120019", "responder_bytes": 6652, "first_seen_epoch": "1583963163.065548" }, { "bytes": 349, "stream": 638, "flow_id": "flow-34f27a8e15d76ae76cef8d9a", "packets": 5, "transport": "tcp", "last_frame": 29516, "first_frame": 29509, "initiator_ip": "10.3.11.194", "responder_ip": "198.23.252.130", "initiator_port": 50181, "responder_port": 443, "initiator_bytes": 237, "last_seen_epoch": "1583963166.91368", "responder_bytes": 112, "first_seen_epoch": "1583963165.483592" }, { "bytes": 16924, "stream": 639, "flow_id": "flow-2997f2a62eb53da2e4187f7d", "packets": 63, "transport": "tcp", "last_frame": 29611, "first_frame": 29521, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 50182, "responder_port": 445, "initiator_bytes": 9766, "last_seen_epoch": "1583963183.015716", "responder_bytes": 7158, "first_seen_epoch": "1583963172.277507" }, { "bytes": 4071, "stream": 640, "flow_id": "flow-5102b71a22540a861ea4c91b", "packets": 12, "transport": "tcp", "last_frame": 29539, "first_frame": 29528, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 50183, "responder_port": 88, "initiator_bytes": 2046, "last_seen_epoch": "1583963172.283777", "responder_bytes": 2025, "first_seen_epoch": "1583963172.281364" }, { "bytes": 3711, "stream": 641, "flow_id": "flow-70ccf18811d5acab3d685e07", "packets": 12, "transport": "tcp", "last_frame": 29551, "first_frame": 29540, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 50184, "responder_port": 88, "initiator_bytes": 1841, "last_seen_epoch": "1583963172.285128", "responder_bytes": 1870, "first_seen_epoch": "1583963172.283902" }, { "bytes": 10813, "stream": 642, "flow_id": "flow-88db3125d0fdf9686a912730", "packets": 30, "transport": "tcp", "last_frame": 29642, "first_frame": 29613, "initiator_ip": "10.3.11.218", "responder_ip": "204.79.197.200", "initiator_port": 49827, "responder_port": 443, "initiator_bytes": 4161, "last_seen_epoch": "1583963188.477616", "responder_bytes": 6652, "first_seen_epoch": "1583963186.452057" }, { "bytes": 20893, "stream": 643, "flow_id": "flow-fe8d2e871533cf4f22a05a32", "packets": 92, "transport": "tcp", "last_frame": 29753, "first_frame": 29643, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 49828, "responder_port": 445, "initiator_bytes": 12145, "last_seen_epoch": "1583963199.543053", "responder_bytes": 8748, "first_seen_epoch": "1583963188.834622" }, { "bytes": 4071, "stream": 644, "flow_id": "flow-fa4d7b8c4160fdf8746055e7", "packets": 12, "transport": "tcp", "last_frame": 29661, "first_frame": 29650, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 49829, "responder_port": 88, "initiator_bytes": 2046, "last_seen_epoch": "1583963188.84534", "responder_bytes": 2025, "first_seen_epoch": "1583963188.842118" }, { "bytes": 16731, "stream": 645, "flow_id": "flow-e5ec03acc13704802d276aeb", "packets": 62, "transport": "tcp", "last_frame": 29834, "first_frame": 29757, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 49907, "responder_port": 445, "initiator_bytes": 9589, "last_seen_epoch": "1583963217.169345", "responder_bytes": 7142, "first_seen_epoch": "1583963206.443306" }, { "bytes": 3971, "stream": 646, "flow_id": "flow-b370c96950c3f049003a0415", "packets": 12, "transport": "tcp", "last_frame": 29775, "first_frame": 29764, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 49908, "responder_port": 88, "initiator_bytes": 1996, "last_seen_epoch": "1583963206.449749", "responder_bytes": 1975, "first_seen_epoch": "1583963206.446878" }, { "bytes": 233, "stream": 416, "flow_id": "flow-5209c14125fef1fc1d5789b4", "packets": 2, "transport": "udp", "last_frame": 29838, "first_frame": 29837, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 56399, "responder_port": 53, "initiator_bytes": 79, "last_seen_epoch": "1583963223.504293", "responder_bytes": 154, "first_seen_epoch": "1583963223.504005" }, { "bytes": 335, "stream": 417, "flow_id": "flow-4885133e0ec69f4ac5faa678", "packets": 3, "transport": "udp", "last_frame": 29846, "first_frame": 29844, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 49660, "responder_port": 53, "initiator_bytes": 180, "last_seen_epoch": "1583963487.731856", "responder_bytes": 155, "first_seen_epoch": "1583963487.664315" }, { "bytes": 8887, "stream": 647, "flow_id": "flow-f5e52c9f93ea931a4ddb99f9", "packets": 22, "transport": "tcp", "last_frame": 29951, "first_frame": 29847, "initiator_ip": "10.3.11.194", "responder_ip": "52.109.88.36", "initiator_port": 50185, "responder_port": 443, "initiator_bytes": 1614, "last_seen_epoch": "1583963597.791841", "responder_bytes": 7273, "first_seen_epoch": "1583963487.7326" }, { "bytes": 7097, "stream": 648, "flow_id": "flow-0699ace1dbe283589aef6919", "packets": 24, "transport": "tcp", "last_frame": 29896, "first_frame": 29873, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 49830, "responder_port": 445, "initiator_bytes": 5009, "last_seen_epoch": "1583963566.942244", "responder_bytes": 2088, "first_seen_epoch": "1583963555.997372" }, { "bytes": 5832, "stream": 649, "flow_id": "flow-3557fbdd466775c02df3618d", "packets": 25, "transport": "tcp", "last_frame": 30007, "first_frame": 29897, "initiator_ip": "10.3.11.218", "responder_ip": "13.78.177.144", "initiator_port": 49831, "responder_port": 443, "initiator_bytes": 1835, "last_seen_epoch": "1583963701.827062", "responder_bytes": 3997, "first_seen_epoch": "1583963577.916726" }, { "bytes": 7663, "stream": 650, "flow_id": "flow-17f9594ee24e3b6dead81fbb", "packets": 27, "transport": "tcp", "last_frame": 29947, "first_frame": 29921, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 50186, "responder_port": 445, "initiator_bytes": 5253, "last_seen_epoch": "1583963592.432488", "responder_bytes": 2410, "first_seen_epoch": "1583963581.6225" }, { "bytes": 7151, "stream": 651, "flow_id": "flow-c750a5d7016144377875cd36", "packets": 25, "transport": "tcp", "last_frame": 29980, "first_frame": 29956, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 49909, "responder_port": 445, "initiator_bytes": 5009, "last_seen_epoch": "1583963624.477268", "responder_bytes": 2142, "first_seen_epoch": "1583963613.609037" }, { "bytes": 5795, "stream": 652, "flow_id": "flow-bd7f04f5157ac325dda0b5a3", "packets": 28, "transport": "tcp", "last_frame": 30035, "first_frame": 29981, "initiator_ip": "10.3.11.218", "responder_ip": "52.161.15.246", "initiator_port": 49833, "responder_port": 443, "initiator_bytes": 1944, "last_seen_epoch": "1583963740.887776", "responder_bytes": 3851, "first_seen_epoch": "1583963646.307836" }, { "bytes": 233, "stream": 418, "flow_id": "flow-7b28420655593844021cc8fe", "packets": 2, "transport": "udp", "last_frame": 30006, "first_frame": 30005, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 64762, "responder_port": 53, "initiator_bytes": 79, "last_seen_epoch": "1583963665.509255", "responder_bytes": 154, "first_seen_epoch": "1583963665.508882" }, { "bytes": 5688, "stream": 653, "flow_id": "flow-dd0577a9bf09dee6af5e59ad", "packets": 26, "transport": "tcp", "last_frame": 30064, "first_frame": 30008, "initiator_ip": "10.3.11.119", "responder_ip": "13.78.187.58", "initiator_port": 49910, "responder_port": 443, "initiator_bytes": 1892, "last_seen_epoch": "1583963797.780461", "responder_bytes": 3796, "first_seen_epoch": "1583963703.235116" }, { "bytes": 233, "stream": 419, "flow_id": "flow-340cc0c50909669b05adaa71", "packets": 2, "transport": "udp", "last_frame": 30031, "first_frame": 30030, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 59701, "responder_port": 53, "initiator_bytes": 79, "last_seen_epoch": "1583963712.230956", "responder_bytes": 154, "first_seen_epoch": "1583963712.230639" }, { "bytes": 5686, "stream": 654, "flow_id": "flow-353fd26deb27295fddb3b289", "packets": 26, "transport": "tcp", "last_frame": 30097, "first_frame": 30036, "initiator_ip": "10.3.11.119", "responder_ip": "52.161.15.246", "initiator_port": 49911, "responder_port": 443, "initiator_bytes": 1890, "last_seen_epoch": "1583963883.692855", "responder_bytes": 3796, "first_seen_epoch": "1583963756.580639" }, { "bytes": 233, "stream": 420, "flow_id": "flow-c992076e45472c5f015faf7f", "packets": 2, "transport": "udp", "last_frame": 30068, "first_frame": 30067, "initiator_ip": "10.3.11.194", "responder_ip": "10.3.11.3", "initiator_port": 59379, "responder_port": 53, "initiator_bytes": 79, "last_seen_epoch": "1583963823.567432", "responder_bytes": 154, "first_seen_epoch": "1583963823.567068" }, { "bytes": 5799, "stream": 655, "flow_id": "flow-3ffc1b796b1b3177806c92ae", "packets": 28, "transport": "tcp", "last_frame": 30103, "first_frame": 30069, "initiator_ip": "10.3.11.218", "responder_ip": "52.161.15.246", "initiator_port": 49838, "responder_port": 443, "initiator_bytes": 1949, "last_seen_epoch": "1583963959.78263", "responder_bytes": 3850, "first_seen_epoch": "1583963837.95491" }, { "bytes": 5638, "stream": 656, "flow_id": "flow-593acde59e1fdff846c22562", "packets": 25, "transport": "tcp", "last_frame": 30194, "first_frame": 30109, "initiator_ip": "10.3.11.119", "responder_ip": "52.161.15.246", "initiator_port": 49912, "responder_port": 443, "initiator_bytes": 1841, "last_seen_epoch": "1583964125.464102", "responder_bytes": 3797, "first_seen_epoch": "1583964000.117303" }, { "bytes": 5634, "stream": 657, "flow_id": "flow-e3f4a9107fd8429efc3dc540", "packets": 25, "transport": "tcp", "last_frame": 30199, "first_frame": 30146, "initiator_ip": "10.3.11.119", "responder_ip": "52.161.15.246", "initiator_port": 49913, "responder_port": 443, "initiator_bytes": 1839, "last_seen_epoch": "1583964219.537211", "responder_bytes": 3795, "first_seen_epoch": "1583964094.948671" }, { "bytes": 5797, "stream": 658, "flow_id": "flow-ee059131870126ace31e76fd", "packets": 28, "transport": "tcp", "last_frame": 30198, "first_frame": 30170, "initiator_ip": "10.3.11.218", "responder_ip": "52.161.15.246", "initiator_port": 49840, "responder_port": 443, "initiator_bytes": 1947, "last_seen_epoch": "1583964180.110884", "responder_bytes": 3850, "first_seen_epoch": "1583964109.335465" }, { "bytes": 5798, "stream": 659, "flow_id": "flow-d7fdb19a0c166712aa08aa76", "packets": 28, "transport": "tcp", "last_frame": 30235, "first_frame": 30200, "initiator_ip": "10.3.11.119", "responder_ip": "52.161.15.246", "initiator_port": 49914, "responder_port": 443, "initiator_bytes": 1949, "last_seen_epoch": "1583964372.959813", "responder_bytes": 3849, "first_seen_epoch": "1583964262.847231" }, { "bytes": 233, "stream": 421, "flow_id": "flow-d27dffd1b6ca157e1fa18bfb", "packets": 2, "transport": "udp", "last_frame": 30225, "first_frame": 30224, "initiator_ip": "10.3.11.218", "responder_ip": "10.3.11.3", "initiator_port": 54061, "responder_port": 53, "initiator_bytes": 79, "last_seen_epoch": "1583964265.574619", "responder_bytes": 154, "first_seen_epoch": "1583964265.574197" }, { "bytes": 233, "stream": 422, "flow_id": "flow-1448f2314b05a61cf779838a", "packets": 2, "transport": "udp", "last_frame": 30227, "first_frame": 30226, "initiator_ip": "10.3.11.119", "responder_ip": "10.3.11.3", "initiator_port": 63731, "responder_port": 53, "initiator_bytes": 79, "last_seen_epoch": "1583964312.292695", "responder_bytes": 154, "first_seen_epoch": "1583964312.292454" } ], "events": { "dns": [ { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.mondogreek.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.3.11.218", "dst_port": 53, "event_id": "evt-328ca6bdc124f3a607fbda89", "src_port": 53532, "tcp_stream": null, "udp_stream": 1, "frame_number": 3, "timestamp_epoch": "1583961755.128744000" }, { "kind": "dns", "dst_ip": "10.3.11.218", "fields": { "dns.a": "10.3.11.3", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.mondogreek.com", "dns.qry.type": "33", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 53532, "event_id": "evt-f54baaa14c92529ef3f58fb0", "src_port": 53, "tcp_stream": null, "udp_stream": 1, "frame_number": 4, "timestamp_epoch": "1583961755.129096000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.DomainDnsZones.mondogreek.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.3.11.218", "dst_port": 53, "event_id": "evt-84617970ffa91bb24097675b", "src_port": 60287, "tcp_stream": null, "udp_stream": 6, "frame_number": 96, "timestamp_epoch": "1583961755.516919000" }, { "kind": "dns", "dst_ip": "10.3.11.218", "fields": { "dns.a": "10.3.11.3", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.DomainDnsZones.mondogreek.com", "dns.qry.type": "33", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 60287, "event_id": "evt-6c0160f2ffb177332eba74c5", "src_port": 53, "tcp_stream": null, "udp_stream": 6, "frame_number": 97, "timestamp_epoch": "1583961755.517270000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.ForestDnsZones.mondogreek.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.3.11.218", "dst_port": 53, "event_id": "evt-0e090c383d36c57d0a992b48", "src_port": 55384, "tcp_stream": null, "udp_stream": 8, "frame_number": 215, "timestamp_epoch": "1583961755.709176000" }, { "kind": "dns", "dst_ip": "10.3.11.218", "fields": { "dns.a": "10.3.11.3", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.ForestDnsZones.mondogreek.com", "dns.qry.type": "33", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 55384, "event_id": "evt-c840ded83c8b91c1b9a53982", "src_port": 53, "tcp_stream": null, "udp_stream": 8, "frame_number": 216, "timestamp_epoch": "1583961755.709448000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.mondogreek.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.3.11.218", "dst_port": 53, "event_id": "evt-f1dcb4bef17bd536959807de", "src_port": 58212, "tcp_stream": null, "udp_stream": 10, "frame_number": 268, "timestamp_epoch": "1583961755.887376000" }, { "kind": "dns", "dst_ip": "10.3.11.218", "fields": { "dns.a": "10.3.11.3", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.mondogreek.com", "dns.qry.type": "33", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 58212, "event_id": "evt-fdf8d8e217247f0ba6e9f6df", "src_port": 53, "tcp_stream": null, "udp_stream": 10, "frame_number": 269, "timestamp_epoch": "1583961755.887604000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "nhfbugwsjf.mondogreek.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.218", "dst_port": 53, "event_id": "evt-db5017fece79cfb6f1b06db8", "src_port": 57365, "tcp_stream": null, "udp_stream": 12, "frame_number": 275, "timestamp_epoch": "1583961755.962222000" }, { "kind": "dns", "dst_ip": "10.3.11.218", "fields": { "dns.qry.name": "nhfbugwsjf.mondogreek.com", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 57365, "event_id": "evt-b62e8e1b3aa9dcf4bd157190", "src_port": 53, "tcp_stream": null, "udp_stream": 12, "frame_number": 276, "timestamp_epoch": "1583961755.962554000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "Mondogreek-DC.mondogreek.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.218", "dst_port": 53, "event_id": "evt-1903037860710051fd289afc", "src_port": 62697, "tcp_stream": null, "udp_stream": 13, "frame_number": 319, "timestamp_epoch": "1583961756.219780000" }, { "kind": "dns", "dst_ip": "10.3.11.218", "fields": { "dns.a": "10.3.11.3", "dns.qry.name": "Mondogreek-DC.mondogreek.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 62697, "event_id": "evt-b7182c81fb14f2bf57284e01", "src_port": 53, "tcp_stream": null, "udp_stream": 13, "frame_number": 320, "timestamp_epoch": "1583961756.220052000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "geo.prod.do.dsp.mp.microsoft.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.218", "dst_port": 53, "event_id": "evt-3639dc8dfc0f4744db1cbd44", "src_port": 63408, "tcp_stream": null, "udp_stream": 15, "frame_number": 525, "timestamp_epoch": "1583961757.819997000" }, { "kind": "dns", "dst_ip": "10.3.11.218", "fields": { "dns.a": "40.69.218.62", "dns.cname": "geo-prod.do.dsp.mp.microsoft.com,geo-prod.dodsp.mp.microsoft.com.nsatc.net,array609-prod.do.dsp.mp.microsoft.com", "dns.qry.name": "geo.prod.do.dsp.mp.microsoft.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 63408, "event_id": "evt-c2ae1e7bcf7fdffbf3b45513", "src_port": 53, "tcp_stream": null, "udp_stream": 15, "frame_number": 526, "timestamp_epoch": "1583961757.840619000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "LAPTOP-I9ZPI04.mondogreek.com", "dns.qry.type": "6", "dns.flags.response": "False" }, "src_ip": "10.3.11.218", "dst_port": 53, "event_id": "evt-37ccb939d5b70f0f58586e3f", "src_port": 53951, "tcp_stream": null, "udp_stream": 16, "frame_number": 545, "timestamp_epoch": "1583961758.337798000" }, { "kind": "dns", "dst_ip": "10.3.11.218", "fields": { "dns.a": "10.3.11.3", "dns.qry.name": "LAPTOP-I9ZPI04.mondogreek.com", "dns.qry.type": "6", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 53951, "event_id": "evt-81c403e4ee0528e832444d59", "src_port": 53, "tcp_stream": null, "udp_stream": 16, "frame_number": 546, "timestamp_epoch": "1583961758.338153000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.a": "10.3.11.218", "dns.qry.name": "mondogreek.com", "dns.qry.type": "6", "dns.flags.response": "False" }, "src_ip": "10.3.11.218", "dst_port": 53, "event_id": "evt-d4d62785f87c570810ac8e72", "src_port": 63258, "tcp_stream": null, "udp_stream": 17, "frame_number": 547, "timestamp_epoch": "1583961758.340596000" }, { "kind": "dns", "dst_ip": "10.3.11.218", "fields": { "dns.a": "10.3.11.218", "dns.qry.name": "mondogreek.com", "dns.qry.type": "6", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 63258, "event_id": "evt-209987542feca46b08e3c588", "src_port": 53, "tcp_stream": null, "udp_stream": 17, "frame_number": 548, "timestamp_epoch": "1583961758.341657000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.mondogreek.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.3.11.218", "dst_port": 53, "event_id": "evt-f61b80ec42c321ad87211ae6", "src_port": 51011, "tcp_stream": null, "udp_stream": 18, "frame_number": 549, "timestamp_epoch": "1583961758.356275000" }, { "kind": "dns", "dst_ip": "10.3.11.218", "fields": { "dns.a": "10.3.11.3", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.mondogreek.com", "dns.qry.type": "33", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 51011, "event_id": "evt-2dbc2242181806ae3b488a92", "src_port": 53, "tcp_stream": null, "udp_stream": 18, "frame_number": 550, "timestamp_epoch": "1583961758.356527000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "kv801.prod.do.dsp.mp.microsoft.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.218", "dst_port": 53, "event_id": "evt-062cb311d8e324b7d416bdba", "src_port": 55478, "tcp_stream": null, "udp_stream": 21, "frame_number": 592, "timestamp_epoch": "1583961758.579463000" }, { "kind": "dns", "dst_ip": "10.3.11.218", "fields": { "dns.a": "23.4.97.247", "dns.cname": "kv801.prod.dodsp.mp.microsoft.com.nsatc.net,kv801.prod.do.dsp.mp.microsoft.com.edgekey.net,e12437.g.akamaiedge.net", "dns.qry.name": "kv801.prod.do.dsp.mp.microsoft.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 55478, "event_id": "evt-0fbc5963b500c1237ec17182", "src_port": 53, "tcp_stream": null, "udp_stream": 21, "frame_number": 604, "timestamp_epoch": "1583961758.615654000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "cp801.prod.do.dsp.mp.microsoft.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.218", "dst_port": 53, "event_id": "evt-13e834dcb1613a66c3d1b839", "src_port": 59815, "tcp_stream": null, "udp_stream": 22, "frame_number": 654, "timestamp_epoch": "1583961758.998718000" }, { "kind": "dns", "dst_ip": "10.3.11.218", "fields": { "dns.a": "23.4.97.247", "dns.cname": "cp801.prod.dodsp.mp.microsoft.com.nsatc.net,cp801.prod.do.dsp.mp.microsoft.com.edgekey.net,e12437.g.akamaiedge.net", "dns.qry.name": "cp801.prod.do.dsp.mp.microsoft.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 59815, "event_id": "evt-109e53ec0f20c5452a745a22", "src_port": 53, "tcp_stream": null, "udp_stream": 22, "frame_number": 657, "timestamp_epoch": "1583961759.040026000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "disc801.prod.do.dsp.mp.microsoft.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.218", "dst_port": 53, "event_id": "evt-c8e696fbe672228d2f554435", "src_port": 62899, "tcp_stream": null, "udp_stream": 24, "frame_number": 679, "timestamp_epoch": "1583961759.292702000" }, { "kind": "dns", "dst_ip": "10.3.11.218", "fields": { "dns.a": "23.4.97.247", "dns.cname": "disc801.prod.dodsp.mp.microsoft.com.nsatc.net,disc801.prod.do.dsp.mp.microsoft.com.edgekey.net,e12437.g.akamaiedge.net", "dns.qry.name": "disc801.prod.do.dsp.mp.microsoft.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 62899, "event_id": "evt-eea13c2071ef1ad4c0c7fcc4", "src_port": 53, "tcp_stream": null, "udp_stream": 24, "frame_number": 683, "timestamp_epoch": "1583961759.326791000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "array801.prod.do.dsp.mp.microsoft.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.218", "dst_port": 53, "event_id": "evt-4b6da34ff3d8d120fe8efc53", "src_port": 55249, "tcp_stream": null, "udp_stream": 25, "frame_number": 752, "timestamp_epoch": "1583961759.710732000" }, { "kind": "dns", "dst_ip": "10.3.11.218", "fields": { "dns.a": "52.161.15.246", "dns.qry.name": "array801.prod.do.dsp.mp.microsoft.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 55249, "event_id": "evt-a5e83613d134f0d284740f20", "src_port": 53, "tcp_stream": null, "udp_stream": 25, "frame_number": 753, "timestamp_epoch": "1583961759.735456000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "array807.prod.do.dsp.mp.microsoft.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.218", "dst_port": 53, "event_id": "evt-3e524ff3fff487b6cf689462", "src_port": 52452, "tcp_stream": null, "udp_stream": 26, "frame_number": 862, "timestamp_epoch": "1583961760.436616000" }, { "kind": "dns", "dst_ip": "10.3.11.218", "fields": { "dns.a": "13.78.177.144", "dns.qry.name": "array807.prod.do.dsp.mp.microsoft.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 52452, "event_id": "evt-c5a58bbdefb6941612c81af8", "src_port": 53, "tcp_stream": null, "udp_stream": 26, "frame_number": 863, "timestamp_epoch": "1583961760.453103000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "self.events.data.microsoft.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.218", "dst_port": 53, "event_id": "evt-f97adae5bb27cc68e47b45f0", "src_port": 57241, "tcp_stream": null, "udp_stream": 28, "frame_number": 1016, "timestamp_epoch": "1583961766.480352000" }, { "kind": "dns", "dst_ip": "10.3.11.218", "fields": { "dns.a": "52.114.77.34", "dns.cname": "global.asimov.events.data.trafficmanager.net,skypedataprdcolneu05.cloudapp.net", "dns.qry.name": "self.events.data.microsoft.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 57241, "event_id": "evt-93389de2bf96cb1c897d0198", "src_port": 53, "tcp_stream": null, "udp_stream": 28, "frame_number": 1019, "timestamp_epoch": "1583961766.602814000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "wpad.mondogreek.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.218", "dst_port": 53, "event_id": "evt-aeca3eb871b1bd634e076a5b", "src_port": 65203, "tcp_stream": null, "udp_stream": 29, "frame_number": 1045, "timestamp_epoch": "1583961769.278542000" }, { "kind": "dns", "dst_ip": "10.3.11.218", "fields": { "dns.qry.name": "wpad.mondogreek.com", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 65203, "event_id": "evt-d69b890e4b974a33cf0f1979", "src_port": 53, "tcp_stream": null, "udp_stream": 29, "frame_number": 1046, "timestamp_epoch": "1583961769.280053000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "_ldap._tcp.dc._msdcs.mondogreek.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": 53, "event_id": "evt-5fad9aee71bd72dd51e8ccf0", "src_port": 52822, "tcp_stream": null, "udp_stream": 33, "frame_number": 1066, "timestamp_epoch": "1583961779.625226000" }, { "kind": "dns", "dst_ip": "10.3.11.194", "fields": { "dns.a": "10.3.11.3", "dns.qry.name": "_ldap._tcp.dc._msdcs.mondogreek.com", "dns.qry.type": "33", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 52822, "event_id": "evt-48b09a465788fe3823cc441c", "src_port": 53, "tcp_stream": null, "udp_stream": 33, "frame_number": 1067, "timestamp_epoch": "1583961779.625644000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "Mondogreek-DC.mondogreek.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": 53, "event_id": "evt-ae69d61862c9ef050aad2330", "src_port": 52164, "tcp_stream": null, "udp_stream": 34, "frame_number": 1068, "timestamp_epoch": "1583961779.658177000" }, { "kind": "dns", "dst_ip": "10.3.11.194", "fields": { "dns.a": "10.3.11.3", "dns.qry.name": "Mondogreek-DC.mondogreek.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 52164, "event_id": "evt-55aed30d74a9e9676caca8e2", "src_port": 53, "tcp_stream": null, "udp_stream": 34, "frame_number": 1069, "timestamp_epoch": "1583961779.658607000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "dns.msftncsi.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": 53, "event_id": "evt-2036b4e106b983f0e5dda000", "src_port": 60382, "tcp_stream": null, "udp_stream": 36, "frame_number": 1079, "timestamp_epoch": "1583961779.925743000" }, { "kind": "dns", "dst_ip": "10.3.11.194", "fields": { "dns.a": "131.107.255.255", "dns.qry.name": "dns.msftncsi.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 60382, "event_id": "evt-15b680955f50adf88e0ca437", "src_port": 53, "tcp_stream": null, "udp_stream": 36, "frame_number": 1080, "timestamp_epoch": "1583961779.950820000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "wpad.mondogreek.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": 53, "event_id": "evt-69a513b8889272fe5d33c783", "src_port": 54129, "tcp_stream": null, "udp_stream": 37, "frame_number": 1081, "timestamp_epoch": "1583961780.297336000" }, { "kind": "dns", "dst_ip": "10.3.11.194", "fields": { "dns.qry.name": "wpad.mondogreek.com", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 54129, "event_id": "evt-94f3a12503128813d3580e73", "src_port": 53, "tcp_stream": null, "udp_stream": 37, "frame_number": 1082, "timestamp_epoch": "1583961780.297613000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.mondogreek.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": 53, "event_id": "evt-a5d3e88ae4069de036d8037c", "src_port": 56441, "tcp_stream": null, "udp_stream": 41, "frame_number": 1092, "timestamp_epoch": "1583961780.815447000" }, { "kind": "dns", "dst_ip": "10.3.11.194", "fields": { "dns.a": "10.3.11.3", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.mondogreek.com", "dns.qry.type": "33", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 56441, "event_id": "evt-824d801a55abe8fb9790bbf4", "src_port": 53, "tcp_stream": null, "udp_stream": 41, "frame_number": 1093, "timestamp_epoch": "1583961780.815765000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "_kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.mondogreek.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": 53, "event_id": "evt-a4c05cd44a3f40f1d1a87f40", "src_port": 50240, "tcp_stream": null, "udp_stream": 45, "frame_number": 1099, "timestamp_epoch": "1583961781.054072000" }, { "kind": "dns", "dst_ip": "10.3.11.194", "fields": { "dns.a": "10.3.11.3", "dns.qry.name": "_kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.mondogreek.com", "dns.qry.type": "33", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 50240, "event_id": "evt-dc31c734cf3c006b216fc951", "src_port": 53, "tcp_stream": null, "udp_stream": 45, "frame_number": 1101, "timestamp_epoch": "1583961781.054298000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.DomainDnsZones.mondogreek.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": 53, "event_id": "evt-c43d1787f06cc30fbcf84a3a", "src_port": 60748, "tcp_stream": null, "udp_stream": 47, "frame_number": 1251, "timestamp_epoch": "1583961781.270958000" }, { "kind": "dns", "dst_ip": "10.3.11.194", "fields": { "dns.a": "10.3.11.3", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.DomainDnsZones.mondogreek.com", "dns.qry.type": "33", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 60748, "event_id": "evt-2b33f3bd9586631930331c2c", "src_port": 53, "tcp_stream": null, "udp_stream": 47, "frame_number": 1252, "timestamp_epoch": "1583961781.271226000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.ForestDnsZones.mondogreek.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": 53, "event_id": "evt-787eca673af829a1a8265aa3", "src_port": 65008, "tcp_stream": null, "udp_stream": 49, "frame_number": 1270, "timestamp_epoch": "1583961781.422370000" }, { "kind": "dns", "dst_ip": "10.3.11.194", "fields": { "dns.a": "10.3.11.3", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.ForestDnsZones.mondogreek.com", "dns.qry.type": "33", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 65008, "event_id": "evt-0d3018cb1c0ed7ad8e7aad05", "src_port": 53, "tcp_stream": null, "udp_stream": 49, "frame_number": 1271, "timestamp_epoch": "1583961781.422599000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "vzxmvhjnnsazsyw.mondogreek.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": 53, "event_id": "evt-a648ee9eb7e9d242321f9455", "src_port": 64541, "tcp_stream": null, "udp_stream": 50, "frame_number": 1272, "timestamp_epoch": "1583961781.432375000" }, { "kind": "dns", "dst_ip": "10.3.11.194", "fields": { "dns.qry.name": "vzxmvhjnnsazsyw.mondogreek.com", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 64541, "event_id": "evt-83706fd407bc96729e4c2d2d", "src_port": 53, "tcp_stream": null, "udp_stream": 50, "frame_number": 1273, "timestamp_epoch": "1583961781.432752000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.mondogreek.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": 53, "event_id": "evt-4d312a43d8f41d845cda44dc", "src_port": 52588, "tcp_stream": null, "udp_stream": 52, "frame_number": 1332, "timestamp_epoch": "1583961781.592695000" }, { "kind": "dns", "dst_ip": "10.3.11.194", "fields": { "dns.a": "10.3.11.3", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.mondogreek.com", "dns.qry.type": "33", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 52588, "event_id": "evt-c5a3d6672c6ff22e7a494889", "src_port": 53, "tcp_stream": null, "udp_stream": 52, "frame_number": 1333, "timestamp_epoch": "1583961781.592936000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "Mondogreek-DC.mondogreek.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": 53, "event_id": "evt-43da7756c1c5785f971faae3", "src_port": 53850, "tcp_stream": null, "udp_stream": 54, "frame_number": 1378, "timestamp_epoch": "1583961781.878568000" }, { "kind": "dns", "dst_ip": "10.3.11.194", "fields": { "dns.a": "10.3.11.3", "dns.qry.name": "Mondogreek-DC.mondogreek.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 53850, "event_id": "evt-ba3eee0ceb540b346bf0b1ad", "src_port": 53, "tcp_stream": null, "udp_stream": 54, "frame_number": 1379, "timestamp_epoch": "1583961781.878882000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "MONDOGREEK.COM", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.218", "dst_port": 53, "event_id": "evt-ccd408c717f810aaddf74c2c", "src_port": 64680, "tcp_stream": null, "udp_stream": 55, "frame_number": 1620, "timestamp_epoch": "1583961783.463628000" }, { "kind": "dns", "dst_ip": "10.3.11.218", "fields": { "dns.a": "10.3.11.3", "dns.qry.name": "MONDOGREEK.COM", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 64680, "event_id": "evt-41a53c0937a576055aca29c1", "src_port": 53, "tcp_stream": null, "udp_stream": 55, "frame_number": 1621, "timestamp_epoch": "1583961783.464014000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "LAPTOP-7XMV2SN.mondogreek.com", "dns.qry.type": "6", "dns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": 53, "event_id": "evt-97422a0a3efa00fd3935102d", "src_port": 56522, "tcp_stream": null, "udp_stream": 56, "frame_number": 1788, "timestamp_epoch": "1583961783.982644000" }, { "kind": "dns", "dst_ip": "10.3.11.194", "fields": { "dns.a": "10.3.11.3", "dns.qry.name": "LAPTOP-7XMV2SN.mondogreek.com", "dns.qry.type": "6", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 56522, "event_id": "evt-58e4d0cc854d94130a93ff5b", "src_port": 53, "tcp_stream": null, "udp_stream": 56, "frame_number": 1789, "timestamp_epoch": "1583961783.982972000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.a": "10.3.11.194", "dns.qry.name": "mondogreek.com", "dns.qry.type": "6", "dns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": 53, "event_id": "evt-ce3e687f9bd544860d7d76ad", "src_port": 59179, "tcp_stream": null, "udp_stream": 57, "frame_number": 1790, "timestamp_epoch": "1583961783.985573000" }, { "kind": "dns", "dst_ip": "10.3.11.194", "fields": { "dns.a": "10.3.11.194", "dns.qry.name": "mondogreek.com", "dns.qry.type": "6", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 59179, "event_id": "evt-fbfc85651e5f6d6cada86a47", "src_port": 53, "tcp_stream": null, "udp_stream": 57, "frame_number": 1791, "timestamp_epoch": "1583961783.986755000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.218", "dst_port": 53, "event_id": "evt-8ccb41c8b0ea07996c435345", "src_port": 56564, "tcp_stream": null, "udp_stream": 59, "frame_number": 1801, "timestamp_epoch": "1583961788.617428000" }, { "kind": "dns", "dst_ip": "10.3.11.218", "fields": { "dns.a": "204.79.197.200,13.107.21.200", "dns.cname": "a-0001.a-afdentry.net.trafficmanager.net,dual-a-0001.a-msedge.net", "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 56564, "event_id": "evt-fd13f9824fc57b31c8f749a4", "src_port": 53, "tcp_stream": null, "udp_stream": 59, "frame_number": 1802, "timestamp_epoch": "1583961788.662452000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "fp-as.azureedge.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.218", "dst_port": 53, "event_id": "evt-c568080b15264b9d3ca60e10", "src_port": 62694, "tcp_stream": null, "udp_stream": 61, "frame_number": 1819, "timestamp_epoch": "1583961789.054029000" }, { "kind": "dns", "dst_ip": "10.3.11.218", "fields": { "dns.a": "23.46.28.16,23.46.28.24", "dns.cname": "fp-as.akstd.azureedge.net,azureedge.mdc.akamaized.net,a1879.dscw14.akamai.net", "dns.qry.name": "fp-as.azureedge.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 62694, "event_id": "evt-a1310f23ee4bcd4a9ebb5e8a", "src_port": 53, "tcp_stream": null, "udp_stream": 61, "frame_number": 1820, "timestamp_epoch": "1583961789.088257000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "a-ring.msedge.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.218", "dst_port": 53, "event_id": "evt-a43660350147a28f7ba4272a", "src_port": 51624, "tcp_stream": null, "udp_stream": 62, "frame_number": 1832, "timestamp_epoch": "1583961789.140910000" }, { "kind": "dns", "dst_ip": "10.3.11.218", "fields": { "dns.a": "204.79.197.254", "dns.cname": "a-ring.a-9999.a-msedge.net,a-9999.a-msedge.net", "dns.qry.name": "a-ring.msedge.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 51624, "event_id": "evt-eb57500f94d2d48c64caa36d", "src_port": 53, "tcp_stream": null, "udp_stream": 62, "frame_number": 1838, "timestamp_epoch": "1583961789.154954000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "k-ring.msedge.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.218", "dst_port": 53, "event_id": "evt-525ea83ff3a9c028bbfcfacc", "src_port": 53199, "tcp_stream": null, "udp_stream": 63, "frame_number": 1850, "timestamp_epoch": "1583961789.179554000" }, { "kind": "dns", "dst_ip": "10.3.11.218", "fields": { "dns.a": "13.107.18.254", "dns.cname": "k-ring.k-9999.k-msedge.net,k-9999.k-msedge.net", "dns.qry.name": "k-ring.msedge.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 53199, "event_id": "evt-9a372505aada3ea114f23510", "src_port": 53, "tcp_stream": null, "udp_stream": 63, "frame_number": 1860, "timestamp_epoch": "1583961789.191783000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "fp-afd.azureedge.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.218", "dst_port": 53, "event_id": "evt-87b909f64d6c3a0b38490027", "src_port": 58349, "tcp_stream": null, "udp_stream": 64, "frame_number": 1862, "timestamp_epoch": "1583961789.198151000" }, { "kind": "dns", "dst_ip": "10.3.11.218", "fields": { "dns.a": "13.107.246.10", "dns.cname": "fp-afd.afd.azureedge.net,afd.t-0001.t-msedge.net,t-0001.t-msedge.net,Edge-Prod-DALr3.ctrl.t-0001.t-msedge.net,standard.t-0001.t-msedge.net", "dns.qry.name": "fp-afd.azureedge.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 58349, "event_id": "evt-9d1c5ecb721dc4b81c57b6b4", "src_port": 53, "tcp_stream": null, "udp_stream": 64, "frame_number": 1867, "timestamp_epoch": "1583961789.224967000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "7754def074cd4b67fe16c8cfdb10e874.clo.footprintdns.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.218", "dst_port": 53, "event_id": "evt-5c72c09037ce437d0d04de06", "src_port": 53241, "tcp_stream": null, "udp_stream": 65, "frame_number": 1868, "timestamp_epoch": "1583961789.225566000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "3750657afd7bdc4d4398b8849268b8a3.nrb.footprintdns.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.218", "dst_port": 53, "event_id": "evt-bb8662ad27917d23c4b9ff24", "src_port": 56313, "tcp_stream": null, "udp_stream": 66, "frame_number": 1876, "timestamp_epoch": "1583961789.240565000" }, { "kind": "dns", "dst_ip": "10.3.11.218", "fields": { "dns.a": "204.79.197.222", "dns.cname": "1.perf.msedge.net,a-0019.a-msedge.net", "dns.qry.name": "7754def074cd4b67fe16c8cfdb10e874.clo.footprintdns.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 53241, "event_id": "evt-35c18f369b701e096401a733", "src_port": 53, "tcp_stream": null, "udp_stream": 65, "frame_number": 1888, "timestamp_epoch": "1583961789.266116000" }, { "kind": "dns", "dst_ip": "10.3.11.218", "fields": { "dns.a": "52.98.73.226,52.98.73.210,40.100.155.2,40.100.155.18,52.98.81.2,52.98.73.242,52.98.77.66,52.98.93.2,52.98.80.210,52.98.81.178,52.98.77.82", "dns.cname": "itm-efz.office.com", "dns.qry.name": "3750657afd7bdc4d4398b8849268b8a3.nrb.footprintdns.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 56313, "event_id": "evt-413119151a4d9475641e19c7", "src_port": 53, "tcp_stream": null, "udp_stream": 66, "frame_number": 1898, "timestamp_epoch": "1583961789.286717000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "self.events.data.microsoft.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": 53, "event_id": "evt-7fb3d42ec0b18df6ccc999aa", "src_port": 50966, "tcp_stream": null, "udp_stream": 69, "frame_number": 2019, "timestamp_epoch": "1583961792.678223000" }, { "kind": "dns", "dst_ip": "10.3.11.194", "fields": { "dns.a": "52.114.77.34", "dns.cname": "global.asimov.events.data.trafficmanager.net,skypedataprdcolneu05.cloudapp.net", "dns.qry.name": "self.events.data.microsoft.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 50966, "event_id": "evt-f3253f3d5d82d59259235c38", "src_port": 53, "tcp_stream": null, "udp_stream": 69, "frame_number": 2020, "timestamp_epoch": "1583961792.706361000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "wpad.mondogreek.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": 53, "event_id": "evt-c3ac1a312ed0a1c72537a997", "src_port": 53857, "tcp_stream": null, "udp_stream": 70, "frame_number": 2058, "timestamp_epoch": "1583961795.313560000" }, { "kind": "dns", "dst_ip": "10.3.11.194", "fields": { "dns.qry.name": "wpad.mondogreek.com", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 53857, "event_id": "evt-3d1e402a7db833520425de5c", "src_port": 53, "tcp_stream": null, "udp_stream": 70, "frame_number": 2059, "timestamp_epoch": "1583961795.313901000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "MONDOGREEK.COM", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": 53, "event_id": "evt-b1d9e588f13a35fd9edf308f", "src_port": 65025, "tcp_stream": null, "udp_stream": 72, "frame_number": 2129, "timestamp_epoch": "1583961800.970926000" }, { "kind": "dns", "dst_ip": "10.3.11.194", "fields": { "dns.a": "10.3.11.3", "dns.qry.name": "MONDOGREEK.COM", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 65025, "event_id": "evt-fcc928578ab2e710f17f2c92", "src_port": 53, "tcp_stream": null, "udp_stream": 72, "frame_number": 2131, "timestamp_epoch": "1583961800.971143000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": 53, "event_id": "evt-2637c9679040fbdd27fc43d9", "src_port": 57213, "tcp_stream": null, "udp_stream": 73, "frame_number": 2280, "timestamp_epoch": "1583961806.049201000" }, { "kind": "dns", "dst_ip": "10.3.11.194", "fields": { "dns.a": "13.107.21.200,204.79.197.200", "dns.cname": "a-0001.a-afdentry.net.trafficmanager.net,dual-a-0001.a-msedge.net", "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 57213, "event_id": "evt-e3ce0e5b9050b2c8abf82c98", "src_port": 53, "tcp_stream": null, "udp_stream": 73, "frame_number": 2281, "timestamp_epoch": "1583961806.049603000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "l-ring.msedge.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": 53, "event_id": "evt-8fef3a44cde69c8ff54e2ba2", "src_port": 57694, "tcp_stream": null, "udp_stream": 74, "frame_number": 2287, "timestamp_epoch": "1583961806.215464000" }, { "kind": "dns", "dst_ip": "10.3.11.194", "fields": { "dns.a": "13.107.42.254", "dns.cname": "l-ring.l-9999.l-msedge.net,l-9999.l-msedge.net", "dns.qry.name": "l-ring.msedge.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 57694, "event_id": "evt-67369579046cd4e65b066daf", "src_port": 53, "tcp_stream": null, "udp_stream": 74, "frame_number": 2295, "timestamp_epoch": "1583961806.240830000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "s-ring.msedge.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": 53, "event_id": "evt-c7d5c5abbe615a4aa78175a4", "src_port": 63379, "tcp_stream": null, "udp_stream": 75, "frame_number": 2326, "timestamp_epoch": "1583961806.398703000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "tring.clo.footprintdns.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": 53, "event_id": "evt-91affec0ec352a05690d58fc", "src_port": 51357, "tcp_stream": null, "udp_stream": 76, "frame_number": 2327, "timestamp_epoch": "1583961806.401801000" }, { "kind": "dns", "dst_ip": "10.3.11.194", "fields": { "dns.a": "13.107.3.254", "dns.cname": "s-ring.s-9999.s-msedge.net,s-9999.s-msedge.net", "dns.qry.name": "s-ring.msedge.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 63379, "event_id": "evt-b67957571ed91e7f1468aa49", "src_port": 53, "tcp_stream": null, "udp_stream": 75, "frame_number": 2328, "timestamp_epoch": "1583961806.430849000" }, { "kind": "dns", "dst_ip": "10.3.11.194", "fields": { "dns.a": "13.107.246.254", "dns.cname": "t-ring.msedge.net,t-ring.t-9999.t-msedge.net,t-9999.t-msedge.net", "dns.qry.name": "tring.clo.footprintdns.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 51357, "event_id": "evt-eaf11199d7044e6fd1fcabbf", "src_port": 53, "tcp_stream": null, "udp_stream": 76, "frame_number": 2329, "timestamp_epoch": "1583961806.431111000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "b-ring.msedge.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": 53, "event_id": "evt-95e08c1519093c8b2c6c429e", "src_port": 56652, "tcp_stream": null, "udp_stream": 77, "frame_number": 2334, "timestamp_epoch": "1583961806.477891000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "rum18.perf.linkedin.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": 53, "event_id": "evt-381f946e2dae157598f51f83", "src_port": 57780, "tcp_stream": null, "udp_stream": 78, "frame_number": 2335, "timestamp_epoch": "1583961806.486979000" }, { "kind": "dns", "dst_ip": "10.3.11.194", "fields": { "dns.a": "13.107.6.254", "dns.cname": "b-ring.b-9999.b-msedge.net,b-9999.b-msedge.net", "dns.qry.name": "b-ring.msedge.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 56652, "event_id": "evt-f81c26af26dec67ff5d5ea06", "src_port": 53, "tcp_stream": null, "udp_stream": 77, "frame_number": 2336, "timestamp_epoch": "1583961806.493595000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "t-ring.msedge.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": 53, "event_id": "evt-0a0ee7be608443ec18aa6cc4", "src_port": 55911, "tcp_stream": null, "udp_stream": 79, "frame_number": 2338, "timestamp_epoch": "1583961806.505691000" }, { "kind": "dns", "dst_ip": "10.3.11.194", "fields": { "dns.a": "13.107.246.254", "dns.cname": "t-ring.t-9999.t-msedge.net,t-9999.t-msedge.net", "dns.qry.name": "t-ring.msedge.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 55911, "event_id": "evt-6716ce2362d6db39f4316b96", "src_port": 53, "tcp_stream": null, "udp_stream": 79, "frame_number": 2339, "timestamp_epoch": "1583961806.506259000" }, { "kind": "dns", "dst_ip": "10.3.11.194", "fields": { "dns.a": "13.107.43.14", "dns.cname": "l-0005.dc-msedge.net", "dns.qry.name": "rum18.perf.linkedin.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 57780, "event_id": "evt-4ebcab3a55559f34cf64e9a0", "src_port": 53, "tcp_stream": null, "udp_stream": 78, "frame_number": 2340, "timestamp_epoch": "1583961806.507845000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "_ldap._tcp.dc._msdcs.mondogreek.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-8953d8e062fa148be74e8fe7", "src_port": 52072, "tcp_stream": null, "udp_stream": 81, "frame_number": 2484, "timestamp_epoch": "1583961810.892584000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "10.3.11.3", "dns.qry.name": "_ldap._tcp.dc._msdcs.mondogreek.com", "dns.qry.type": "33", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 52072, "event_id": "evt-99b8ec27472b62f90c60f142", "src_port": 53, "tcp_stream": null, "udp_stream": 81, "frame_number": 2485, "timestamp_epoch": "1583961810.892861000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "Mondogreek-DC.mondogreek.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-82598838c7dc4599506c28e0", "src_port": 53653, "tcp_stream": null, "udp_stream": 82, "frame_number": 2486, "timestamp_epoch": "1583961810.918613000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "10.3.11.3", "dns.qry.name": "Mondogreek-DC.mondogreek.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 53653, "event_id": "evt-56ff7db70d29a82b6f186ae4", "src_port": 53, "tcp_stream": null, "udp_stream": 82, "frame_number": 2487, "timestamp_epoch": "1583961810.919308000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "dns.msftncsi.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-31807c8569b95c21b7a5c35c", "src_port": 55940, "tcp_stream": null, "udp_stream": 84, "frame_number": 2497, "timestamp_epoch": "1583961811.168733000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "131.107.255.255", "dns.qry.name": "dns.msftncsi.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 55940, "event_id": "evt-fcbceb6dd2b5a96141c3e659", "src_port": 53, "tcp_stream": null, "udp_stream": 84, "frame_number": 2498, "timestamp_epoch": "1583961811.185698000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "wpad.mondogreek.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-fb7e588f957162575162c676", "src_port": 59772, "tcp_stream": null, "udp_stream": 85, "frame_number": 2499, "timestamp_epoch": "1583961811.509917000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.qry.name": "wpad.mondogreek.com", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 59772, "event_id": "evt-a85ad366c4eb764ac9bfe4da", "src_port": 53, "tcp_stream": null, "udp_stream": 85, "frame_number": 2500, "timestamp_epoch": "1583961811.510192000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.mondogreek.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-c39197a26c08382fb566e9d3", "src_port": 60273, "tcp_stream": null, "udp_stream": 89, "frame_number": 2526, "timestamp_epoch": "1583961812.561544000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "10.3.11.3", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.mondogreek.com", "dns.qry.type": "33", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 60273, "event_id": "evt-1b6bb6677902674dd58bef4a", "src_port": 53, "tcp_stream": null, "udp_stream": 89, "frame_number": 2527, "timestamp_epoch": "1583961812.561843000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.DomainDnsZones.mondogreek.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-d4d49d6b626d93ef98224d6e", "src_port": 57031, "tcp_stream": null, "udp_stream": 94, "frame_number": 2659, "timestamp_epoch": "1583961813.164158000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "10.3.11.3", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.DomainDnsZones.mondogreek.com", "dns.qry.type": "33", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 57031, "event_id": "evt-caee2ff009f36959e99757eb", "src_port": 53, "tcp_stream": null, "udp_stream": 94, "frame_number": 2660, "timestamp_epoch": "1583961813.164338000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "kcvsmarszhnhqdd.mondogreek.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-da716f3b7d80f39e5baba89a", "src_port": 63995, "tcp_stream": null, "udp_stream": 96, "frame_number": 2684, "timestamp_epoch": "1583961813.264054000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.qry.name": "kcvsmarszhnhqdd.mondogreek.com", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 63995, "event_id": "evt-0e9b5dca83e7840f101d2d86", "src_port": 53, "tcp_stream": null, "udp_stream": 96, "frame_number": 2685, "timestamp_epoch": "1583961813.264308000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.ForestDnsZones.mondogreek.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-2c79f081d469245fef3ca68b", "src_port": 53008, "tcp_stream": null, "udp_stream": 97, "frame_number": 2694, "timestamp_epoch": "1583961813.296328000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "10.3.11.3", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.ForestDnsZones.mondogreek.com", "dns.qry.type": "33", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 53008, "event_id": "evt-8d53de0554da4fc80995643f", "src_port": 53, "tcp_stream": null, "udp_stream": 97, "frame_number": 2695, "timestamp_epoch": "1583961813.296594000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.mondogreek.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-d2a3fdc3fdfe5a143850dd31", "src_port": 56717, "tcp_stream": null, "udp_stream": 99, "frame_number": 2747, "timestamp_epoch": "1583961813.453095000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "10.3.11.3", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.mondogreek.com", "dns.qry.type": "33", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 56717, "event_id": "evt-c3e673b19a1e932a82089ee5", "src_port": 53, "tcp_stream": null, "udp_stream": 99, "frame_number": 2748, "timestamp_epoch": "1583961813.453322000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "Mondogreek-DC.mondogreek.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-47cccb6bbcc90421d8c55727", "src_port": 49548, "tcp_stream": null, "udp_stream": 101, "frame_number": 2808, "timestamp_epoch": "1583961813.765796000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "10.3.11.3", "dns.qry.name": "Mondogreek-DC.mondogreek.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 49548, "event_id": "evt-6796fe87d07b967387b9c88e", "src_port": 53, "tcp_stream": null, "udp_stream": 101, "frame_number": 2809, "timestamp_epoch": "1583961813.766099000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "geo.prod.do.dsp.mp.microsoft.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-63416d42e9be2d2948f061eb", "src_port": 56275, "tcp_stream": null, "udp_stream": 102, "frame_number": 3006, "timestamp_epoch": "1583961815.246867000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "40.69.218.62", "dns.cname": "geo-prod.do.dsp.mp.microsoft.com,geo-prod.dodsp.mp.microsoft.com.nsatc.net,array609-prod.do.dsp.mp.microsoft.com", "dns.qry.name": "geo.prod.do.dsp.mp.microsoft.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 56275, "event_id": "evt-3113e058d8e21b71502e1398", "src_port": 53, "tcp_stream": null, "udp_stream": 102, "frame_number": 3007, "timestamp_epoch": "1583961815.247099000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "LAPTOP-SQSA42O.mondogreek.com", "dns.qry.type": "6", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-1fb2f022f0c5251cb6be62e1", "src_port": 58179, "tcp_stream": null, "udp_stream": 103, "frame_number": 3013, "timestamp_epoch": "1583961815.419746000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "10.3.11.3", "dns.qry.name": "LAPTOP-SQSA42O.mondogreek.com", "dns.qry.type": "6", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 58179, "event_id": "evt-d3569df1d63b93383d49b120", "src_port": 53, "tcp_stream": null, "udp_stream": 103, "frame_number": 3014, "timestamp_epoch": "1583961815.419961000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.a": "10.3.11.119", "dns.qry.name": "mondogreek.com", "dns.qry.type": "6", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-c6a68e06b3bbc45090c9d8d3", "src_port": 57585, "tcp_stream": null, "udp_stream": 104, "frame_number": 3015, "timestamp_epoch": "1583961815.424012000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "10.3.11.119", "dns.qry.name": "mondogreek.com", "dns.qry.type": "6", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 57585, "event_id": "evt-ca6b2cefa41b925c5c4201a7", "src_port": 53, "tcp_stream": null, "udp_stream": 104, "frame_number": 3016, "timestamp_epoch": "1583961815.424999000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.mondogreek.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-f1793e6750a087f32f2aae6c", "src_port": 64568, "tcp_stream": null, "udp_stream": 105, "frame_number": 3022, "timestamp_epoch": "1583961815.687068000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "10.3.11.3", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.mondogreek.com", "dns.qry.type": "33", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 64568, "event_id": "evt-d8fed07a789f54ef8023ae1e", "src_port": 53, "tcp_stream": null, "udp_stream": 105, "frame_number": 3023, "timestamp_epoch": "1583961815.687343000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "kv801.prod.do.dsp.mp.microsoft.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-b352b7e0dba6c352b38e8b07", "src_port": 52371, "tcp_stream": null, "udp_stream": 108, "frame_number": 3115, "timestamp_epoch": "1583961816.001111000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "23.4.97.247", "dns.cname": "kv801.prod.dodsp.mp.microsoft.com.nsatc.net,kv801.prod.do.dsp.mp.microsoft.com.edgekey.net,e12437.g.akamaiedge.net", "dns.qry.name": "kv801.prod.do.dsp.mp.microsoft.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 52371, "event_id": "evt-24e05b8c8d7dd59054877491", "src_port": 53, "tcp_stream": null, "udp_stream": 108, "frame_number": 3116, "timestamp_epoch": "1583961816.043339000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "nexusrules.officeapps.live.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.218", "dst_port": 53, "event_id": "evt-7c2f0992026bc80e116f14b7", "src_port": 52029, "tcp_stream": null, "udp_stream": 110, "frame_number": 3121, "timestamp_epoch": "1583961816.717826000" }, { "kind": "dns", "dst_ip": "10.3.11.218", "fields": { "dns.a": "52.109.12.19", "dns.cname": "prod.nexusrules.live.com.akadns.net", "dns.qry.name": "nexusrules.officeapps.live.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 52029, "event_id": "evt-6def2f01c2bb44b0d58a3ea7", "src_port": 53, "tcp_stream": null, "udp_stream": 110, "frame_number": 3122, "timestamp_epoch": "1583961816.742544000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "cp801.prod.do.dsp.mp.microsoft.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-d87c9eb5c768a81a8a749a1b", "src_port": 57740, "tcp_stream": null, "udp_stream": 111, "frame_number": 3162, "timestamp_epoch": "1583961817.237735000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "23.4.97.247", "dns.cname": "cp801.prod.dodsp.mp.microsoft.com.nsatc.net,cp801.prod.do.dsp.mp.microsoft.com.edgekey.net,e12437.g.akamaiedge.net", "dns.qry.name": "cp801.prod.do.dsp.mp.microsoft.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 57740, "event_id": "evt-6223dbcf365abbcc8af63cbd", "src_port": 53, "tcp_stream": null, "udp_stream": 111, "frame_number": 3163, "timestamp_epoch": "1583961817.238134000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "disc801.prod.do.dsp.mp.microsoft.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-4dd462a82d27044a7d1605ad", "src_port": 53718, "tcp_stream": null, "udp_stream": 112, "frame_number": 3186, "timestamp_epoch": "1583961817.390295000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "23.4.97.247", "dns.cname": "disc801.prod.dodsp.mp.microsoft.com.nsatc.net,disc801.prod.do.dsp.mp.microsoft.com.edgekey.net,e12437.g.akamaiedge.net", "dns.qry.name": "disc801.prod.do.dsp.mp.microsoft.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 53718, "event_id": "evt-82f20b022113d99d74366d70", "src_port": 53, "tcp_stream": null, "udp_stream": 112, "frame_number": 3187, "timestamp_epoch": "1583961817.390606000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "array801.prod.do.dsp.mp.microsoft.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-c51190830ab8e5553abccc6b", "src_port": 58678, "tcp_stream": null, "udp_stream": 113, "frame_number": 3230, "timestamp_epoch": "1583961817.509957000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "52.161.15.246", "dns.qry.name": "array801.prod.do.dsp.mp.microsoft.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 58678, "event_id": "evt-72d7ca3248a151153085b7af", "src_port": 53, "tcp_stream": null, "udp_stream": 113, "frame_number": 3231, "timestamp_epoch": "1583961817.510251000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "array802.prod.do.dsp.mp.microsoft.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-b3d418ccfefea38ccf880b6e", "src_port": 65093, "tcp_stream": null, "udp_stream": 114, "frame_number": 3299, "timestamp_epoch": "1583961817.708162000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "13.78.187.58", "dns.qry.name": "array802.prod.do.dsp.mp.microsoft.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 65093, "event_id": "evt-489c70b0dfdaf882259377b6", "src_port": 53, "tcp_stream": null, "udp_stream": 114, "frame_number": 3304, "timestamp_epoch": "1583961817.728584000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "array803.prod.do.dsp.mp.microsoft.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-8aa9ab86321dbdc9dd498740", "src_port": 49765, "tcp_stream": null, "udp_stream": 115, "frame_number": 3503, "timestamp_epoch": "1583961818.470160000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "13.78.186.254", "dns.qry.name": "array803.prod.do.dsp.mp.microsoft.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 49765, "event_id": "evt-12bb8f12662d9c955233cd12", "src_port": 53, "tcp_stream": null, "udp_stream": 115, "frame_number": 3512, "timestamp_epoch": "1583961818.499999000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "settings-win.data.microsoft.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.218", "dst_port": 53, "event_id": "evt-f502320570a99d9923de715d", "src_port": 49527, "tcp_stream": null, "udp_stream": 117, "frame_number": 3698, "timestamp_epoch": "1583961823.738973000" }, { "kind": "dns", "dst_ip": "10.3.11.218", "fields": { "dns.a": "40.119.2.214", "dns.cname": "settingsfd-geo.trafficmanager.net", "dns.qry.name": "settings-win.data.microsoft.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 49527, "event_id": "evt-f464f7183b5a9ebacece8d24", "src_port": 53, "tcp_stream": null, "udp_stream": 117, "frame_number": 3699, "timestamp_epoch": "1583961823.771503000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "self.events.data.microsoft.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-e64647f54c8240cec1b40650", "src_port": 64687, "tcp_stream": null, "udp_stream": 118, "frame_number": 3705, "timestamp_epoch": "1583961823.973236000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "52.114.132.73", "dns.cname": "global.asimov.events.data.trafficmanager.net,skypedataprdcoleus04.cloudapp.net", "dns.qry.name": "self.events.data.microsoft.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 64687, "event_id": "evt-c9bb076d0732dbe29c706a60", "src_port": 53, "tcp_stream": null, "udp_stream": 118, "frame_number": 3706, "timestamp_epoch": "1583961824.002810000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "wpad.mondogreek.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-eded04336bf56d91b53c23b8", "src_port": 52163, "tcp_stream": null, "udp_stream": 119, "frame_number": 3763, "timestamp_epoch": "1583961826.576626000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.qry.name": "wpad.mondogreek.com", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 52163, "event_id": "evt-f66ed4af78250f62486907e9", "src_port": 53, "tcp_stream": null, "udp_stream": 119, "frame_number": 3764, "timestamp_epoch": "1583961826.576920000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "wpad.mondogreek.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.218", "dst_port": 53, "event_id": "evt-649fc6b92f340fb9c57c5c0c", "src_port": 53338, "tcp_stream": null, "udp_stream": 120, "frame_number": 3767, "timestamp_epoch": "1583961829.279283000" }, { "kind": "dns", "dst_ip": "10.3.11.218", "fields": { "dns.qry.name": "wpad.mondogreek.com", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 53338, "event_id": "evt-2555cb538505ff8a71ed8e6c", "src_port": 53, "tcp_stream": null, "udp_stream": 120, "frame_number": 3768, "timestamp_epoch": "1583961829.279628000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "MONDOGREEK.COM", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-5cfd61af5f3f8bcbf9748eae", "src_port": 57361, "tcp_stream": null, "udp_stream": 121, "frame_number": 3825, "timestamp_epoch": "1583961831.476016000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "10.3.11.3", "dns.qry.name": "MONDOGREEK.COM", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 57361, "event_id": "evt-c67820875d8fa9adc29eb615", "src_port": 53, "tcp_stream": null, "udp_stream": 121, "frame_number": 3827, "timestamp_epoch": "1583961831.476298000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.218", "dst_port": 53, "event_id": "evt-a105d1686bb187887accf546", "src_port": 64690, "tcp_stream": null, "udp_stream": 122, "frame_number": 3979, "timestamp_epoch": "1583961832.890108000" }, { "kind": "dns", "dst_ip": "10.3.11.218", "fields": { "dns.a": "204.79.197.200,13.107.21.200", "dns.cname": "a-0001.a-afdentry.net.trafficmanager.net,dual-a-0001.a-msedge.net", "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 64690, "event_id": "evt-aba515aebdb4d9082301a152", "src_port": 53, "tcp_stream": null, "udp_stream": 122, "frame_number": 3980, "timestamp_epoch": "1583961832.907313000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "arc.msn.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.218", "dst_port": 53, "event_id": "evt-004577b46d64d3592ab48b0d", "src_port": 52895, "tcp_stream": null, "udp_stream": 123, "frame_number": 4008, "timestamp_epoch": "1583961833.271472000" }, { "kind": "dns", "dst_ip": "10.3.11.218", "fields": { "dns.a": "52.179.129.229", "dns.cname": "arc.msn.com.nsatc.net", "dns.qry.name": "arc.msn.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 52895, "event_id": "evt-839a1039cdf3b7ee5055abd9", "src_port": 53, "tcp_stream": null, "udp_stream": 123, "frame_number": 4009, "timestamp_epoch": "1583961833.292679000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-7707e0d90893b9255dbc6f4d", "src_port": 64504, "tcp_stream": null, "udp_stream": 124, "frame_number": 4037, "timestamp_epoch": "1583961837.107429000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "13.107.21.200,204.79.197.200", "dns.cname": "a-0001.a-afdentry.net.trafficmanager.net,dual-a-0001.a-msedge.net", "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 64504, "event_id": "evt-e0e4890546bb20725d3f8d41", "src_port": 53, "tcp_stream": null, "udp_stream": 124, "frame_number": 4038, "timestamp_epoch": "1583961837.107859000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "k-ring.msedge.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-a435d914a3b2246868cecb5b", "src_port": 54553, "tcp_stream": null, "udp_stream": 125, "frame_number": 4044, "timestamp_epoch": "1583961837.153044000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "fp-vp.azureedge.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-d572987c6e326d62146f03e7", "src_port": 60083, "tcp_stream": null, "udp_stream": 126, "frame_number": 4045, "timestamp_epoch": "1583961837.160541000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "spo-ring.msedge.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-5b085068200c10c703d4e13a", "src_port": 50810, "tcp_stream": null, "udp_stream": 127, "frame_number": 4046, "timestamp_epoch": "1583961837.164150000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "13.107.18.254", "dns.cname": "k-ring.k-9999.k-msedge.net,k-9999.k-msedge.net", "dns.qry.name": "k-ring.msedge.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 54553, "event_id": "evt-55e6006fc216526860c97dd3", "src_port": 53, "tcp_stream": null, "udp_stream": 125, "frame_number": 4047, "timestamp_epoch": "1583961837.170614000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "13.107.136.254", "dns.cname": "spo-ring.spo-9999.spo-msedge.net,spo-9999.spo-msedge.net", "dns.qry.name": "spo-ring.msedge.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 50810, "event_id": "evt-e0eb03d4265f2c8c6a292858", "src_port": 53, "tcp_stream": null, "udp_stream": 127, "frame_number": 4058, "timestamp_epoch": "1583961837.190570000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "72.21.81.200", "dns.cname": "fp-vp.ec.azureedge.net,cs9.wpc.v0cdn.net", "dns.qry.name": "fp-vp.azureedge.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 60083, "event_id": "evt-d49809aecc7e769c2411e609", "src_port": 53, "tcp_stream": null, "udp_stream": 126, "frame_number": 4063, "timestamp_epoch": "1583961837.210365000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.mondogreek.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.3.11.218", "dst_port": 53, "event_id": "evt-14f2b81e5274fe1ef0c4b88d", "src_port": 57350, "tcp_stream": null, "udp_stream": 128, "frame_number": 4173, "timestamp_epoch": "1583961844.289363000" }, { "kind": "dns", "dst_ip": "10.3.11.218", "fields": { "dns.a": "10.3.11.3", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.mondogreek.com", "dns.qry.type": "33", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 57350, "event_id": "evt-9baac2798bd11467f45eb869", "src_port": 53, "tcp_stream": null, "udp_stream": 128, "frame_number": 4174, "timestamp_epoch": "1583961844.289742000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": 53, "event_id": "evt-1b7032878ce876e0ba49961f", "src_port": 63015, "tcp_stream": null, "udp_stream": 130, "frame_number": 4256, "timestamp_epoch": "1583961848.516411000" }, { "kind": "dns", "dst_ip": "10.3.11.194", "fields": { "dns.a": "204.79.197.200,13.107.21.200", "dns.cname": "a-0001.a-afdentry.net.trafficmanager.net,dual-a-0001.a-msedge.net", "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 63015, "event_id": "evt-8b771363777af3559d5f9a7d", "src_port": 53, "tcp_stream": null, "udp_stream": 130, "frame_number": 4257, "timestamp_epoch": "1583961848.562517000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "arc.msn.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": 53, "event_id": "evt-bc824c30cd22036f68e98624", "src_port": 61107, "tcp_stream": null, "udp_stream": 131, "frame_number": 4283, "timestamp_epoch": "1583961848.816890000" }, { "kind": "dns", "dst_ip": "10.3.11.194", "fields": { "dns.a": "52.179.129.229", "dns.cname": "arc.msn.com.nsatc.net", "dns.qry.name": "arc.msn.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 61107, "event_id": "evt-16fca26c240619d3d95aa1db", "src_port": 53, "tcp_stream": null, "udp_stream": 131, "frame_number": 4284, "timestamp_epoch": "1583961848.817143000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "wpad.mondogreek.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-e8340cd1ad86053e7aa78fa2", "src_port": 54690, "tcp_stream": null, "udp_stream": 133, "frame_number": 4315, "timestamp_epoch": "1583961853.498551000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.qry.name": "wpad.mondogreek.com", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 54690, "event_id": "evt-437331f26cfaec13a15a81c2", "src_port": 53, "tcp_stream": null, "udp_stream": 133, "frame_number": 4316, "timestamp_epoch": "1583961853.498879000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "www.tuscaloosabarnyard.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-ae1a457c6e1e43e6cd377c5e", "src_port": 64602, "tcp_stream": null, "udp_stream": 136, "frame_number": 4338, "timestamp_epoch": "1583961854.498926000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "config.edge.skype.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-1aef6fb14747617f0f3ab915", "src_port": 64082, "tcp_stream": null, "udp_stream": 137, "frame_number": 4339, "timestamp_epoch": "1583961854.499941000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "13.107.3.128", "dns.cname": "s-0001.s-msedge.net", "dns.qry.name": "config.edge.skype.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 64082, "event_id": "evt-4effc1a5291ca1827ccc713a", "src_port": 53, "tcp_stream": null, "udp_stream": 137, "frame_number": 4342, "timestamp_epoch": "1583961854.516637000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "72.167.191.69", "dns.cname": "tuscaloosabarnyard.com", "dns.qry.name": "www.tuscaloosabarnyard.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 64602, "event_id": "evt-406967119755b00557e5e8b4", "src_port": 53, "tcp_stream": null, "udp_stream": 136, "frame_number": 4348, "timestamp_epoch": "1583961854.572439000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "fonts.googleapis.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-bd9802ab4968ad59ae836a30", "src_port": 50998, "tcp_stream": null, "udp_stream": 138, "frame_number": 4385, "timestamp_epoch": "1583961854.731137000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "fonts.gstatic.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-6c172fa7fdd128177ce6a6ea", "src_port": 58195, "tcp_stream": null, "udp_stream": 139, "frame_number": 4386, "timestamp_epoch": "1583961854.731803000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "img1.wsimg.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-677ee5ca41e6424a85923fb8", "src_port": 63238, "tcp_stream": null, "udp_stream": 140, "frame_number": 4387, "timestamp_epoch": "1583961854.732156000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "216.58.194.42", "dns.qry.name": "fonts.googleapis.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 50998, "event_id": "evt-e43000dc86ad859bfbd16777", "src_port": 53, "tcp_stream": null, "udp_stream": 138, "frame_number": 4390, "timestamp_epoch": "1583961854.757736000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "216.58.194.131", "dns.cname": "gstaticadssl.l.google.com", "dns.qry.name": "fonts.gstatic.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 58195, "event_id": "evt-259069ace3e63dd07c43a07e", "src_port": 53, "tcp_stream": null, "udp_stream": 139, "frame_number": 4391, "timestamp_epoch": "1583961854.757824000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "nebula.wsimg.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-970fffb903f71c87e7c9ab2a", "src_port": 55982, "tcp_stream": null, "udp_stream": 141, "frame_number": 4394, "timestamp_epoch": "1583961854.763504000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "img4.wsimg.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-b0ac19b608c05f841811b7bb", "src_port": 51916, "tcp_stream": null, "udp_stream": 142, "frame_number": 4395, "timestamp_epoch": "1583961854.764850000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "23.211.18.27", "dns.cname": "global-wildcard.wsimg.com.edgekey.net,e2836.g.akamaiedge.net", "dns.qry.name": "img1.wsimg.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 63238, "event_id": "evt-3843efba534e459ec8944f1e", "src_port": 53, "tcp_stream": null, "udp_stream": 140, "frame_number": 4396, "timestamp_epoch": "1583961854.766530000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "fh-kit.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-1e8661ff86a4a76dbee7928c", "src_port": 50409, "tcp_stream": null, "udp_stream": 143, "frame_number": 4415, "timestamp_epoch": "1583961854.795171000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "23.211.18.27", "dns.cname": "global-wildcard.wsimg.com.edgekey.net,e2836.g.akamaiedge.net", "dns.qry.name": "img4.wsimg.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 51916, "event_id": "evt-2180adf75eacb96beeeac53c", "src_port": 53, "tcp_stream": null, "udp_stream": 142, "frame_number": 4416, "timestamp_epoch": "1583961854.797966000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "img2.wsimg.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-cbf71197f7bed2c948492036", "src_port": 57456, "tcp_stream": null, "udp_stream": 144, "frame_number": 4419, "timestamp_epoch": "1583961854.800699000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "23.209.74.120", "dns.cname": "wildcard.wsimg.com.edgekey.net,e2149.c.akamaiedge.net", "dns.qry.name": "nebula.wsimg.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 55982, "event_id": "evt-07adb62b766e4d552eece156", "src_port": 53, "tcp_stream": null, "udp_stream": 141, "frame_number": 4426, "timestamp_epoch": "1583961854.810288000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "104.26.9.32,104.26.8.32", "dns.qry.name": "fh-kit.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 50409, "event_id": "evt-5a826141388916ef0eea4b9b", "src_port": 53, "tcp_stream": null, "udp_stream": 143, "frame_number": 4438, "timestamp_epoch": "1583961854.840055000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "23.211.18.27", "dns.cname": "global-wildcard.wsimg.com.edgekey.net,e2836.g.akamaiedge.net", "dns.qry.name": "img2.wsimg.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 57456, "event_id": "evt-84ba8f8d24eb233022b4ea89", "src_port": 53, "tcp_stream": null, "udp_stream": 144, "frame_number": 4446, "timestamp_epoch": "1583961854.845638000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "fareharbor.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-9cf1206ea6e768ac93466fd2", "src_port": 62899, "tcp_stream": null, "udp_stream": 145, "frame_number": 4537, "timestamp_epoch": "1583961854.904733000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "s7.addthis.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-22eb74c318ec21711828b7b5", "src_port": 54867, "tcp_stream": null, "udp_stream": 146, "frame_number": 4538, "timestamp_epoch": "1583961854.904839000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "52.9.108.55,54.153.98.238", "dns.qry.name": "fareharbor.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 62899, "event_id": "evt-3a27189aee5b48b8da01d6ef", "src_port": 53, "tcp_stream": null, "udp_stream": 145, "frame_number": 4543, "timestamp_epoch": "1583961854.926971000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "72.246.84.150", "dns.cname": "s8.addthis.com,ds-s7.addthis.com.edgekey.net,e3615.a.akamaiedge.net", "dns.qry.name": "s7.addthis.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 54867, "event_id": "evt-d33b51ae5a2dde81d9df143f", "src_port": 53, "tcp_stream": null, "udp_stream": 146, "frame_number": 4544, "timestamp_epoch": "1583961854.927021000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "wpad.mondogreek.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": 53, "event_id": "evt-70a84ee161a4eee21a8e0ca8", "src_port": 53058, "tcp_stream": null, "udp_stream": 147, "frame_number": 4809, "timestamp_epoch": "1583961855.330328000" }, { "kind": "dns", "dst_ip": "10.3.11.194", "fields": { "dns.qry.name": "wpad.mondogreek.com", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 53058, "event_id": "evt-8744773e9d7e37aac1065442", "src_port": 53, "tcp_stream": null, "udp_stream": 147, "frame_number": 4810, "timestamp_epoch": "1583961855.330672000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "www.combsscreenprinting.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-3296f966bcb28867aa155422", "src_port": 62383, "tcp_stream": null, "udp_stream": 148, "frame_number": 4876, "timestamp_epoch": "1583961855.929704000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "www.godaddy.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-8d0faaefd6ff01843e61d08b", "src_port": 57173, "tcp_stream": null, "udp_stream": 149, "frame_number": 4877, "timestamp_epoch": "1583961855.929844000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "23.204.68.230", "dns.cname": "www-ipv6.godaddy.com.edgekey.net,e8804.dscx.akamaiedge.net", "dns.qry.name": "www.godaddy.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 57173, "event_id": "evt-d5a77195e596f1ccac0999ab", "src_port": 53, "tcp_stream": null, "udp_stream": 149, "frame_number": 4886, "timestamp_epoch": "1583961855.968427000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "72.167.191.69", "dns.cname": "combsscreenprinting.com", "dns.qry.name": "www.combsscreenprinting.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 62383, "event_id": "evt-e71caedffe97f57a54a0f0cd", "src_port": 53, "tcp_stream": null, "udp_stream": 148, "frame_number": 4916, "timestamp_epoch": "1583961856.009855000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "z.moatads.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-0e9a71b98033886de8b51cf8", "src_port": 51214, "tcp_stream": null, "udp_stream": 150, "frame_number": 4925, "timestamp_epoch": "1583961856.052929000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "v1.addthisedge.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-cf0bf0ce6350381589939346", "src_port": 63285, "tcp_stream": null, "udp_stream": 151, "frame_number": 4926, "timestamp_epoch": "1583961856.053988000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "m.addthis.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-fce2573d596cc9ff7988fea7", "src_port": 50998, "tcp_stream": null, "udp_stream": 138, "frame_number": 4927, "timestamp_epoch": "1583961856.054302000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "dp58aslhmbcib.cloudfront.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-412a34abc4715b1205669e0d", "src_port": 49174, "tcp_stream": null, "udp_stream": 152, "frame_number": 5033, "timestamp_epoch": "1583961856.143539000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "13.249.26.99,13.249.26.125,13.249.26.87,13.249.26.114", "dns.qry.name": "dp58aslhmbcib.cloudfront.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 49174, "event_id": "evt-945480800e61ebb91c681f1b", "src_port": 53, "tcp_stream": null, "udp_stream": 152, "frame_number": 5064, "timestamp_epoch": "1583961856.184965000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "23.44.170.27", "dns.cname": "wildcard.moatads.com.edgekey.net,e13136.g.akamaiedge.net", "dns.qry.name": "z.moatads.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 51214, "event_id": "evt-02aea836b7572a52ed302f8e", "src_port": 53, "tcp_stream": null, "udp_stream": 150, "frame_number": 5207, "timestamp_epoch": "1583961856.360480000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "72.246.84.150", "dns.cname": "m.addthisedge.com,ds-m.addthisedge.com.edgekey.net,e3615.a.akamaiedge.net", "dns.qry.name": "m.addthis.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 50998, "event_id": "evt-0c0f6b4ffeeac57f1c3db9aa", "src_port": 53, "tcp_stream": null, "udp_stream": 138, "frame_number": 5213, "timestamp_epoch": "1583961856.360527000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "72.246.84.150", "dns.cname": "v1.addthisedge.com.edgekey.net,e3615.a.akamaiedge.net", "dns.qry.name": "v1.addthisedge.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 63285, "event_id": "evt-93c5e3b27172419d0a0a3962", "src_port": 53, "tcp_stream": null, "udp_stream": 151, "frame_number": 5227, "timestamp_epoch": "1583961856.360811000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "www.addthis.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-13c2f55ad03b4654850bec48", "src_port": 50929, "tcp_stream": null, "udp_stream": 153, "frame_number": 5936, "timestamp_epoch": "1583961856.850533000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "72.246.84.150", "dns.cname": "ds-www.addthis.com.edgekey.net,e3615.a.akamaiedge.net", "dns.qry.name": "www.addthis.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 50929, "event_id": "evt-daf8e34e1b2b60a1136d0688", "src_port": 53, "tcp_stream": null, "udp_stream": 153, "frame_number": 5937, "timestamp_epoch": "1583961856.889136000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "www.facebook.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-616aaf937368fa64543cc979", "src_port": 64749, "tcp_stream": null, "udp_stream": 154, "frame_number": 5938, "timestamp_epoch": "1583961856.893298000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "connect.facebook.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-782cf172250a57728d4771a8", "src_port": 59796, "tcp_stream": null, "udp_stream": 155, "frame_number": 5939, "timestamp_epoch": "1583961856.894261000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "31.13.93.35", "dns.cname": "star-mini.c10r.facebook.com", "dns.qry.name": "www.facebook.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 64749, "event_id": "evt-f2c5efaaf5b909dedab525b2", "src_port": 53, "tcp_stream": null, "udp_stream": 154, "frame_number": 5984, "timestamp_epoch": "1583961856.929561000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "31.13.65.7", "dns.cname": "scontent.xx.fbcdn.net", "dns.qry.name": "connect.facebook.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 59796, "event_id": "evt-652eb9a85722b74525e5c78d", "src_port": 53, "tcp_stream": null, "udp_stream": 155, "frame_number": 5989, "timestamp_epoch": "1583961856.974342000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "platform.twitter.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-5b9ba2d83655bdcc14e1dee7", "src_port": 54130, "tcp_stream": null, "udp_stream": 156, "frame_number": 6001, "timestamp_epoch": "1583961857.000173000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "twitter.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-6e3d9e93c219e612c6e7b8ba", "src_port": 54590, "tcp_stream": null, "udp_stream": 157, "frame_number": 6002, "timestamp_epoch": "1583961857.008064000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "www.google-analytics.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-a7d48953e2ed85ef7f8623a9", "src_port": 59880, "tcp_stream": null, "udp_stream": 158, "frame_number": 6003, "timestamp_epoch": "1583961857.015931000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "fh-sites.imgix.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-ad444d38a5c860de2a078a7c", "src_port": 51664, "tcp_stream": null, "udp_stream": 159, "frame_number": 6006, "timestamp_epoch": "1583961857.017781000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "104.244.42.129,104.244.42.1", "dns.qry.name": "twitter.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 54590, "event_id": "evt-6bb540086ed60c4543dfe0d6", "src_port": 53, "tcp_stream": null, "udp_stream": 157, "frame_number": 6018, "timestamp_epoch": "1583961857.057731000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "216.58.193.142", "dns.cname": "www-google-analytics.l.google.com", "dns.qry.name": "www.google-analytics.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 59880, "event_id": "evt-2dcd7495491a133dd6f70833", "src_port": 53, "tcp_stream": null, "udp_stream": 158, "frame_number": 6019, "timestamp_epoch": "1583961857.067951000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "151.101.50.208", "dns.cname": "dualstack.com.imgix.map.fastly.net", "dns.qry.name": "fh-sites.imgix.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 51664, "event_id": "evt-2fffb752adef6ff38f9c915e", "src_port": 53, "tcp_stream": null, "udp_stream": 159, "frame_number": 6020, "timestamp_epoch": "1583961857.068008000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "72.21.91.66", "dns.cname": "cs472.wac.edgecastcdn.net,cs1-apr-8315.wac.edgecastcdn.net,wac.apr-8315.edgecastdns.net,cs1-lb-us.8315.ecdns.net,cs41.wac.edgecastcdn.net", "dns.qry.name": "platform.twitter.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 54130, "event_id": "evt-d77ac20908137b7cf83d9108", "src_port": 53, "tcp_stream": null, "udp_stream": 156, "frame_number": 6069, "timestamp_epoch": "1583961857.209794000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "syndication.twitter.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-4d444142f741d5d9a09ecf3e", "src_port": 51174, "tcp_stream": null, "udp_stream": 161, "frame_number": 7057, "timestamp_epoch": "1583961857.752218000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "104.244.42.8,104.244.42.200,104.244.42.136,104.244.42.72", "dns.qry.name": "syndication.twitter.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 51174, "event_id": "evt-cb546e9a1eeb1c9b683dc8d6", "src_port": 53, "tcp_stream": null, "udp_stream": 161, "frame_number": 7142, "timestamp_epoch": "1583961857.789491000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "muewhinerfhe.mondogreek.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-4c57e69a4f7c2b73dd7e0abb", "src_port": 54704, "tcp_stream": null, "udp_stream": 162, "frame_number": 7316, "timestamp_epoch": "1583961858.377611000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.qry.name": "muewhinerfhe.mondogreek.com", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 54704, "event_id": "evt-796a17c8a029752adc5cf42c", "src_port": 53, "tcp_stream": null, "udp_stream": 162, "frame_number": 7317, "timestamp_epoch": "1583961858.377882000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "ukrtzhmkwhgj.mondogreek.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-8a103256a305e1e9117ed4e8", "src_port": 58103, "tcp_stream": null, "udp_stream": 163, "frame_number": 7318, "timestamp_epoch": "1583961858.377972000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "vbwxoaflt.mondogreek.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-aa2f1bccd1a0c12ad699aeb7", "src_port": 56398, "tcp_stream": null, "udp_stream": 164, "frame_number": 7319, "timestamp_epoch": "1583961858.378167000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.qry.name": "ukrtzhmkwhgj.mondogreek.com", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 58103, "event_id": "evt-798f874217bf29ad8defeca4", "src_port": 53, "tcp_stream": null, "udp_stream": 163, "frame_number": 7320, "timestamp_epoch": "1583961858.378172000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.qry.name": "vbwxoaflt.mondogreek.com", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 56398, "event_id": "evt-0cdf920d91a1d78a36456ba6", "src_port": 53, "tcp_stream": null, "udp_stream": 164, "frame_number": 7322, "timestamp_epoch": "1583961858.378408000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "img.secureserver.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-df13e8075035d3ee67652adc", "src_port": 65103, "tcp_stream": null, "udp_stream": 168, "frame_number": 7612, "timestamp_epoch": "1583961859.201037000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "23.206.208.173", "dns.cname": "wildcard.secureserver.net.edgekey.net,e8843.b.akamaiedge.net", "dns.qry.name": "img.secureserver.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 65103, "event_id": "evt-412c4dd9d97eeb481110d75d", "src_port": 53, "tcp_stream": null, "udp_stream": 168, "frame_number": 7613, "timestamp_epoch": "1583961859.233927000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "wpad.mondogreek.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-b595b58c04ba83966988ed98", "src_port": 60671, "tcp_stream": null, "udp_stream": 169, "frame_number": 7698, "timestamp_epoch": "1583961862.500514000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.qry.name": "wpad.mondogreek.com", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 60671, "event_id": "evt-dc809697a5d27be638646381", "src_port": 53, "tcp_stream": null, "udp_stream": 169, "frame_number": 7699, "timestamp_epoch": "1583961862.500827000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "wpad.mondogreek.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-06546ee7ece048b9979317a0", "src_port": 60041, "tcp_stream": null, "udp_stream": 171, "frame_number": 7703, "timestamp_epoch": "1583961862.503247000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.qry.name": "wpad.mondogreek.com", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 60041, "event_id": "evt-3cc4233bafdea35eae6b9d1c", "src_port": 53, "tcp_stream": null, "udp_stream": 171, "frame_number": 7704, "timestamp_epoch": "1583961862.503491000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "login.microsoftonline.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": 53, "event_id": "evt-9ec6616f6f33149aa3016e2b", "src_port": 65510, "tcp_stream": null, "udp_stream": 174, "frame_number": 8135, "timestamp_epoch": "1583961870.452904000" }, { "kind": "dns", "dst_ip": "10.3.11.194", "fields": { "dns.a": "40.126.0.67,40.126.0.69,40.126.0.71,40.126.0.68,40.126.0.66,40.126.0.73,40.126.0.72,40.126.0.65", "dns.cname": "prda.aadg.msidentity.com,www.tm.a.prd.aadg.trafficmanager.net,san.current.a.prd.aadg.trafficmanager.net", "dns.qry.name": "login.microsoftonline.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 65510, "event_id": "evt-a70387f8f40f35c95ce313ea", "src_port": 53, "tcp_stream": null, "udp_stream": 174, "frame_number": 8136, "timestamp_epoch": "1583961870.477543000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "_gc._tcp.Default-First-Site-Name._sites.mondogreek.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": 53, "event_id": "evt-480f7c19fbc204bb9745377b", "src_port": 65273, "tcp_stream": null, "udp_stream": 175, "frame_number": 8171, "timestamp_epoch": "1583961872.407421000" }, { "kind": "dns", "dst_ip": "10.3.11.194", "fields": { "dns.a": "10.3.11.3", "dns.qry.name": "_gc._tcp.Default-First-Site-Name._sites.mondogreek.com", "dns.qry.type": "33", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 65273, "event_id": "evt-ce19a26cfd0dcca91f9c0984", "src_port": 53, "tcp_stream": null, "udp_stream": 175, "frame_number": 8172, "timestamp_epoch": "1583961872.407790000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "nexusrules.officeapps.live.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-44878765c915e3b5abe3d5c7", "src_port": 53095, "tcp_stream": null, "udp_stream": 177, "frame_number": 8542, "timestamp_epoch": "1583961873.835905000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "52.109.12.19", "dns.cname": "prod.nexusrules.live.com.akadns.net", "dns.qry.name": "nexusrules.officeapps.live.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 53095, "event_id": "evt-51ba2ba5d5a5e62a9222991e", "src_port": 53, "tcp_stream": null, "udp_stream": 177, "frame_number": 8543, "timestamp_epoch": "1583961873.836267000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "login.live.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.218", "dst_port": 53, "event_id": "evt-87d16971f3da39be7754c09b", "src_port": 60920, "tcp_stream": null, "udp_stream": 178, "frame_number": 8549, "timestamp_epoch": "1583961873.948506000" }, { "kind": "dns", "dst_ip": "10.3.11.218", "fields": { "dns.a": "40.90.22.185,40.90.22.187,40.90.22.189", "dns.cname": "login.msa.msidentity.com,lgin.msa.trafficmanager.net,fe-by01p-msa.trafficmanager.net", "dns.qry.name": "login.live.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 60920, "event_id": "evt-6b5afb323a4e09474c8eca25", "src_port": 53, "tcp_stream": null, "udp_stream": 178, "frame_number": 8550, "timestamp_epoch": "1583961873.974309000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "bolton-tech.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": 53, "event_id": "evt-1c6a60fb45f5c3c9df9fb0b2", "src_port": 63929, "tcp_stream": null, "udp_stream": 179, "frame_number": 8611, "timestamp_epoch": "1583961876.384749000" }, { "kind": "dns", "dst_ip": "10.3.11.194", "fields": { "dns.a": "50.87.248.17", "dns.qry.name": "bolton-tech.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 63929, "event_id": "evt-d7de1836e279a9efd8ec6174", "src_port": 53, "tcp_stream": null, "udp_stream": 179, "frame_number": 8612, "timestamp_epoch": "1583961876.430841000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "self.events.data.microsoft.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": 53, "event_id": "evt-cd1057c7edefea46872ecedf", "src_port": 63468, "tcp_stream": null, "udp_stream": 180, "frame_number": 9003, "timestamp_epoch": "1583961879.976722000" }, { "kind": "dns", "dst_ip": "10.3.11.194", "fields": { "dns.a": "52.114.132.73", "dns.cname": "global.asimov.events.data.trafficmanager.net,skypedataprdcoleus04.cloudapp.net", "dns.qry.name": "self.events.data.microsoft.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 63468, "event_id": "evt-9977890791104b17238231a5", "src_port": 53, "tcp_stream": null, "udp_stream": 180, "frame_number": 9004, "timestamp_epoch": "1583961880.041235000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "wpad.mondogreek.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-11240546ff5eb2482b838398", "src_port": 50813, "tcp_stream": null, "udp_stream": 181, "frame_number": 9417, "timestamp_epoch": "1583961886.594060000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.qry.name": "wpad.mondogreek.com", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 50813, "event_id": "evt-326f4126e22366b7786a8ea9", "src_port": 53, "tcp_stream": null, "udp_stream": 181, "frame_number": 9418, "timestamp_epoch": "1583961886.594398000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.mondogreek.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-52c7e7bed13f1087c8aadab5", "src_port": 56200, "tcp_stream": null, "udp_stream": 182, "frame_number": 9738, "timestamp_epoch": "1583961892.292288000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "10.3.11.3", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.mondogreek.com", "dns.qry.type": "33", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 56200, "event_id": "evt-946ffc2288b073a3668668f3", "src_port": 53, "tcp_stream": null, "udp_stream": 182, "frame_number": 9739, "timestamp_epoch": "1583961892.292615000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "wpad.mondogreek.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-165b4845f9e3b8e2c1a91414", "src_port": 63206, "tcp_stream": null, "udp_stream": 184, "frame_number": 9823, "timestamp_epoch": "1583961895.300081000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.qry.name": "wpad.mondogreek.com", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 63206, "event_id": "evt-ae213e3fe96d4b1fa4cb8d57", "src_port": 53, "tcp_stream": null, "udp_stream": 184, "frame_number": 9824, "timestamp_epoch": "1583961895.300384000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "edge.microsoft.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-a6938bde7cc04729c74b70fd", "src_port": 56670, "tcp_stream": null, "udp_stream": 186, "frame_number": 10206, "timestamp_epoch": "1583961911.711934000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "wpad.mondogreek.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-dc30c5943f8e6ae0c2e7c691", "src_port": 51250, "tcp_stream": null, "udp_stream": 187, "frame_number": 10207, "timestamp_epoch": "1583961911.713467000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.qry.name": "wpad.mondogreek.com", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 51250, "event_id": "evt-61453d8587752f1cf6a4d890", "src_port": 53, "tcp_stream": null, "udp_stream": 187, "frame_number": 10208, "timestamp_epoch": "1583961911.713832000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "13.107.6.158", "dns.cname": "edge-microsoft-com.b-0005.b-msedge.net,b-0005.b-msedge.net", "dns.qry.name": "edge.microsoft.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 56670, "event_id": "evt-249cd2e3b5f3bc1bbbffd3b0", "src_port": 53, "tcp_stream": null, "udp_stream": 186, "frame_number": 10212, "timestamp_epoch": "1583961911.739107000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "ctldl.windowsupdate.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.218", "dst_port": 53, "event_id": "evt-1218805a0edb6010cfa691d1", "src_port": 56939, "tcp_stream": null, "udp_stream": 189, "frame_number": 10324, "timestamp_epoch": "1583961934.167029000" }, { "kind": "dns", "dst_ip": "10.3.11.218", "fields": { "dns.a": "8.253.164.248,8.253.164.240,8.253.112.120,67.27.98.254,67.27.99.254", "dns.cname": "audownload.windowsupdate.nsatc.net,auto.au.download.windowsupdate.com.c.footprint.net", "dns.qry.name": "ctldl.windowsupdate.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 56939, "event_id": "evt-9fc1b8abffa4501dd6851d59", "src_port": 53, "tcp_stream": null, "udp_stream": 189, "frame_number": 10325, "timestamp_epoch": "1583961934.209558000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "nexusrules.officeapps.live.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": 53, "event_id": "evt-a1a5e3a89a26917a72b1d661", "src_port": 53697, "tcp_stream": null, "udp_stream": 190, "frame_number": 10338, "timestamp_epoch": "1583961936.170865000" }, { "kind": "dns", "dst_ip": "10.3.11.194", "fields": { "dns.a": "52.109.12.19", "dns.cname": "prod.nexusrules.live.com.akadns.net", "dns.qry.name": "nexusrules.officeapps.live.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 53697, "event_id": "evt-50b56ff833de4ab4add49604", "src_port": 53, "tcp_stream": null, "udp_stream": 190, "frame_number": 10339, "timestamp_epoch": "1583961936.171143000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "slscr.update.microsoft.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": 53, "event_id": "evt-8fb2151a2513df5842da511c", "src_port": 62843, "tcp_stream": null, "udp_stream": 191, "frame_number": 10443, "timestamp_epoch": "1583961950.896457000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "slscr.update.microsoft.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": 53, "event_id": "evt-1affb997ea3a44098f48ca97", "src_port": 62843, "tcp_stream": null, "udp_stream": 191, "frame_number": 10445, "timestamp_epoch": "1583961951.891892000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "slscr.update.microsoft.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": 53, "event_id": "evt-63bdf0b4be42c571d64caa52", "src_port": 62843, "tcp_stream": null, "udp_stream": 191, "frame_number": 10446, "timestamp_epoch": "1583961952.907454000" }, { "kind": "dns", "dst_ip": "10.3.11.194", "fields": { "dns.a": "13.68.93.109", "dns.cname": "slscr.update.microsoft.com.akadns.net,sls.update.microsoft.com.akadns.net,sls.row.update.microsoft.com.akadns.net", "dns.qry.name": "slscr.update.microsoft.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 62843, "event_id": "evt-f0eece3513aa0a8b8edca7a9", "src_port": 53, "tcp_stream": null, "udp_stream": 191, "frame_number": 10456, "timestamp_epoch": "1583961954.783018000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "login.live.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": 53, "event_id": "evt-44dd384a4a9bb57dfacf4b78", "src_port": 54610, "tcp_stream": null, "udp_stream": 192, "frame_number": 10481, "timestamp_epoch": "1583961955.590380000" }, { "kind": "dns", "dst_ip": "10.3.11.194", "fields": { "dns.a": "40.90.22.191,40.90.22.188,40.90.22.189", "dns.cname": "login.msa.msidentity.com,lgin.msa.trafficmanager.net", "dns.qry.name": "login.live.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 54610, "event_id": "evt-80cdba8020b3a9939b03681b", "src_port": 53, "tcp_stream": null, "udp_stream": 192, "frame_number": 10482, "timestamp_epoch": "1583961955.604959000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "ocsp.digicert.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": 53, "event_id": "evt-81b9d789cd5014b3f3b1c023", "src_port": 50346, "tcp_stream": null, "udp_stream": 193, "frame_number": 10494, "timestamp_epoch": "1583961955.768821000" }, { "kind": "dns", "dst_ip": "10.3.11.194", "fields": { "dns.a": "72.21.91.29", "dns.cname": "cs9.wac.phicdn.net", "dns.qry.name": "ocsp.digicert.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 50346, "event_id": "evt-183a3d3ccc65d8f8b1db9af6", "src_port": 53, "tcp_stream": null, "udp_stream": 193, "frame_number": 10496, "timestamp_epoch": "1583961955.805772000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "licensing.mp.microsoft.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": 53, "event_id": "evt-390264cfcbbd63545595eba0", "src_port": 55580, "tcp_stream": null, "udp_stream": 194, "frame_number": 10537, "timestamp_epoch": "1583961956.185076000" }, { "kind": "dns", "dst_ip": "10.3.11.194", "fields": { "dns.a": "40.91.76.238", "dns.cname": "licensing.md.mp.microsoft.com.akadns.net,licensing-uswesteap.md.mp.microsoft.com.akadns.net,mw1.licensing.md.mp.microsoft.com.akadns.net", "dns.qry.name": "licensing.mp.microsoft.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 55580, "event_id": "evt-783a02cbb9bb8bd85a5e46ab", "src_port": 53, "tcp_stream": null, "udp_stream": 194, "frame_number": 10540, "timestamp_epoch": "1583961956.376456000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "client.wns.windows.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.218", "dst_port": 53, "event_id": "evt-a7d1a75ad2fbb02f0793a4a9", "src_port": 55825, "tcp_stream": null, "udp_stream": 196, "frame_number": 12354, "timestamp_epoch": "1583961994.562581000" }, { "kind": "dns", "dst_ip": "10.3.11.218", "fields": { "dns.a": "52.242.211.89", "dns.cname": "wns.notify.windows.com.akadns.net,americas1.notify.windows.com.akadns.net,dm3p.wns.notify.windows.com.akadns.net", "dns.qry.name": "client.wns.windows.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 55825, "event_id": "evt-dc7a7ee339b560b910373128", "src_port": 53, "tcp_stream": null, "udp_stream": 196, "frame_number": 12357, "timestamp_epoch": "1583961994.711946000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "pti.store.microsoft.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.218", "dst_port": 53, "event_id": "evt-6792b579a3a80aa063664951", "src_port": 59547, "tcp_stream": null, "udp_stream": 197, "frame_number": 12411, "timestamp_epoch": "1583961995.533222000" }, { "kind": "dns", "dst_ip": "10.3.11.218", "fields": { "dns.a": "13.107.246.10", "dns.cname": "sfd-production.azurefd.net,t-0001.t-msedge.net,Edge-Prod-DALr3.ctrl.t-0001.t-msedge.net,standard.t-0001.t-msedge.net", "dns.qry.name": "pti.store.microsoft.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 59547, "event_id": "evt-8ab71a5b30421769c0200cb0", "src_port": 53, "tcp_stream": null, "udp_stream": 197, "frame_number": 12412, "timestamp_epoch": "1583961995.556452000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "fp.msedge.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.218", "dst_port": 53, "event_id": "evt-a45ccf8bbe10fd2c08c4302d", "src_port": 51577, "tcp_stream": null, "udp_stream": 198, "frame_number": 12451, "timestamp_epoch": "1583962012.911857000" }, { "kind": "dns", "dst_ip": "10.3.11.218", "fields": { "dns.a": "204.79.197.222", "dns.cname": "1.perf.msedge.net,a-0019.a-msedge.net", "dns.qry.name": "fp.msedge.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 51577, "event_id": "evt-e0face9e82499dac51471a52", "src_port": 53, "tcp_stream": null, "udp_stream": 198, "frame_number": 12452, "timestamp_epoch": "1583962012.938150000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "api.bing.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.218", "dst_port": 53, "event_id": "evt-ee2d0e1493d2b8265f2d669a", "src_port": 62757, "tcp_stream": null, "udp_stream": 199, "frame_number": 12475, "timestamp_epoch": "1583962013.754640000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.218", "dst_port": 53, "event_id": "evt-6239d8370891318d9e727555", "src_port": 60598, "tcp_stream": null, "udp_stream": 200, "frame_number": 12476, "timestamp_epoch": "1583962013.755011000" }, { "kind": "dns", "dst_ip": "10.3.11.218", "fields": { "dns.a": "13.107.5.80", "dns.cname": "api-bing-com.e-0001.e-msedge.net,e-0001.e-msedge.net", "dns.qry.name": "api.bing.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 62757, "event_id": "evt-6a2d5cc952dedb49b55e57da", "src_port": 53, "tcp_stream": null, "udp_stream": 199, "frame_number": 12477, "timestamp_epoch": "1583962013.872494000" }, { "kind": "dns", "dst_ip": "10.3.11.218", "fields": { "dns.a": "204.79.197.200,13.107.21.200", "dns.cname": "a-0001.a-afdentry.net.trafficmanager.net,dual-a-0001.a-msedge.net", "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 60598, "event_id": "evt-4964459b6ce7fd11ad5472ea", "src_port": 53, "tcp_stream": null, "udp_stream": 200, "frame_number": 12478, "timestamp_epoch": "1583962013.872576000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "go.microsoft.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.218", "dst_port": 53, "event_id": "evt-aad9e9aa57221eeea2eefb47", "src_port": 61421, "tcp_stream": null, "udp_stream": 201, "frame_number": 12479, "timestamp_epoch": "1583962013.966655000" }, { "kind": "dns", "dst_ip": "10.3.11.218", "fields": { "dns.a": "23.211.36.128", "dns.cname": "go.microsoft.com.edgekey.net,e11290.dspg.akamaiedge.net", "dns.qry.name": "go.microsoft.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 61421, "event_id": "evt-9b876f8433657262d5db41f2", "src_port": 53, "tcp_stream": null, "udp_stream": 201, "frame_number": 12480, "timestamp_epoch": "1583962014.002923000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "ie11welcome.microsoft.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.218", "dst_port": 53, "event_id": "evt-b067d62b44d05ede445dda09", "src_port": 51361, "tcp_stream": null, "udp_stream": 202, "frame_number": 12512, "timestamp_epoch": "1583962014.281442000" }, { "kind": "dns", "dst_ip": "10.3.11.218", "fields": { "dns.a": "52.173.134.115", "dns.cname": "ie11welcomefre.azurewebsites.net,waws-prod-dm1-071.sip.azurewebsites.windows.net,waws-prod-dm1-071.cloudapp.net", "dns.qry.name": "ie11welcome.microsoft.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 51361, "event_id": "evt-ab1f5ee2672f39bef78da625", "src_port": 53, "tcp_stream": null, "udp_stream": 202, "frame_number": 12513, "timestamp_epoch": "1583962014.306944000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "3af21bab922f1a3fff13816e3eed341a.clo.footprintdns.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.218", "dst_port": 53, "event_id": "evt-a1422e7845a256400cf85a25", "src_port": 59288, "tcp_stream": null, "udp_stream": 203, "frame_number": 12622, "timestamp_epoch": "1583962015.215242000" }, { "kind": "dns", "dst_ip": "10.3.11.218", "fields": { "dns.a": "204.79.197.254", "dns.cname": "a-ring.msedge.net,a-ring.a-9999.a-msedge.net,a-9999.a-msedge.net", "dns.qry.name": "3af21bab922f1a3fff13816e3eed341a.clo.footprintdns.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 59288, "event_id": "evt-6405446bcc6bf3baa1b3549b", "src_port": 53, "tcp_stream": null, "udp_stream": 203, "frame_number": 12625, "timestamp_epoch": "1583962015.260881000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "az725175.vo.msecnd.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.218", "dst_port": 53, "event_id": "evt-bca2ea4fedb464207297850b", "src_port": 55053, "tcp_stream": null, "udp_stream": 204, "frame_number": 12659, "timestamp_epoch": "1583962015.493983000" }, { "kind": "dns", "dst_ip": "10.3.11.218", "fields": { "dns.a": "152.199.4.33", "dns.cname": "cs22.wpc.v0cdn.net", "dns.qry.name": "az725175.vo.msecnd.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 55053, "event_id": "evt-d01cf37e94136720897183c0", "src_port": 53, "tcp_stream": null, "udp_stream": 204, "frame_number": 12660, "timestamp_epoch": "1583962015.538643000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "web.vortex.data.microsoft.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.218", "dst_port": 53, "event_id": "evt-9b7145ded1a9c1b5d608f1fc", "src_port": 57104, "tcp_stream": null, "udp_stream": 205, "frame_number": 12903, "timestamp_epoch": "1583962015.841022000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "spo-ring.msedge.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.218", "dst_port": 53, "event_id": "evt-f5474ec81e95b577169a4706", "src_port": 53344, "tcp_stream": null, "udp_stream": 206, "frame_number": 12906, "timestamp_epoch": "1583962015.853494000" }, { "kind": "dns", "dst_ip": "10.3.11.218", "fields": { "dns.a": "13.107.136.254", "dns.cname": "spo-ring.spo-9999.spo-msedge.net,spo-9999.spo-msedge.net", "dns.qry.name": "spo-ring.msedge.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 53344, "event_id": "evt-7cedc3e9bc24d172b905e702", "src_port": 53, "tcp_stream": null, "udp_stream": 206, "frame_number": 12907, "timestamp_epoch": "1583962015.867946000" }, { "kind": "dns", "dst_ip": "10.3.11.218", "fields": { "dns.a": "64.4.54.254", "dns.cname": "web.vortex.data.microsoft.com.akadns.net,geo.vortex.data.microsoft.com.akadns.net,cy2.vortex.data.microsoft.com.akadns.net", "dns.qry.name": "web.vortex.data.microsoft.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 57104, "event_id": "evt-6af082f008f20e97030b8838", "src_port": 53, "tcp_stream": null, "udp_stream": 205, "frame_number": 12946, "timestamp_epoch": "1583962015.928169000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "notable-quotes.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.218", "dst_port": 53, "event_id": "evt-0128aa0e5e6f727595e1505f", "src_port": 51781, "tcp_stream": null, "udp_stream": 207, "frame_number": 13301, "timestamp_epoch": "1583962027.181355000" }, { "kind": "dns", "dst_ip": "10.3.11.218", "fields": { "dns.a": "65.254.227.240", "dns.qry.name": "notable-quotes.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 51781, "event_id": "evt-b1d3e10a8a99145ca679d8da", "src_port": 53, "tcp_stream": null, "udp_stream": 207, "frame_number": 13302, "timestamp_epoch": "1583962027.252924000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "files.markerly.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.218", "dst_port": 53, "event_id": "evt-38ddd50c7e5dce2686b6d585", "src_port": 60740, "tcp_stream": null, "udp_stream": 208, "frame_number": 13332, "timestamp_epoch": "1583962027.442392000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "www.notable-quotes.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.218", "dst_port": 53, "event_id": "evt-8986c774c1f6f37740a377b2", "src_port": 54789, "tcp_stream": null, "udp_stream": 209, "frame_number": 13333, "timestamp_epoch": "1583962027.448432000" }, { "kind": "dns", "dst_ip": "10.3.11.218", "fields": { "dns.a": "172.217.6.144", "dns.cname": "c.storage.googleapis.com", "dns.qry.name": "files.markerly.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 60740, "event_id": "evt-f4fd02b527257eaa04090001", "src_port": 53, "tcp_stream": null, "udp_stream": 208, "frame_number": 13334, "timestamp_epoch": "1583962027.473726000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "ajax.googleapis.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.218", "dst_port": 53, "event_id": "evt-878e962f5b868a69f752b800", "src_port": 56419, "tcp_stream": null, "udp_stream": 210, "frame_number": 13387, "timestamp_epoch": "1583962027.497850000" }, { "kind": "dns", "dst_ip": "10.3.11.218", "fields": { "dns.a": "65.254.227.240", "dns.qry.name": "www.notable-quotes.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 54789, "event_id": "evt-e89bec4b0235a0f83e95e5fa", "src_port": 53, "tcp_stream": null, "udp_stream": 209, "frame_number": 13391, "timestamp_epoch": "1583962027.518423000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "ajax.googleapis.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.218", "dst_port": 53, "event_id": "evt-bea4c9a457649f391171e7f3", "src_port": 56419, "tcp_stream": null, "udp_stream": 210, "frame_number": 13824, "timestamp_epoch": "1583962028.498159000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "ajax.googleapis.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.218", "dst_port": 53, "event_id": "evt-f11ab7ec96e927a0c8c3dfe2", "src_port": 56419, "tcp_stream": null, "udp_stream": 210, "frame_number": 13825, "timestamp_epoch": "1583962029.498523000" }, { "kind": "dns", "dst_ip": "10.3.11.218", "fields": { "dns.a": "172.217.12.74", "dns.qry.name": "ajax.googleapis.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 56419, "event_id": "evt-6b4c06b4493a507551cbec10", "src_port": 53, "tcp_stream": null, "udp_stream": 210, "frame_number": 13828, "timestamp_epoch": "1583962031.453069000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "client.wns.windows.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.218", "dst_port": 53, "event_id": "evt-db9d865719cdded8eba4dee1", "src_port": 61335, "tcp_stream": null, "udp_stream": 211, "frame_number": 14080, "timestamp_epoch": "1583962054.455424000" }, { "kind": "dns", "dst_ip": "10.3.11.218", "fields": { "dns.a": "52.242.211.89", "dns.cname": "wns.notify.windows.com.akadns.net,americas1.notify.windows.com.akadns.net,dm3p.wns.notify.windows.com.akadns.net", "dns.qry.name": "client.wns.windows.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 61335, "event_id": "evt-6c9b995c2e65156d83c52df2", "src_port": 53, "tcp_stream": null, "udp_stream": 211, "frame_number": 14081, "timestamp_epoch": "1583962054.581731000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.218", "dst_port": 53, "event_id": "evt-1e6240ec7029345ffda12a75", "src_port": 58992, "tcp_stream": null, "udp_stream": 212, "frame_number": 14087, "timestamp_epoch": "1583962054.667278000" }, { "kind": "dns", "dst_ip": "10.3.11.218", "fields": { "dns.a": "204.79.197.200,13.107.21.200", "dns.cname": "a-0001.a-afdentry.net.trafficmanager.net,dual-a-0001.a-msedge.net", "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 58992, "event_id": "evt-975506a43e72bbea3b8ae81e", "src_port": 53, "tcp_stream": null, "udp_stream": 212, "frame_number": 14092, "timestamp_epoch": "1583962054.684480000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.mondogreek.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.3.11.218", "dst_port": 53, "event_id": "evt-10c55270b08f77eb25fc4914", "src_port": 56549, "tcp_stream": null, "udp_stream": 213, "frame_number": 14136, "timestamp_epoch": "1583962055.558500000" }, { "kind": "dns", "dst_ip": "10.3.11.218", "fields": { "dns.a": "10.3.11.3", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.mondogreek.com", "dns.qry.type": "33", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 56549, "event_id": "evt-6087ca8dc4db6909f2f32ae5", "src_port": 53, "tcp_stream": null, "udp_stream": 213, "frame_number": 14137, "timestamp_epoch": "1583962055.558822000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.mondogreek.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-22e9c76fa649e4e2f1267c63", "src_port": 53030, "tcp_stream": null, "udp_stream": 216, "frame_number": 14342, "timestamp_epoch": "1583962113.696961000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "10.3.11.3", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.mondogreek.com", "dns.qry.type": "33", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 53030, "event_id": "evt-f67320b378410b7d94fdaa62", "src_port": 53, "tcp_stream": null, "udp_stream": 216, "frame_number": 14343, "timestamp_epoch": "1583962113.697369000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "mrodevicemgr.officeapps.live.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.218", "dst_port": 53, "event_id": "evt-eb4fc0d0e7ca65de85fe8ceb", "src_port": 58860, "tcp_stream": null, "udp_stream": 218, "frame_number": 14419, "timestamp_epoch": "1583962114.533183000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "mrodevicemgr.officeapps.live.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.218", "dst_port": 53, "event_id": "evt-13afd41f0a1e5a9f94b7b867", "src_port": 58860, "tcp_stream": null, "udp_stream": 218, "frame_number": 14420, "timestamp_epoch": "1583962114.562144000" }, { "kind": "dns", "dst_ip": "10.3.11.218", "fields": { "dns.a": "52.109.8.30", "dns.cname": "prod.mrodevicemgr.live.com.akadns.net", "dns.qry.name": "mrodevicemgr.officeapps.live.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 58860, "event_id": "evt-805a734ec019ddd2f7de6bb0", "src_port": 53, "tcp_stream": null, "udp_stream": 218, "frame_number": 14421, "timestamp_epoch": "1583962114.660248000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "dns.msftncsi.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": 53, "event_id": "evt-342a54e03d77c0c9317c2d97", "src_port": 55092, "tcp_stream": null, "udp_stream": 220, "frame_number": 14614, "timestamp_epoch": "1583962215.914197000" }, { "kind": "dns", "dst_ip": "10.3.11.194", "fields": { "dns.a": "131.107.255.255", "dns.qry.name": "dns.msftncsi.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 55092, "event_id": "evt-7809a8e95db06ac2c1d67928", "src_port": 53, "tcp_stream": null, "udp_stream": 220, "frame_number": 14615, "timestamp_epoch": "1583962215.989692000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "wpad.mondogreek.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-b4d36e19290af36c0b052b7b", "src_port": 55314, "tcp_stream": null, "udp_stream": 221, "frame_number": 14637, "timestamp_epoch": "1583962217.840321000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.qry.name": "wpad.mondogreek.com", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 55314, "event_id": "evt-78bd3822a2f06b8a6ebd62b2", "src_port": 53, "tcp_stream": null, "udp_stream": 221, "frame_number": 14638, "timestamp_epoch": "1583962217.840598000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "dns.msftncsi.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": 53, "event_id": "evt-3230f7ebe72bfcd95d5a2ca9", "src_port": 62192, "tcp_stream": null, "udp_stream": 223, "frame_number": 14724, "timestamp_epoch": "1583962275.915845000" }, { "kind": "dns", "dst_ip": "10.3.11.194", "fields": { "dns.a": "131.107.255.255", "dns.qry.name": "dns.msftncsi.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 62192, "event_id": "evt-3bf041c6b0b5d5702260c822", "src_port": 53, "tcp_stream": null, "udp_stream": 223, "frame_number": 14725, "timestamp_epoch": "1583962275.929534000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "client.wns.windows.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-8fba9916b2cc9a75a326c956", "src_port": 60201, "tcp_stream": null, "udp_stream": 224, "frame_number": 14738, "timestamp_epoch": "1583962291.158736000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "client.wns.windows.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-dafcbaf4b2302cec9b7ea135", "src_port": 60201, "tcp_stream": null, "udp_stream": 224, "frame_number": 14739, "timestamp_epoch": "1583962291.199928000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "pti.store.microsoft.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-c4a6a1b0536693b3d660c28f", "src_port": 50819, "tcp_stream": null, "udp_stream": 225, "frame_number": 14740, "timestamp_epoch": "1583962291.232047000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "52.242.211.89", "dns.cname": "wns.notify.windows.com.akadns.net,americas1.notify.windows.com.akadns.net,dm3p.wns.notify.windows.com.akadns.net", "dns.qry.name": "client.wns.windows.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 60201, "event_id": "evt-5df3b0c58a34997ac5d23fec", "src_port": 53, "tcp_stream": null, "udp_stream": 224, "frame_number": 14741, "timestamp_epoch": "1583962291.242182000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "pti.store.microsoft.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-89dec42f8e5ee45d78150e5c", "src_port": 50819, "tcp_stream": null, "udp_stream": 225, "frame_number": 14743, "timestamp_epoch": "1583962291.263099000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "13.107.246.10", "dns.cname": "sfd-production.azurefd.net,t-0001.t-msedge.net,Edge-Prod-DALr3.ctrl.t-0001.t-msedge.net,standard.t-0001.t-msedge.net", "dns.qry.name": "pti.store.microsoft.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 50819, "event_id": "evt-a04ef9fb149760ba364a9578", "src_port": 53, "tcp_stream": null, "udp_stream": 225, "frame_number": 14744, "timestamp_epoch": "1583962291.265084000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "client.wns.windows.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": 53, "event_id": "evt-f27cc5a9677673cde4d674c5", "src_port": 55214, "tcp_stream": null, "udp_stream": 226, "frame_number": 14913, "timestamp_epoch": "1583962319.845278000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "pti.store.microsoft.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": 53, "event_id": "evt-748b2e0ede5474cb5741938e", "src_port": 63483, "tcp_stream": null, "udp_stream": 227, "frame_number": 14918, "timestamp_epoch": "1583962319.914672000" }, { "kind": "dns", "dst_ip": "10.3.11.194", "fields": { "dns.a": "13.107.246.10", "dns.cname": "sfd-production.azurefd.net,t-0001.t-msedge.net,Edge-Prod-DALr3.ctrl.t-0001.t-msedge.net,standard.t-0001.t-msedge.net", "dns.qry.name": "pti.store.microsoft.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 63483, "event_id": "evt-9fec6cf138ff90d77bcc2399", "src_port": 53, "tcp_stream": null, "udp_stream": 227, "frame_number": 14919, "timestamp_epoch": "1583962319.940114000" }, { "kind": "dns", "dst_ip": "10.3.11.194", "fields": { "dns.a": "52.230.222.68", "dns.cname": "wns.notify.windows.com.akadns.net,americas1.notify.windows.com.akadns.net,dm3p.wns.notify.windows.com.akadns.net", "dns.qry.name": "client.wns.windows.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 55214, "event_id": "evt-0a669d507d9d07f4e14db540", "src_port": 53, "tcp_stream": null, "udp_stream": 226, "frame_number": 14921, "timestamp_epoch": "1583962319.963750000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "checkip.amazonaws.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": 53, "event_id": "evt-8349c4743c08bf11f0bbd805", "src_port": 60257, "tcp_stream": null, "udp_stream": 228, "frame_number": 14966, "timestamp_epoch": "1583962320.148514000" }, { "kind": "dns", "dst_ip": "10.3.11.194", "fields": { "dns.a": "18.235.112.207,34.197.12.81,18.233.90.151,34.196.181.158,34.192.250.175,3.224.145.145,18.214.132.216,52.206.178.1", "dns.cname": "checkip.check-ip.aws.a2z.com,checkip.us-east-1.prod.check-ip.aws.a2z.com", "dns.qry.name": "checkip.amazonaws.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 60257, "event_id": "evt-6f485a3988dcc45b177d8908", "src_port": 53, "tcp_stream": null, "udp_stream": 228, "frame_number": 14974, "timestamp_epoch": "1583962320.197469000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "112.146.166.173.zen.spamhaus.org", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": 53, "event_id": "evt-79cff96e672dd0b7fb2370d9", "src_port": 55848, "tcp_stream": null, "udp_stream": 229, "frame_number": 15109, "timestamp_epoch": "1583962330.537921000" }, { "kind": "dns", "dst_ip": "10.3.11.194", "fields": { "dns.qry.name": "112.146.166.173.zen.spamhaus.org", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 55848, "event_id": "evt-9487cce3528d9f477294fe05", "src_port": 53, "tcp_stream": null, "udp_stream": 229, "frame_number": 15110, "timestamp_epoch": "1583962330.571003000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "112.146.166.173.cbl.abuseat.org", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": 53, "event_id": "evt-d34cc2aa3a226b4d6e045e27", "src_port": 60865, "tcp_stream": null, "udp_stream": 230, "frame_number": 15111, "timestamp_epoch": "1583962330.571726000" }, { "kind": "dns", "dst_ip": "10.3.11.194", "fields": { "dns.qry.name": "112.146.166.173.cbl.abuseat.org", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 60865, "event_id": "evt-33c06124571458b876e26230", "src_port": 53, "tcp_stream": null, "udp_stream": 230, "frame_number": 15113, "timestamp_epoch": "1583962330.620313000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "112.146.166.173.b.barracudacentral.org", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": 53, "event_id": "evt-60e96747c60ec14ef5b322f2", "src_port": 58221, "tcp_stream": null, "udp_stream": 231, "frame_number": 15114, "timestamp_epoch": "1583962330.620991000" }, { "kind": "dns", "dst_ip": "10.3.11.194", "fields": { "dns.qry.name": "112.146.166.173.b.barracudacentral.org", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 58221, "event_id": "evt-831706199ba2d66e838ce1cb", "src_port": 53, "tcp_stream": null, "udp_stream": 231, "frame_number": 15115, "timestamp_epoch": "1583962330.679154000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "112.146.166.173.dnsbl-1.uceprotect.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": 53, "event_id": "evt-e444da73172e30df3120acbc", "src_port": 58119, "tcp_stream": null, "udp_stream": 232, "frame_number": 15116, "timestamp_epoch": "1583962330.679973000" }, { "kind": "dns", "dst_ip": "10.3.11.194", "fields": { "dns.qry.name": "112.146.166.173.dnsbl-1.uceprotect.net", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 58119, "event_id": "evt-09d1edcec5544f24bc017de1", "src_port": 53, "tcp_stream": null, "udp_stream": 232, "frame_number": 15117, "timestamp_epoch": "1583962330.724772000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "112.146.166.173.spam.dnsbl.sorbs.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": 53, "event_id": "evt-37cac00164c8ac0b3c0ff2b1", "src_port": 53205, "tcp_stream": null, "udp_stream": 233, "frame_number": 15118, "timestamp_epoch": "1583962330.725520000" }, { "kind": "dns", "dst_ip": "10.3.11.194", "fields": { "dns.qry.name": "112.146.166.173.spam.dnsbl.sorbs.net", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 53205, "event_id": "evt-5661e43aa73d5e4f3368e603", "src_port": 53, "tcp_stream": null, "udp_stream": 233, "frame_number": 15119, "timestamp_epoch": "1583962330.755632000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "client.wns.windows.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-61a7143d6b0dc69b34b6da68", "src_port": 49658, "tcp_stream": null, "udp_stream": 235, "frame_number": 15134, "timestamp_epoch": "1583962351.651049000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "client.wns.windows.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-8f96fa6ac8aea7b5133ab8c4", "src_port": 49658, "tcp_stream": null, "udp_stream": 235, "frame_number": 15135, "timestamp_epoch": "1583962351.681707000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "52.230.222.68", "dns.cname": "wns.notify.windows.com.akadns.net,americas1.notify.windows.com.akadns.net,dm3p.wns.notify.windows.com.akadns.net", "dns.qry.name": "client.wns.windows.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 49658, "event_id": "evt-f0a0636406f8721d66cc224b", "src_port": 53, "tcp_stream": null, "udp_stream": 235, "frame_number": 15136, "timestamp_epoch": "1583962351.740704000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "fe2cr.update.microsoft.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.218", "dst_port": 53, "event_id": "evt-47683c026c24a1e3587c9946", "src_port": 57200, "tcp_stream": null, "udp_stream": 236, "frame_number": 15202, "timestamp_epoch": "1583962359.615054000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "fe2cr.update.microsoft.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.218", "dst_port": 53, "event_id": "evt-e971e65bab549c3a121e0c3a", "src_port": 57200, "tcp_stream": null, "udp_stream": 236, "frame_number": 15203, "timestamp_epoch": "1583962359.646100000" }, { "kind": "dns", "dst_ip": "10.3.11.218", "fields": { "dns.a": "52.230.220.159", "dns.cname": "fe2cr.update.microsoft.com.akadns.net", "dns.qry.name": "fe2cr.update.microsoft.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 57200, "event_id": "evt-8cc6799294f11c2f3994a89b", "src_port": 53, "tcp_stream": null, "udp_stream": 236, "frame_number": 15204, "timestamp_epoch": "1583962359.660989000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "fe3cr.delivery.mp.microsoft.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.218", "dst_port": 53, "event_id": "evt-d5b64d1f4555dc71081624b0", "src_port": 50220, "tcp_stream": null, "udp_stream": 237, "frame_number": 15313, "timestamp_epoch": "1583962360.827395000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "fe3cr.delivery.mp.microsoft.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.218", "dst_port": 53, "event_id": "evt-f0fe71e1b31c3eeee22c4ae4", "src_port": 50220, "tcp_stream": null, "udp_stream": 237, "frame_number": 15314, "timestamp_epoch": "1583962360.848294000" }, { "kind": "dns", "dst_ip": "10.3.11.218", "fields": { "dns.a": "111.221.29.40", "dns.cname": "fe3.delivery.mp.microsoft.com,fe3.delivery.dsp.mp.microsoft.com.nsatc.net", "dns.qry.name": "fe3cr.delivery.mp.microsoft.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 50220, "event_id": "evt-89aa389acd9bb54fd2f4cd20", "src_port": 53, "tcp_stream": null, "udp_stream": 237, "frame_number": 15315, "timestamp_epoch": "1583962360.863226000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "client.wns.windows.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": 53, "event_id": "evt-b234d388710c9ad7e26ceea1", "src_port": 58473, "tcp_stream": null, "udp_stream": 238, "frame_number": 15375, "timestamp_epoch": "1583962380.291791000" }, { "kind": "dns", "dst_ip": "10.3.11.194", "fields": { "dns.a": "52.230.222.68", "dns.cname": "wns.notify.windows.com.akadns.net,americas1.notify.windows.com.akadns.net,dm3p.wns.notify.windows.com.akadns.net", "dns.qry.name": "client.wns.windows.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 58473, "event_id": "evt-4268751deb43a8b14541f08c", "src_port": 53, "tcp_stream": null, "udp_stream": 238, "frame_number": 15376, "timestamp_epoch": "1583962380.292101000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "settings-win.data.microsoft.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.218", "dst_port": 53, "event_id": "evt-a4a6a32e619d39ec123a108d", "src_port": 54609, "tcp_stream": null, "udp_stream": 239, "frame_number": 15386, "timestamp_epoch": "1583962380.401914000" }, { "kind": "dns", "dst_ip": "10.3.11.218", "fields": { "dns.a": "40.119.2.214", "dns.cname": "settingsfd-geo.trafficmanager.net", "dns.qry.name": "settings-win.data.microsoft.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 54609, "event_id": "evt-29a608f1fde31da3db0d146e", "src_port": 53, "tcp_stream": null, "udp_stream": 239, "frame_number": 15393, "timestamp_epoch": "1583962380.441417000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "login.live.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.218", "dst_port": 53, "event_id": "evt-68a8048a26e688ddd6656988", "src_port": 61563, "tcp_stream": null, "udp_stream": 240, "frame_number": 15439, "timestamp_epoch": "1583962381.344210000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "login.live.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.218", "dst_port": 53, "event_id": "evt-36d2f3347ea9133c9d5dcb17", "src_port": 61563, "tcp_stream": null, "udp_stream": 240, "frame_number": 15440, "timestamp_epoch": "1583962381.364416000" }, { "kind": "dns", "dst_ip": "10.3.11.218", "fields": { "dns.a": "40.90.22.187,40.90.22.183,40.90.22.189", "dns.cname": "login.msa.msidentity.com,lgin.msa.trafficmanager.net,fe-by01p-msa.trafficmanager.net", "dns.qry.name": "login.live.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 61563, "event_id": "evt-a6228d2db11c2d94a50dc850", "src_port": 53, "tcp_stream": null, "udp_stream": 240, "frame_number": 15441, "timestamp_epoch": "1583962381.378143000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "licensing.mp.microsoft.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.218", "dst_port": 53, "event_id": "evt-bc98769cb77a08dd0ea17e3b", "src_port": 49608, "tcp_stream": null, "udp_stream": 241, "frame_number": 15485, "timestamp_epoch": "1583962381.913145000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "licensing.mp.microsoft.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.218", "dst_port": 53, "event_id": "evt-54d82dca31d75a00eb73a6b3", "src_port": 49608, "tcp_stream": null, "udp_stream": 241, "frame_number": 15486, "timestamp_epoch": "1583962381.942405000" }, { "kind": "dns", "dst_ip": "10.3.11.218", "fields": { "dns.a": "40.91.76.238", "dns.cname": "licensing.md.mp.microsoft.com.akadns.net,licensing-uswesteap.md.mp.microsoft.com.akadns.net,mw1.licensing.md.mp.microsoft.com.akadns.net", "dns.qry.name": "licensing.mp.microsoft.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 49608, "event_id": "evt-5724e9f2bc56b065d5fe4809", "src_port": 53, "tcp_stream": null, "udp_stream": 241, "frame_number": 15489, "timestamp_epoch": "1583962381.966088000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "msftspeechmodelsprod.azureedge.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.218", "dst_port": 53, "event_id": "evt-3ce9c8c84a14c42df449aab6", "src_port": 64144, "tcp_stream": null, "udp_stream": 242, "frame_number": 15545, "timestamp_epoch": "1583962384.970159000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "msftspeechmodelsprod.azureedge.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.218", "dst_port": 53, "event_id": "evt-9232f1bf90b027cdcf6c75da", "src_port": 64144, "tcp_stream": null, "udp_stream": 242, "frame_number": 15546, "timestamp_epoch": "1583962384.989254000" }, { "kind": "dns", "dst_ip": "10.3.11.218", "fields": { "dns.qry.name": "msftspeechmodelsprod.azureedge.net", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 64144, "event_id": "evt-2387779bffd838c09e05fd9d", "src_port": 53, "tcp_stream": null, "udp_stream": 242, "frame_number": 15547, "timestamp_epoch": "1583962385.041155000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "slscr.update.microsoft.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": 53, "event_id": "evt-79a0cb1def830f84e6e01042", "src_port": 53381, "tcp_stream": null, "udp_stream": 243, "frame_number": 15550, "timestamp_epoch": "1583962385.391674000" }, { "kind": "dns", "dst_ip": "10.3.11.194", "fields": { "dns.a": "13.78.168.230", "dns.cname": "slscr.update.microsoft.com.akadns.net,sls.update.microsoft.com.akadns.net,sls.row.update.microsoft.com.akadns.net", "dns.qry.name": "slscr.update.microsoft.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 53381, "event_id": "evt-6e30ab6ff48714e4d8689251", "src_port": 53, "tcp_stream": null, "udp_stream": 243, "frame_number": 15551, "timestamp_epoch": "1583962385.535429000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "storecatalogrevocation.storequality.microsoft.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.218", "dst_port": 53, "event_id": "evt-e2f71e01a9c7bf5af8b7e3fa", "src_port": 58786, "tcp_stream": null, "udp_stream": 244, "frame_number": 15562, "timestamp_epoch": "1583962385.634946000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "storecatalogrevocation.storequality.microsoft.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.218", "dst_port": 53, "event_id": "evt-7e271eedc8e450f18a4d334a", "src_port": 58786, "tcp_stream": null, "udp_stream": 244, "frame_number": 15570, "timestamp_epoch": "1583962385.661204000" }, { "kind": "dns", "dst_ip": "10.3.11.218", "fields": { "dns.a": "23.206.213.111", "dns.cname": "storecatalogrevocation.storequality.microsoft.com.edgekey.net,e10198.b.akamaiedge.net", "dns.qry.name": "storecatalogrevocation.storequality.microsoft.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 58786, "event_id": "evt-5b67d6737c6fc2ce622050ef", "src_port": 53, "tcp_stream": null, "udp_stream": 244, "frame_number": 15571, "timestamp_epoch": "1583962385.663937000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "fe2cr.update.microsoft.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": 53, "event_id": "evt-a1165202c66ac95c3e5fce62", "src_port": 50486, "tcp_stream": null, "udp_stream": 245, "frame_number": 15600, "timestamp_epoch": "1583962385.972164000" }, { "kind": "dns", "dst_ip": "10.3.11.194", "fields": { "dns.a": "52.230.220.159", "dns.cname": "fe2cr.update.microsoft.com.akadns.net", "dns.qry.name": "fe2cr.update.microsoft.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 50486, "event_id": "evt-fe4d211f8359449d2bd2e312", "src_port": 53, "tcp_stream": null, "udp_stream": 245, "frame_number": 15601, "timestamp_epoch": "1583962385.972448000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "LAPTOP-I9ZPI04.mondogreek.com", "dns.qry.type": "6", "dns.flags.response": "False" }, "src_ip": "10.3.11.218", "dst_port": 53, "event_id": "evt-aaec34c69e8d8342c37fdbc1", "src_port": 63694, "tcp_stream": null, "udp_stream": 249, "frame_number": 15659, "timestamp_epoch": "1583962386.740038000" }, { "kind": "dns", "dst_ip": "10.3.11.218", "fields": { "dns.a": "10.3.11.3", "dns.qry.name": "LAPTOP-I9ZPI04.mondogreek.com", "dns.qry.type": "6", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 63694, "event_id": "evt-979bbe9dee68e4fe7ad7ea81", "src_port": 53, "tcp_stream": null, "udp_stream": 249, "frame_number": 15660, "timestamp_epoch": "1583962386.740438000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.a": "10.3.11.218", "dns.qry.name": "mondogreek.com", "dns.qry.type": "6", "dns.flags.response": "False" }, "src_ip": "10.3.11.218", "dst_port": 53, "event_id": "evt-63fc76ed8aac60d47537b3c1", "src_port": 60705, "tcp_stream": null, "udp_stream": 250, "frame_number": 15661, "timestamp_epoch": "1583962386.750583000" }, { "kind": "dns", "dst_ip": "10.3.11.218", "fields": { "dns.a": "10.3.11.218", "dns.qry.name": "mondogreek.com", "dns.qry.type": "6", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 60705, "event_id": "evt-45eb3f75d612222c0c468ad6", "src_port": 53, "tcp_stream": null, "udp_stream": 250, "frame_number": 15662, "timestamp_epoch": "1583962386.751686000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "Mondogreek-DC.mondogreek.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.218", "dst_port": 53, "event_id": "evt-23397fd03114efbca8e384e2", "src_port": 58759, "tcp_stream": null, "udp_stream": 251, "frame_number": 15667, "timestamp_epoch": "1583962386.797821000" }, { "kind": "dns", "dst_ip": "10.3.11.218", "fields": { "dns.a": "10.3.11.3", "dns.qry.name": "Mondogreek-DC.mondogreek.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 58759, "event_id": "evt-99c1db87cf9af77b1146a8f3", "src_port": 53, "tcp_stream": null, "udp_stream": 251, "frame_number": 15668, "timestamp_epoch": "1583962386.798154000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "fe3cr.delivery.mp.microsoft.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": 53, "event_id": "evt-36d845797d9074348b081c8d", "src_port": 53824, "tcp_stream": null, "udp_stream": 252, "frame_number": 15725, "timestamp_epoch": "1583962387.327521000" }, { "kind": "dns", "dst_ip": "10.3.11.194", "fields": { "dns.a": "111.221.29.40", "dns.cname": "fe3.delivery.mp.microsoft.com,fe3.delivery.dsp.mp.microsoft.com.nsatc.net", "dns.qry.name": "fe3cr.delivery.mp.microsoft.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 53824, "event_id": "evt-65b5d7d00fc1f98fef003fca", "src_port": 53, "tcp_stream": null, "udp_stream": 252, "frame_number": 15726, "timestamp_epoch": "1583962387.327849000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "wpad.mondogreek.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.218", "dst_port": 53, "event_id": "evt-1a4ab81ad5fed6b9806daa55", "src_port": 61157, "tcp_stream": null, "udp_stream": 253, "frame_number": 15738, "timestamp_epoch": "1583962387.445268000" }, { "kind": "dns", "dst_ip": "10.3.11.218", "fields": { "dns.qry.name": "wpad.mondogreek.com", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 61157, "event_id": "evt-765d3f4673d5ade44205e7c4", "src_port": 53, "tcp_stream": null, "udp_stream": 253, "frame_number": 15739, "timestamp_epoch": "1583962387.445546000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "client.wns.windows.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.218", "dst_port": 53, "event_id": "evt-370c8c175a3d4857510af29f", "src_port": 64395, "tcp_stream": null, "udp_stream": 254, "frame_number": 15743, "timestamp_epoch": "1583962387.466379000" }, { "kind": "dns", "dst_ip": "10.3.11.218", "fields": { "dns.a": "52.230.222.68", "dns.cname": "wns.notify.windows.com.akadns.net,americas1.notify.windows.com.akadns.net,dm3p.wns.notify.windows.com.akadns.net", "dns.qry.name": "client.wns.windows.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 64395, "event_id": "evt-e9074e852b47d670a3339f77", "src_port": 53, "tcp_stream": null, "udp_stream": 254, "frame_number": 15744, "timestamp_epoch": "1583962387.466826000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "wpad.mondogreek.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.218", "dst_port": 53, "event_id": "evt-9a10d0cf4993ab83fb4316cb", "src_port": 53909, "tcp_stream": null, "udp_stream": 255, "frame_number": 15903, "timestamp_epoch": "1583962405.460442000" }, { "kind": "dns", "dst_ip": "10.3.11.218", "fields": { "dns.qry.name": "wpad.mondogreek.com", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 53909, "event_id": "evt-9df6398a868565c3bc30a731", "src_port": 53, "tcp_stream": null, "udp_stream": 255, "frame_number": 15904, "timestamp_epoch": "1583962405.460973000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "fe2cr.update.microsoft.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-8c6be162c78b562f1c96b81d", "src_port": 64431, "tcp_stream": null, "udp_stream": 256, "frame_number": 15922, "timestamp_epoch": "1583962416.974187000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "52.230.220.159", "dns.cname": "fe2cr.update.microsoft.com.akadns.net", "dns.qry.name": "fe2cr.update.microsoft.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 64431, "event_id": "evt-26daadb89290a51209b55498", "src_port": 53, "tcp_stream": null, "udp_stream": 256, "frame_number": 15923, "timestamp_epoch": "1583962416.974560000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "fe3cr.delivery.mp.microsoft.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-d022657111c1b2c482e44fed", "src_port": 55452, "tcp_stream": null, "udp_stream": 257, "frame_number": 16027, "timestamp_epoch": "1583962418.343766000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "111.221.29.40", "dns.cname": "fe3.delivery.mp.microsoft.com,fe3.delivery.dsp.mp.microsoft.com.nsatc.net", "dns.qry.name": "fe3cr.delivery.mp.microsoft.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 55452, "event_id": "evt-b014cb590e347aacc9a2c9e7", "src_port": 53, "tcp_stream": null, "udp_stream": 257, "frame_number": 16028, "timestamp_epoch": "1583962418.344091000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "LAPTOP-SQSA42O.mondogreek.com", "dns.qry.type": "6", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-3cdc97a075561ed9ded50704", "src_port": 56189, "tcp_stream": null, "udp_stream": 258, "frame_number": 16083, "timestamp_epoch": "1583962433.370420000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "10.3.11.3", "dns.qry.name": "LAPTOP-SQSA42O.mondogreek.com", "dns.qry.type": "6", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 56189, "event_id": "evt-8fd6ad19f5a6a2a76f35c882", "src_port": 53, "tcp_stream": null, "udp_stream": 258, "frame_number": 16084, "timestamp_epoch": "1583962433.370632000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.a": "10.3.11.119", "dns.qry.name": "mondogreek.com", "dns.qry.type": "6", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-2331481f089dac893e0669a3", "src_port": 50256, "tcp_stream": null, "udp_stream": 260, "frame_number": 16090, "timestamp_epoch": "1583962433.391674000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "10.3.11.119", "dns.qry.name": "mondogreek.com", "dns.qry.type": "6", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 50256, "event_id": "evt-3b283401bfd75f96bf13a3d2", "src_port": 53, "tcp_stream": null, "udp_stream": 260, "frame_number": 16091, "timestamp_epoch": "1583962433.392824000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "Mondogreek-DC.mondogreek.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-680bcba08db796c077a3e9c8", "src_port": 53886, "tcp_stream": null, "udp_stream": 261, "frame_number": 16092, "timestamp_epoch": "1583962433.463950000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "10.3.11.3", "dns.qry.name": "Mondogreek-DC.mondogreek.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 53886, "event_id": "evt-2f055e314542a6dffddbb334", "src_port": 53, "tcp_stream": null, "udp_stream": 261, "frame_number": 16093, "timestamp_epoch": "1583962433.464217000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "client.wns.windows.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-e88514d6e41f46b3867cbe36", "src_port": 55332, "tcp_stream": null, "udp_stream": 262, "frame_number": 16109, "timestamp_epoch": "1583962433.733151000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "client.wns.windows.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-c2f3f21221049d1df5cff4e5", "src_port": 55332, "tcp_stream": null, "udp_stream": 262, "frame_number": 16110, "timestamp_epoch": "1583962433.763569000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "wpad.mondogreek.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-9cba11a78f39479d35213a10", "src_port": 58950, "tcp_stream": null, "udp_stream": 263, "frame_number": 16112, "timestamp_epoch": "1583962434.138425000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.qry.name": "wpad.mondogreek.com", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 58950, "event_id": "evt-558127a8fc271dfc0eae5180", "src_port": 53, "tcp_stream": null, "udp_stream": 263, "frame_number": 16113, "timestamp_epoch": "1583962434.138674000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "52.230.222.68", "dns.cname": "wns.notify.windows.com.akadns.net,americas1.notify.windows.com.akadns.net,dm3p.wns.notify.windows.com.akadns.net", "dns.qry.name": "client.wns.windows.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 55332, "event_id": "evt-fa453537cfbec551909c6ed3", "src_port": 53, "tcp_stream": null, "udp_stream": 262, "frame_number": 16114, "timestamp_epoch": "1583962434.184347000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "wpad.mondogreek.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-5661480f52a78503454f829d", "src_port": 61440, "tcp_stream": null, "udp_stream": 264, "frame_number": 16200, "timestamp_epoch": "1583962438.367420000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.qry.name": "wpad.mondogreek.com", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 61440, "event_id": "evt-e8a7b375b1ed377053c3c54d", "src_port": 53, "tcp_stream": null, "udp_stream": 264, "frame_number": 16201, "timestamp_epoch": "1583962438.367679000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "wpad.mondogreek.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-4257b2c083242027646bea10", "src_port": 54721, "tcp_stream": null, "udp_stream": 266, "frame_number": 16205, "timestamp_epoch": "1583962438.371244000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.qry.name": "wpad.mondogreek.com", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 54721, "event_id": "evt-47d48c2be185704d1442a221", "src_port": 53, "tcp_stream": null, "udp_stream": 266, "frame_number": 16206, "timestamp_epoch": "1583962438.371476000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "adhcinqls.mondogreek.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-ad9986df497f598e509f5467", "src_port": 58512, "tcp_stream": null, "udp_stream": 269, "frame_number": 16218, "timestamp_epoch": "1583962439.873489000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.qry.name": "adhcinqls.mondogreek.com", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 58512, "event_id": "evt-f2432057bc57c88359b58be3", "src_port": 53, "tcp_stream": null, "udp_stream": 269, "frame_number": 16219, "timestamp_epoch": "1583962439.873745000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "nvzkinvuuinkgs.mondogreek.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-f227435562f2190816bcc573", "src_port": 53321, "tcp_stream": null, "udp_stream": 270, "frame_number": 16220, "timestamp_epoch": "1583962439.874056000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "roijvdflsx.mondogreek.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-d2a175dd076d8f996e0a0c20", "src_port": 54097, "tcp_stream": null, "udp_stream": 271, "frame_number": 16221, "timestamp_epoch": "1583962439.874196000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.qry.name": "nvzkinvuuinkgs.mondogreek.com", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 53321, "event_id": "evt-a0bf3542cca1073763c54ded", "src_port": 53, "tcp_stream": null, "udp_stream": 270, "frame_number": 16222, "timestamp_epoch": "1583962439.874349000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.qry.name": "roijvdflsx.mondogreek.com", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 54097, "event_id": "evt-ecde5f065c449d71217f557a", "src_port": 53, "tcp_stream": null, "udp_stream": 271, "frame_number": 16224, "timestamp_epoch": "1583962439.874418000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "wpad.mondogreek.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-5279c4c22cc336c569bdba93", "src_port": 52435, "tcp_stream": null, "udp_stream": 275, "frame_number": 16260, "timestamp_epoch": "1583962447.371082000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.qry.name": "wpad.mondogreek.com", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 52435, "event_id": "evt-3b32895240d6cf8efc672021", "src_port": 53, "tcp_stream": null, "udp_stream": 275, "frame_number": 16261, "timestamp_epoch": "1583962447.371328000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "wpad.mondogreek.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-44f9156e3f84a22fbeff1c9c", "src_port": 50188, "tcp_stream": null, "udp_stream": 277, "frame_number": 16265, "timestamp_epoch": "1583962447.375652000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.qry.name": "wpad.mondogreek.com", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 50188, "event_id": "evt-2ba12a4e483c40afa0a52016", "src_port": 53, "tcp_stream": null, "udp_stream": 277, "frame_number": 16266, "timestamp_epoch": "1583962447.375845000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "wpad.mondogreek.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-0a88ffa8f65e61a758ea49b4", "src_port": 49447, "tcp_stream": null, "udp_stream": 279, "frame_number": 16279, "timestamp_epoch": "1583962452.150148000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.qry.name": "wpad.mondogreek.com", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 49447, "event_id": "evt-e56f8764347b881d94ae42fe", "src_port": 53, "tcp_stream": null, "udp_stream": 279, "frame_number": 16280, "timestamp_epoch": "1583962452.150409000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "wpad.mondogreek.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": 53, "event_id": "evt-259c74b4156b631b854b90e8", "src_port": 63641, "tcp_stream": null, "udp_stream": 280, "frame_number": 16281, "timestamp_epoch": "1583962455.343446000" }, { "kind": "dns", "dst_ip": "10.3.11.194", "fields": { "dns.qry.name": "wpad.mondogreek.com", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 63641, "event_id": "evt-e26a02264177ffe7020cd2ae", "src_port": 53, "tcp_stream": null, "udp_stream": 280, "frame_number": 16282, "timestamp_epoch": "1583962455.343753000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "fareharbor.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-d9d0db1f655ff0b9f3dd5570", "src_port": 61413, "tcp_stream": null, "udp_stream": 281, "frame_number": 16283, "timestamp_epoch": "1583962457.841813000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "54.153.98.238,52.9.108.55", "dns.qry.name": "fareharbor.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 61413, "event_id": "evt-9866b8f72dec8ee017d1e7c3", "src_port": 53, "tcp_stream": null, "udp_stream": 281, "frame_number": 16284, "timestamp_epoch": "1583962457.871573000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "wpad.mondogreek.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.218", "dst_port": 53, "event_id": "evt-60548f758bb8c400fc4e076d", "src_port": 58707, "tcp_stream": null, "udp_stream": 282, "frame_number": 16307, "timestamp_epoch": "1583962465.462576000" }, { "kind": "dns", "dst_ip": "10.3.11.218", "fields": { "dns.qry.name": "wpad.mondogreek.com", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 58707, "event_id": "evt-2924fc948908cf64b10a0857", "src_port": 53, "tcp_stream": null, "udp_stream": 282, "frame_number": 16308, "timestamp_epoch": "1583962465.462886000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "wpad.mondogreek.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-ebc4adc47694be3099966ef2", "src_port": 63948, "tcp_stream": null, "udp_stream": 283, "frame_number": 16320, "timestamp_epoch": "1583962512.155261000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.qry.name": "wpad.mondogreek.com", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 63948, "event_id": "evt-7ab9f35365a8d96886c74476", "src_port": 53, "tcp_stream": null, "udp_stream": 283, "frame_number": 16321, "timestamp_epoch": "1583962512.155592000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "settings-win.data.microsoft.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": 53, "event_id": "evt-0c6a85c4e32c9ba84d26d1a4", "src_port": 57646, "tcp_stream": null, "udp_stream": 284, "frame_number": 16327, "timestamp_epoch": "1583962544.765052000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "settings-win.data.microsoft.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": 53, "event_id": "evt-deb2719f8075c9ede9f599a3", "src_port": 57646, "tcp_stream": null, "udp_stream": 284, "frame_number": 16328, "timestamp_epoch": "1583962544.794759000" }, { "kind": "dns", "dst_ip": "10.3.11.194", "fields": { "dns.a": "40.119.2.214", "dns.cname": "settingsfd-geo.trafficmanager.net", "dns.qry.name": "settings-win.data.microsoft.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 57646, "event_id": "evt-f32b11c3559bfb982c995c01", "src_port": 53, "tcp_stream": null, "udp_stream": 284, "frame_number": 16329, "timestamp_epoch": "1583962544.824732000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "LAPTOP-7XMV2SN.mondogreek.com", "dns.qry.type": "6", "dns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": 53, "event_id": "evt-0cc0a5a429cfe3c4b613d20c", "src_port": 61855, "tcp_stream": null, "udp_stream": 287, "frame_number": 16352, "timestamp_epoch": "1583962544.993385000" }, { "kind": "dns", "dst_ip": "10.3.11.194", "fields": { "dns.a": "10.3.11.3", "dns.qry.name": "LAPTOP-7XMV2SN.mondogreek.com", "dns.qry.type": "6", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 61855, "event_id": "evt-9997504cc774f25a1ff93a47", "src_port": 53, "tcp_stream": null, "udp_stream": 287, "frame_number": 16353, "timestamp_epoch": "1583962544.993657000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.a": "10.3.11.194", "dns.qry.name": "mondogreek.com", "dns.qry.type": "6", "dns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": 53, "event_id": "evt-3f23edb877fc4a7517a9b1bf", "src_port": 63570, "tcp_stream": null, "udp_stream": 288, "frame_number": 16354, "timestamp_epoch": "1583962544.995048000" }, { "kind": "dns", "dst_ip": "10.3.11.194", "fields": { "dns.a": "10.3.11.194", "dns.qry.name": "mondogreek.com", "dns.qry.type": "6", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 63570, "event_id": "evt-cfba0290bc175874eabc467e", "src_port": 53, "tcp_stream": null, "udp_stream": 288, "frame_number": 16355, "timestamp_epoch": "1583962544.995990000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "Mondogreek-DC.mondogreek.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": 53, "event_id": "evt-d7e755f45759d5ea2ddf0ac0", "src_port": 55277, "tcp_stream": null, "udp_stream": 289, "frame_number": 16357, "timestamp_epoch": "1583962545.037411000" }, { "kind": "dns", "dst_ip": "10.3.11.194", "fields": { "dns.a": "10.3.11.3", "dns.qry.name": "Mondogreek-DC.mondogreek.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 55277, "event_id": "evt-0ab681a13f16009cfb8f3be1", "src_port": 53, "tcp_stream": null, "udp_stream": 289, "frame_number": 16358, "timestamp_epoch": "1583962545.037705000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "client.wns.windows.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": 53, "event_id": "evt-a41e1be88622596ed534460a", "src_port": 61273, "tcp_stream": null, "udp_stream": 290, "frame_number": 16380, "timestamp_epoch": "1583962545.186625000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "client.wns.windows.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": 53, "event_id": "evt-5c83b710820080a2430ea6ed", "src_port": 61273, "tcp_stream": null, "udp_stream": 290, "frame_number": 16382, "timestamp_epoch": "1583962545.216605000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "licensing.mp.microsoft.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": 53, "event_id": "evt-1204e76ce4fb0a0b58584ed4", "src_port": 65134, "tcp_stream": null, "udp_stream": 291, "frame_number": 16384, "timestamp_epoch": "1583962545.300032000" }, { "kind": "dns", "dst_ip": "10.3.11.194", "fields": { "dns.a": "40.91.76.238", "dns.cname": "licensing.md.mp.microsoft.com.akadns.net,licensing-uswesteap.md.mp.microsoft.com.akadns.net,mw1.licensing.md.mp.microsoft.com.akadns.net", "dns.qry.name": "licensing.mp.microsoft.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 65134, "event_id": "evt-d4d9c2c6b176abecaec8d00a", "src_port": 53, "tcp_stream": null, "udp_stream": 291, "frame_number": 16385, "timestamp_epoch": "1583962545.300426000" }, { "kind": "dns", "dst_ip": "10.3.11.194", "fields": { "dns.a": "52.230.222.68", "dns.cname": "wns.notify.windows.com.akadns.net,americas1.notify.windows.com.akadns.net,dm3p.wns.notify.windows.com.akadns.net", "dns.qry.name": "client.wns.windows.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 61273, "event_id": "evt-0f279f4d1c0f4e2760d4931f", "src_port": 53, "tcp_stream": null, "udp_stream": 290, "frame_number": 16404, "timestamp_epoch": "1583962545.440932000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "wpad.mondogreek.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": 53, "event_id": "evt-63b91233b9bd550680b98c00", "src_port": 53490, "tcp_stream": null, "udp_stream": 292, "frame_number": 16421, "timestamp_epoch": "1583962545.498982000" }, { "kind": "dns", "dst_ip": "10.3.11.194", "fields": { "dns.qry.name": "wpad.mondogreek.com", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 53490, "event_id": "evt-7c4d67a25f9ee80b91a09214", "src_port": 53, "tcp_stream": null, "udp_stream": 292, "frame_number": 16422, "timestamp_epoch": "1583962545.499270000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": 53, "event_id": "evt-e1994781e6fba27cf3650281", "src_port": 65460, "tcp_stream": null, "udp_stream": 294, "frame_number": 16487, "timestamp_epoch": "1583962547.110221000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": 53, "event_id": "evt-53719e20c691ac9e033ce5d0", "src_port": 65460, "tcp_stream": null, "udp_stream": 294, "frame_number": 16488, "timestamp_epoch": "1583962547.138635000" }, { "kind": "dns", "dst_ip": "10.3.11.194", "fields": { "dns.a": "204.79.197.200,13.107.21.200", "dns.cname": "a-0001.a-afdentry.net.trafficmanager.net,dual-a-0001.a-msedge.net", "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 65460, "event_id": "evt-ec31e96826b9099a111ae78a", "src_port": 53, "tcp_stream": null, "udp_stream": 294, "frame_number": 16489, "timestamp_epoch": "1583962547.149148000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "storecatalogrevocation.storequality.microsoft.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": 53, "event_id": "evt-90ca8767c659165b0720bf32", "src_port": 52038, "tcp_stream": null, "udp_stream": 295, "frame_number": 16522, "timestamp_epoch": "1583962548.988295000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "storecatalogrevocation.storequality.microsoft.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": 53, "event_id": "evt-1ad0fe2d7a107659abb55365", "src_port": 52038, "tcp_stream": null, "udp_stream": 295, "frame_number": 16523, "timestamp_epoch": "1583962549.014811000" }, { "kind": "dns", "dst_ip": "10.3.11.194", "fields": { "dns.a": "23.206.213.111", "dns.cname": "storecatalogrevocation.storequality.microsoft.com.edgekey.net,e10198.b.akamaiedge.net", "dns.qry.name": "storecatalogrevocation.storequality.microsoft.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 52038, "event_id": "evt-9a42fad55fc4afefc5127de2", "src_port": 53, "tcp_stream": null, "udp_stream": 295, "frame_number": 16524, "timestamp_epoch": "1583962549.023492000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "msftspeechmodelsprod.azureedge.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": 53, "event_id": "evt-489e3bb0c98156314e2ff41b", "src_port": 55884, "tcp_stream": null, "udp_stream": 296, "frame_number": 16564, "timestamp_epoch": "1583962549.947731000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "msftspeechmodelsprod.azureedge.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": 53, "event_id": "evt-616ceba90ac022ba6949b614", "src_port": 55884, "tcp_stream": null, "udp_stream": 296, "frame_number": 16565, "timestamp_epoch": "1583962549.968158000" }, { "kind": "dns", "dst_ip": "10.3.11.194", "fields": { "dns.qry.name": "msftspeechmodelsprod.azureedge.net", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 55884, "event_id": "evt-efc140d79fecfad80b6e1ada", "src_port": 53, "tcp_stream": null, "udp_stream": 296, "frame_number": 16566, "timestamp_epoch": "1583962549.969823000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "wpad.mondogreek.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": 53, "event_id": "evt-75649bc682cdcdeff2cd6188", "src_port": 53108, "tcp_stream": null, "udp_stream": 298, "frame_number": 17603, "timestamp_epoch": "1583962563.502331000" }, { "kind": "dns", "dst_ip": "10.3.11.194", "fields": { "dns.qry.name": "wpad.mondogreek.com", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 53108, "event_id": "evt-f28e77a8e375b9ff5f72f6bc", "src_port": 53, "tcp_stream": null, "udp_stream": 298, "frame_number": 17604, "timestamp_epoch": "1583962563.502714000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.Mondogreek-DC.mondogreek.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": 53, "event_id": "evt-0f39586dd6c596294be84f66", "src_port": 63274, "tcp_stream": null, "udp_stream": 301, "frame_number": 20429, "timestamp_epoch": "1583962619.345766000" }, { "kind": "dns", "dst_ip": "10.3.11.194", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.Mondogreek-DC.mondogreek.com", "dns.qry.type": "33", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 63274, "event_id": "evt-3b60f98fc6993f5c1ae02d7d", "src_port": 53, "tcp_stream": null, "udp_stream": 301, "frame_number": 20430, "timestamp_epoch": "1583962619.346051000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "_ldap._tcp.Mondogreek-DC.mondogreek.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": 53, "event_id": "evt-7d72888d38a3ee4acd35d37a", "src_port": 59264, "tcp_stream": null, "udp_stream": 302, "frame_number": 20431, "timestamp_epoch": "1583962619.346638000" }, { "kind": "dns", "dst_ip": "10.3.11.194", "fields": { "dns.qry.name": "_ldap._tcp.Mondogreek-DC.mondogreek.com", "dns.qry.type": "33", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 59264, "event_id": "evt-5585bdb1392410809010d15c", "src_port": 53, "tcp_stream": null, "udp_stream": 302, "frame_number": 20432, "timestamp_epoch": "1583962619.346816000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "wpad.mondogreek.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": 53, "event_id": "evt-2e92c13d3ac565eb9b6b5009", "src_port": 63731, "tcp_stream": null, "udp_stream": 304, "frame_number": 20702, "timestamp_epoch": "1583962623.502662000" }, { "kind": "dns", "dst_ip": "10.3.11.194", "fields": { "dns.qry.name": "wpad.mondogreek.com", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 63731, "event_id": "evt-b8606a821e8f1628d4139e92", "src_port": 53, "tcp_stream": null, "udp_stream": 304, "frame_number": 20703, "timestamp_epoch": "1583962623.503009000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "MONDOGREEK-DC.mondogreek.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": 53, "event_id": "evt-8f0798d419c8fedb1b675c68", "src_port": 57400, "tcp_stream": null, "udp_stream": 305, "frame_number": 21056, "timestamp_epoch": "1583962637.214633000" }, { "kind": "dns", "dst_ip": "10.3.11.194", "fields": { "dns.a": "10.3.11.3", "dns.qry.name": "MONDOGREEK-DC.mondogreek.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 57400, "event_id": "evt-d197517ff43eae0be5a05ac9", "src_port": 53, "tcp_stream": null, "udp_stream": 305, "frame_number": 21057, "timestamp_epoch": "1583962637.214931000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "LAPTOP-I9ZPI04.mondogreek.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": 53, "event_id": "evt-04ee85d340f62ec20e5b0ca0", "src_port": 54422, "tcp_stream": null, "udp_stream": 306, "frame_number": 21063, "timestamp_epoch": "1583962637.217205000" }, { "kind": "dns", "dst_ip": "10.3.11.194", "fields": { "dns.a": "10.3.11.218", "dns.qry.name": "LAPTOP-I9ZPI04.mondogreek.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 54422, "event_id": "evt-95717559823c31e1e8346e5a", "src_port": 53, "tcp_stream": null, "udp_stream": 306, "frame_number": 21064, "timestamp_epoch": "1583962637.217396000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "LAPTOP-SQSA42O.mondogreek.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": 53, "event_id": "evt-41b1b5a4461aedffdcfd2da7", "src_port": 58602, "tcp_stream": null, "udp_stream": 307, "frame_number": 21070, "timestamp_epoch": "1583962637.221006000" }, { "kind": "dns", "dst_ip": "10.3.11.194", "fields": { "dns.a": "10.3.11.119", "dns.qry.name": "LAPTOP-SQSA42O.mondogreek.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 58602, "event_id": "evt-8f4ea4617a1872e90c2776c3", "src_port": 53, "tcp_stream": null, "udp_stream": 307, "frame_number": 21071, "timestamp_epoch": "1583962637.221413000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "newegg.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-d5763b7041ff0ac3016488f2", "src_port": 53423, "tcp_stream": null, "udp_stream": 308, "frame_number": 21114, "timestamp_epoch": "1583962650.283852000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "m.addthis.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-2047edea423004f0fd013487", "src_port": 51518, "tcp_stream": null, "udp_stream": 309, "frame_number": 21115, "timestamp_epoch": "1583962650.283918000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "connect.facebook.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-f9a3ff30c9987de945ffee22", "src_port": 56355, "tcp_stream": null, "udp_stream": 310, "frame_number": 21116, "timestamp_epoch": "1583962650.284728000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "fareharbor.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-187676c4cb8fa5c315f8fb15", "src_port": 55270, "tcp_stream": null, "udp_stream": 311, "frame_number": 21117, "timestamp_epoch": "1583962650.284771000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "wpad.mondogreek.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-45d6248a93be6f4ab62d2f63", "src_port": 63456, "tcp_stream": null, "udp_stream": 312, "frame_number": 21118, "timestamp_epoch": "1583962650.285566000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.qry.name": "wpad.mondogreek.com", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 63456, "event_id": "evt-ddff81e4f1ed9250f5b7fdf3", "src_port": 53, "tcp_stream": null, "udp_stream": 312, "frame_number": 21119, "timestamp_epoch": "1583962650.285771000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "newegg.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-97e7306d299da8d2a350db80", "src_port": 53423, "tcp_stream": null, "udp_stream": 308, "frame_number": 21123, "timestamp_epoch": "1583962650.314584000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "m.addthis.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-ad741e2d1c4d58e3e5b7246c", "src_port": 51518, "tcp_stream": null, "udp_stream": 309, "frame_number": 21124, "timestamp_epoch": "1583962650.314681000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "connect.facebook.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-6efa25a0b0c3a44c938bb334", "src_port": 56355, "tcp_stream": null, "udp_stream": 310, "frame_number": 21125, "timestamp_epoch": "1583962650.316511000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "fareharbor.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-69f04b38542821ee70b3e7ff", "src_port": 55270, "tcp_stream": null, "udp_stream": 311, "frame_number": 21126, "timestamp_epoch": "1583962650.316555000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "72.246.84.150", "dns.cname": "m.addthisedge.com,ds-m.addthisedge.com.edgekey.net,e3615.a.akamaiedge.net", "dns.qry.name": "m.addthis.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 51518, "event_id": "evt-1c55052da5b0982da9fdeae6", "src_port": 53, "tcp_stream": null, "udp_stream": 309, "frame_number": 21127, "timestamp_epoch": "1583962650.340042000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "54.153.98.238,52.9.108.55", "dns.qry.name": "fareharbor.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 55270, "event_id": "evt-513a4ca670ecf67d85eb3d57", "src_port": 53, "tcp_stream": null, "udp_stream": 311, "frame_number": 21128, "timestamp_epoch": "1583962650.340100000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "31.13.65.7", "dns.cname": "scontent.xx.fbcdn.net", "dns.qry.name": "connect.facebook.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 56355, "event_id": "evt-d71f06f2e7aa678e5b74ca3f", "src_port": 53, "tcp_stream": null, "udp_stream": 310, "frame_number": 21130, "timestamp_epoch": "1583962650.341046000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "fh-kit.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-1c839dcca40944f6978b55e9", "src_port": 54141, "tcp_stream": null, "udp_stream": 314, "frame_number": 21131, "timestamp_epoch": "1583962650.341897000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "fonts.googleapis.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-547a2e7eb751506ddbbc0f47", "src_port": 56582, "tcp_stream": null, "udp_stream": 315, "frame_number": 21132, "timestamp_epoch": "1583962650.343191000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "23.199.252.214", "dns.qry.name": "newegg.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 53423, "event_id": "evt-1bee4af75980d9d8ebc620e9", "src_port": 53, "tcp_stream": null, "udp_stream": 308, "frame_number": 21133, "timestamp_epoch": "1583962650.349973000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "fonts.gstatic.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-dccb12ad88cea5b7dbc7846b", "src_port": 50427, "tcp_stream": null, "udp_stream": 316, "frame_number": 21136, "timestamp_epoch": "1583962650.352180000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "fh-kit.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-9fff2a4e0bb69fabfcc9a98c", "src_port": 54141, "tcp_stream": null, "udp_stream": 314, "frame_number": 21137, "timestamp_epoch": "1583962650.372744000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "fonts.googleapis.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-8e13cb8e582ef32b35c19aba", "src_port": 56582, "tcp_stream": null, "udp_stream": 315, "frame_number": 21138, "timestamp_epoch": "1583962650.373590000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "216.58.194.42", "dns.qry.name": "fonts.googleapis.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 56582, "event_id": "evt-03d82899aaaf06cb8a2887f1", "src_port": 53, "tcp_stream": null, "udp_stream": 315, "frame_number": 21139, "timestamp_epoch": "1583962650.374617000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "img1.wsimg.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-7069ee6fd9ca7163b6d7f6bd", "src_port": 60835, "tcp_stream": null, "udp_stream": 317, "frame_number": 21140, "timestamp_epoch": "1583962650.376392000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "fonts.gstatic.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-2806b0635fd661e31f784617", "src_port": 50427, "tcp_stream": null, "udp_stream": 316, "frame_number": 21141, "timestamp_epoch": "1583962650.382634000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "216.58.194.131", "dns.cname": "gstaticadssl.l.google.com", "dns.qry.name": "fonts.gstatic.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 50427, "event_id": "evt-4b710dcc7e4ee47ce8748985", "src_port": 53, "tcp_stream": null, "udp_stream": 316, "frame_number": 21142, "timestamp_epoch": "1583962650.383619000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "104.26.9.32,104.26.8.32", "dns.qry.name": "fh-kit.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 54141, "event_id": "evt-88bf2c18592db626a1c81ce9", "src_port": 53, "tcp_stream": null, "udp_stream": 314, "frame_number": 21145, "timestamp_epoch": "1583962650.385341000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "img2.wsimg.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-16dcfcebd301968ada41e623", "src_port": 61619, "tcp_stream": null, "udp_stream": 318, "frame_number": 21148, "timestamp_epoch": "1583962650.385872000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "img4.wsimg.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-b4ad0f8990c8b332463b4ec0", "src_port": 62359, "tcp_stream": null, "udp_stream": 319, "frame_number": 21149, "timestamp_epoch": "1583962650.387061000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "img1.wsimg.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-5c07e08f3f11983e82c0acad", "src_port": 60835, "tcp_stream": null, "udp_stream": 317, "frame_number": 21156, "timestamp_epoch": "1583962650.407657000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "img2.wsimg.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-f4bff1b3122e113260919896", "src_port": 61619, "tcp_stream": null, "udp_stream": 318, "frame_number": 21157, "timestamp_epoch": "1583962650.416650000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "img4.wsimg.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-4e35f3f8eaf425aa1c9d8459", "src_port": 62359, "tcp_stream": null, "udp_stream": 319, "frame_number": 21158, "timestamp_epoch": "1583962650.417627000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "23.211.18.27", "dns.cname": "global-wildcard.wsimg.com.edgekey.net,e2836.g.akamaiedge.net", "dns.qry.name": "img2.wsimg.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 61619, "event_id": "evt-95bcb072e3fa68a10fe28445", "src_port": 53, "tcp_stream": null, "udp_stream": 318, "frame_number": 21159, "timestamp_epoch": "1583962650.459214000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "23.211.18.27", "dns.cname": "global-wildcard.wsimg.com.edgekey.net,e2836.g.akamaiedge.net", "dns.qry.name": "img1.wsimg.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 60835, "event_id": "evt-f4029474ee124c43d1d52bd5", "src_port": 53, "tcp_stream": null, "udp_stream": 317, "frame_number": 21160, "timestamp_epoch": "1583962650.459266000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "23.211.18.27", "dns.cname": "global-wildcard.wsimg.com.edgekey.net,e2836.g.akamaiedge.net", "dns.qry.name": "img4.wsimg.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 62359, "event_id": "evt-c8a711858ac5159d8c6ac272", "src_port": 53, "tcp_stream": null, "udp_stream": 319, "frame_number": 21161, "timestamp_epoch": "1583962650.459342000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "nebula.wsimg.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-975193c27d453ad61aabffa5", "src_port": 61173, "tcp_stream": null, "udp_stream": 320, "frame_number": 21162, "timestamp_epoch": "1583962650.461201000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "platform.twitter.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-a3985697bc74c6152e2e7a2c", "src_port": 65247, "tcp_stream": null, "udp_stream": 321, "frame_number": 21163, "timestamp_epoch": "1583962650.461396000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "s7.addthis.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-b65d9cab0a6e279f07db1ebc", "src_port": 57606, "tcp_stream": null, "udp_stream": 322, "frame_number": 21164, "timestamp_epoch": "1583962650.461620000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "www.newegg.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-4d629518b972b398fbdc47bf", "src_port": 62981, "tcp_stream": null, "udp_stream": 323, "frame_number": 21179, "timestamp_epoch": "1583962650.483652000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "nebula.wsimg.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-5d944d870cd01414941d60ae", "src_port": 61173, "tcp_stream": null, "udp_stream": 320, "frame_number": 21182, "timestamp_epoch": "1583962650.491671000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "s7.addthis.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-bde19f5b941e3e994137104f", "src_port": 57606, "tcp_stream": null, "udp_stream": 322, "frame_number": 21183, "timestamp_epoch": "1583962650.492719000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "platform.twitter.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-ff791975bda552e993967129", "src_port": 65247, "tcp_stream": null, "udp_stream": 321, "frame_number": 21184, "timestamp_epoch": "1583962650.492792000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "104.105.248.178", "dns.cname": "wildcard.wsimg.com.edgekey.net,e2149.c.akamaiedge.net", "dns.qry.name": "nebula.wsimg.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 61173, "event_id": "evt-3e93749c3a196605fc7fab3d", "src_port": 53, "tcp_stream": null, "udp_stream": 320, "frame_number": 21185, "timestamp_epoch": "1583962650.504416000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "72.246.84.150", "dns.cname": "s8.addthis.com,ds-s7.addthis.com.edgekey.net,e3615.a.akamaiedge.net", "dns.qry.name": "s7.addthis.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 57606, "event_id": "evt-6f01338ff3655aef3f2120fb", "src_port": 53, "tcp_stream": null, "udp_stream": 322, "frame_number": 21187, "timestamp_epoch": "1583962650.507613000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "v1.addthisedge.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-0604c44e042643bafcb88e8e", "src_port": 58852, "tcp_stream": null, "udp_stream": 324, "frame_number": 21190, "timestamp_epoch": "1583962650.507885000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "www.facebook.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-a29542486dd5ead4fa2d395d", "src_port": 58019, "tcp_stream": null, "udp_stream": 325, "frame_number": 21191, "timestamp_epoch": "1583962650.509056000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "www.newegg.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-702d727343f7df6c3bf906c8", "src_port": 62981, "tcp_stream": null, "udp_stream": 323, "frame_number": 21192, "timestamp_epoch": "1583962650.514704000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "72.21.91.66", "dns.cname": "cs472.wac.edgecastcdn.net,cs1-apr-8315.wac.edgecastcdn.net,wac.apr-8315.edgecastdns.net,cs1-lb-us.8315.ecdns.net,cs41.wac.edgecastcdn.net", "dns.qry.name": "platform.twitter.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 65247, "event_id": "evt-dcfb6c8fae939fbbf83c57d2", "src_port": 53, "tcp_stream": null, "udp_stream": 321, "frame_number": 21194, "timestamp_epoch": "1583962650.527524000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "72.246.84.229", "dns.cname": "newegg.com.edgekey.net,e5638.a.akamaiedge.net", "dns.qry.name": "www.newegg.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 62981, "event_id": "evt-6a7215fd06b1f80838874835", "src_port": 53, "tcp_stream": null, "udp_stream": 323, "frame_number": 21195, "timestamp_epoch": "1583962650.527591000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "www.tuscaloosabarnyard.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-9aaffe8f56934d3b6f771389", "src_port": 65305, "tcp_stream": null, "udp_stream": 326, "frame_number": 21197, "timestamp_epoch": "1583962650.530170000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "v1.addthisedge.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-7d42596b36b5854d9fd0e51a", "src_port": 58852, "tcp_stream": null, "udp_stream": 324, "frame_number": 21198, "timestamp_epoch": "1583962650.538697000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "www.facebook.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-c6052d6dd037b8a3a1f40055", "src_port": 58019, "tcp_stream": null, "udp_stream": 325, "frame_number": 21199, "timestamp_epoch": "1583962650.539670000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "72.246.84.150", "dns.cname": "v1.addthisedge.com.edgekey.net,e3615.a.akamaiedge.net", "dns.qry.name": "v1.addthisedge.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 58852, "event_id": "evt-99b0637dc5cb7770677fd982", "src_port": 53, "tcp_stream": null, "udp_stream": 324, "frame_number": 21204, "timestamp_epoch": "1583962650.557545000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "31.13.65.36", "dns.cname": "star-mini.c10r.facebook.com", "dns.qry.name": "www.facebook.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 58019, "event_id": "evt-80f800443c036cf0775aa7c1", "src_port": 53, "tcp_stream": null, "udp_stream": 325, "frame_number": 21205, "timestamp_epoch": "1583962650.557596000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "z.moatads.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-55499f52e78dffcd23d60562", "src_port": 53158, "tcp_stream": null, "udp_stream": 327, "frame_number": 21206, "timestamp_epoch": "1583962650.558947000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "www.tuscaloosabarnyard.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-edbfcb9baacad5f9ecc8d0f6", "src_port": 65305, "tcp_stream": null, "udp_stream": 326, "frame_number": 21207, "timestamp_epoch": "1583962650.560528000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "z.moatads.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-c36b10ffd82cd7f1380f14a7", "src_port": 53158, "tcp_stream": null, "udp_stream": 327, "frame_number": 21210, "timestamp_epoch": "1583962650.589603000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "72.167.191.69", "dns.cname": "tuscaloosabarnyard.com", "dns.qry.name": "www.tuscaloosabarnyard.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 65305, "event_id": "evt-fef050e3dca003f4ddb12b71", "src_port": 53, "tcp_stream": null, "udp_stream": 326, "frame_number": 21211, "timestamp_epoch": "1583962650.607967000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "23.199.253.242", "dns.cname": "wildcard.moatads.com.edgekey.net,e13136.g.akamaiedge.net", "dns.qry.name": "z.moatads.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 53158, "event_id": "evt-94b51fe0f8a9bc928f435f90", "src_port": 53, "tcp_stream": null, "udp_stream": 327, "frame_number": 21212, "timestamp_epoch": "1583962650.608017000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "assets.adobedtm.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-72185b2b84f1209a3c4f76ab", "src_port": 63162, "tcp_stream": null, "udp_stream": 328, "frame_number": 21274, "timestamp_epoch": "1583962650.898819000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "promotions.newegg.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-c443eed8867f1db4b04fd7eb", "src_port": 65272, "tcp_stream": null, "udp_stream": 329, "frame_number": 21281, "timestamp_epoch": "1583962650.899420000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "c1.neweggimages.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-ce36baca622c26477911f773", "src_port": 50155, "tcp_stream": null, "udp_stream": 330, "frame_number": 21282, "timestamp_epoch": "1583962650.899589000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "23.199.253.39", "dns.cname": "cn-assets.adobedtm.com.edgekey.net,e7808.g.akamaiedge.net", "dns.qry.name": "assets.adobedtm.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 63162, "event_id": "evt-32e7fbccf191200e163e0dbc", "src_port": 53, "tcp_stream": null, "udp_stream": 328, "frame_number": 21288, "timestamp_epoch": "1583962650.943602000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "72.246.84.229", "dns.cname": "newegg.com.edgekey.net,e5638.a.akamaiedge.net", "dns.qry.name": "c1.neweggimages.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 50155, "event_id": "evt-12f6c33581750f7e71d053b6", "src_port": 53, "tcp_stream": null, "udp_stream": 330, "frame_number": 21289, "timestamp_epoch": "1583962650.943689000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "72.246.84.229", "dns.cname": "newegg.com.edgekey.net,e5638.a.akamaiedge.net", "dns.qry.name": "promotions.newegg.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 65272, "event_id": "evt-b62775cee9769c31b7adcef3", "src_port": 53, "tcp_stream": null, "udp_stream": 329, "frame_number": 21290, "timestamp_epoch": "1583962650.943765000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "images10.newegg.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-122f0d510a4e78a09e5d68be", "src_port": 57957, "tcp_stream": null, "udp_stream": 331, "frame_number": 21294, "timestamp_epoch": "1583962650.958089000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "tags.tiqcdn.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-255c30fc5faf342f5ef16eb7", "src_port": 56081, "tcp_stream": null, "udp_stream": 332, "frame_number": 21296, "timestamp_epoch": "1583962650.959746000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "secure.newegg.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-c0559a11e944a0340c2de150", "src_port": 56487, "tcp_stream": null, "udp_stream": 333, "frame_number": 21297, "timestamp_epoch": "1583962650.960120000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "imk.neweggimages.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-354cda54d3b523a3e053d319", "src_port": 59947, "tcp_stream": null, "udp_stream": 334, "frame_number": 21306, "timestamp_epoch": "1583962650.967564000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "se.monetate.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-d23f62f0d68cf1f71d21b45c", "src_port": 59946, "tcp_stream": null, "udp_stream": 335, "frame_number": 21317, "timestamp_epoch": "1583962650.973530000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "152.199.4.210", "dns.cname": "cs2005.wpc.alphacdn.net", "dns.qry.name": "tags.tiqcdn.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 56081, "event_id": "evt-4e4bd7fba0a12b71d93aaee3", "src_port": 53, "tcp_stream": null, "udp_stream": 332, "frame_number": 21318, "timestamp_epoch": "1583962650.986719000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "images10.newegg.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-36740c1d7527a2d6c11a73cf", "src_port": 57957, "tcp_stream": null, "udp_stream": 331, "frame_number": 21321, "timestamp_epoch": "1583962650.988589000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "states.newegg.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-8d09e19c0629fb7fbd2a2630", "src_port": 51241, "tcp_stream": null, "udp_stream": 336, "frame_number": 21322, "timestamp_epoch": "1583962650.989158000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "secure.newegg.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-99a1f19f7ca5d9c3f7253e6c", "src_port": 56487, "tcp_stream": null, "udp_stream": 333, "frame_number": 21354, "timestamp_epoch": "1583962650.991794000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "imk.neweggimages.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-9c2a23fef13b188805893f8f", "src_port": 59947, "tcp_stream": null, "udp_stream": 334, "frame_number": 21363, "timestamp_epoch": "1583962650.999518000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "72.246.84.229", "dns.cname": "newegg.com.edgekey.net,e5638.a.akamaiedge.net", "dns.qry.name": "secure.newegg.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 56487, "event_id": "evt-be7bd1073ca7a4928f829db0", "src_port": 53, "tcp_stream": null, "udp_stream": 333, "frame_number": 21364, "timestamp_epoch": "1583962651.000088000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "help.newegg.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-76a4b1417a58314c3b132af8", "src_port": 54281, "tcp_stream": null, "udp_stream": 337, "frame_number": 21366, "timestamp_epoch": "1583962651.002847000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "se.monetate.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-16dd1bbaa1366e4de90d1c11", "src_port": 59946, "tcp_stream": null, "udp_stream": 335, "frame_number": 21367, "timestamp_epoch": "1583962651.004532000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "states.newegg.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-f59b68b1b025954cd9752a58", "src_port": 51241, "tcp_stream": null, "udp_stream": 336, "frame_number": 21372, "timestamp_epoch": "1583962651.019716000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "help.newegg.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-b2111fa0cf74ad29b2972624", "src_port": 54281, "tcp_stream": null, "udp_stream": 337, "frame_number": 21374, "timestamp_epoch": "1583962651.035144000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "72.246.84.229", "dns.cname": "newegg.com.edgekey.net,e5638.a.akamaiedge.net", "dns.qry.name": "images10.newegg.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 57957, "event_id": "evt-6abb2ecab157608f296ceaec", "src_port": 53, "tcp_stream": null, "udp_stream": 331, "frame_number": 21376, "timestamp_epoch": "1583962651.053207000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "sealserver.trustwave.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-42a4f40378eb0c7c33a0cb0d", "src_port": 61059, "tcp_stream": null, "udp_stream": 338, "frame_number": 21378, "timestamp_epoch": "1583962651.055367000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "sealserver.trustwave.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-bd2798f82d366e7a05a88ef3", "src_port": 61059, "tcp_stream": null, "udp_stream": 338, "frame_number": 21379, "timestamp_epoch": "1583962651.086538000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "3.219.244.74,3.208.14.195,34.234.23.242", "dns.cname": "newegg.com.ssl.sc.omtrdc.net", "dns.qry.name": "states.newegg.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 51241, "event_id": "evt-c62c8d763ccbe67f052cae95", "src_port": 53, "tcp_stream": null, "udp_stream": 336, "frame_number": 21384, "timestamp_epoch": "1583962651.092080000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "72.246.84.229", "dns.cname": "newegg.com.edgekey.net,e5638.a.akamaiedge.net", "dns.qry.name": "help.newegg.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 54281, "event_id": "evt-4c22231fc137441fcb698c1a", "src_port": 53, "tcp_stream": null, "udp_stream": 337, "frame_number": 21385, "timestamp_epoch": "1583962651.092134000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "ec-apis.newegg.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-6ed002f41da615990db5c4f5", "src_port": 52037, "tcp_stream": null, "udp_stream": 339, "frame_number": 21387, "timestamp_epoch": "1583962651.094883000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "pf.newegg.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-be899ce43e46f7cc7bf09dc4", "src_port": 52214, "tcp_stream": null, "udp_stream": 340, "frame_number": 21389, "timestamp_epoch": "1583962651.096911000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "ec-apis.newegg.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-588c2000e80fb2dc1188c7f3", "src_port": 52037, "tcp_stream": null, "udp_stream": 339, "frame_number": 21402, "timestamp_epoch": "1583962651.125734000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "104.117.242.71", "dns.cname": "http2.monetate.edgekey.net,e4361.b.akamaiedge.net", "dns.qry.name": "se.monetate.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 59946, "event_id": "evt-7b0c5437ab84731222070092", "src_port": 53, "tcp_stream": null, "udp_stream": 335, "frame_number": 21451, "timestamp_epoch": "1583962651.128381000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "pf.newegg.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-3e210be59c628b7ce14d1c93", "src_port": 52214, "tcp_stream": null, "udp_stream": 340, "frame_number": 21462, "timestamp_epoch": "1583962651.129190000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "72.246.84.229", "dns.cname": "newegg.com.edgekey.net,e5638.a.akamaiedge.net", "dns.qry.name": "imk.neweggimages.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 59947, "event_id": "evt-cbf8f24a0cb857b8c05f3de4", "src_port": 53, "tcp_stream": null, "udp_stream": 334, "frame_number": 21479, "timestamp_epoch": "1583962651.129702000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "23.204.16.227", "dns.cname": "login.trustwave.com.edgekey.net,e5631.b.akamaiedge.net", "dns.qry.name": "sealserver.trustwave.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 61059, "event_id": "evt-d21831648a0e3fc5813f0d63", "src_port": 53, "tcp_stream": null, "udp_stream": 338, "frame_number": 21482, "timestamp_epoch": "1583962651.129952000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "72.246.84.229", "dns.cname": "newegg.com.edgekey.net,e5638.a.akamaiedge.net", "dns.qry.name": "pf.newegg.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 52214, "event_id": "evt-4dc18a08df40284d900fa63a", "src_port": 53, "tcp_stream": null, "udp_stream": 340, "frame_number": 21486, "timestamp_epoch": "1583962651.132407000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "www2.newegg.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-37c17d62b83b0275bbad9be7", "src_port": 62654, "tcp_stream": null, "udp_stream": 341, "frame_number": 21520, "timestamp_epoch": "1583962651.150243000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "www2.newegg.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-bc6beb82fe4f93cecf25ecd8", "src_port": 62654, "tcp_stream": null, "udp_stream": 341, "frame_number": 21564, "timestamp_epoch": "1583962651.182553000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "72.246.84.229", "dns.cname": "newegg.com.edgekey.net,e5638.a.akamaiedge.net", "dns.qry.name": "ec-apis.newegg.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 52037, "event_id": "evt-23df5c3dbf5a6982d7723359", "src_port": 53, "tcp_stream": null, "udp_stream": 339, "frame_number": 21566, "timestamp_epoch": "1583962651.194645000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "72.246.84.229", "dns.cname": "newegg.com.edgekey.net,e5638.a.akamaiedge.net", "dns.qry.name": "www2.newegg.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 62654, "event_id": "evt-6e8b758416976f5e351c6bd5", "src_port": 53, "tcp_stream": null, "udp_stream": 341, "frame_number": 21634, "timestamp_epoch": "1583962651.199027000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "crl.securetrust.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-5a1ea5881aee91c943e1f527", "src_port": 51865, "tcp_stream": null, "udp_stream": 342, "frame_number": 21822, "timestamp_epoch": "1583962651.315788000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "crl.securetrust.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-47d65bcf64087468430f9894", "src_port": 51865, "tcp_stream": null, "udp_stream": 342, "frame_number": 21890, "timestamp_epoch": "1583962651.357204000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "23.63.253.208,23.63.253.147", "dns.cname": "crl.securetrust.com.edgesuite.net,a229.d.akamai.net", "dns.qry.name": "crl.securetrust.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 51865, "event_id": "evt-4507f15a40465cca27aad86e", "src_port": 53, "tcp_stream": null, "udp_stream": 342, "frame_number": 21898, "timestamp_epoch": "1583962651.368700000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "dpm.demdex.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-16641daeefbc8bfc3ea1ca17", "src_port": 65012, "tcp_stream": null, "udp_stream": 343, "frame_number": 21903, "timestamp_epoch": "1583962651.419370000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "dpm.demdex.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-d4b0e84ddd1a11c024b87928", "src_port": 65012, "tcp_stream": null, "udp_stream": 343, "frame_number": 21913, "timestamp_epoch": "1583962651.451829000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "34.208.131.21,34.209.127.1,34.208.36.157,35.167.5.179,34.212.232.109,35.161.52.15,35.163.173.161,35.161.118.223", "dns.cname": "gslb-2.demdex.net,edge-usw2.demdex.net,dcs-edge-usw2-620097651.us-west-2.elb.amazonaws.com", "dns.qry.name": "dpm.demdex.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 65012, "event_id": "evt-bc63f0a7bdb420a0294d8beb", "src_port": 53, "tcp_stream": null, "udp_stream": 343, "frame_number": 21915, "timestamp_epoch": "1583962651.475025000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "f.monetate.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-1006671968e0c4eb4d5d2dd7", "src_port": 62050, "tcp_stream": null, "udp_stream": 345, "frame_number": 23645, "timestamp_epoch": "1583962652.091134000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "sb.monetate.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-f5a12ad0330b50e0920cc869", "src_port": 51146, "tcp_stream": null, "udp_stream": 346, "frame_number": 23646, "timestamp_epoch": "1583962652.091185000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "sb.monetate.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-e3fa77b6188c4742fd4ee5fb", "src_port": 51146, "tcp_stream": null, "udp_stream": 346, "frame_number": 23650, "timestamp_epoch": "1583962652.122053000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "f.monetate.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-a21c9cc1eafca137be06378e", "src_port": 62050, "tcp_stream": null, "udp_stream": 345, "frame_number": 23651, "timestamp_epoch": "1583962652.122192000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "104.117.242.71", "dns.cname": "http2.monetate.edgekey.net,e4361.b.akamaiedge.net", "dns.qry.name": "sb.monetate.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 51146, "event_id": "evt-fe44dcd776922a4c24316bad", "src_port": 53, "tcp_stream": null, "udp_stream": 346, "frame_number": 23655, "timestamp_epoch": "1583962652.135603000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "34.211.22.199,34.208.124.133,34.213.227.128", "dns.cname": "f.monetate.net.akadns.net,f-us-west-2.monetate.net.akadns.net", "dns.qry.name": "f.monetate.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 62050, "event_id": "evt-54d90313abacf1d5210ad559", "src_port": 53, "tcp_stream": null, "udp_stream": 345, "frame_number": 23659, "timestamp_epoch": "1583962652.155462000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "newegginc.demdex.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-5e6699abb79925a0a81015b9", "src_port": 51707, "tcp_stream": null, "udp_stream": 348, "frame_number": 23792, "timestamp_epoch": "1583962652.394288000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "34.209.127.1,34.208.36.157,35.167.5.179,34.212.232.109,35.161.52.15,35.163.173.161,35.161.118.223,34.208.131.21", "dns.cname": "gslb-2.demdex.net,edge-usw2.demdex.net,dcs-edge-usw2-620097651.us-west-2.elb.amazonaws.com", "dns.qry.name": "newegginc.demdex.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 51707, "event_id": "evt-a51c35f5a4650a0f65b9e3b5", "src_port": 53, "tcp_stream": null, "udp_stream": 348, "frame_number": 23807, "timestamp_epoch": "1583962652.422875000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "edge.microsoft.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-ec773d66e7c3933f83bc6d8b", "src_port": 61563, "tcp_stream": null, "udp_stream": 349, "frame_number": 23844, "timestamp_epoch": "1583962652.593652000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "cm.everesttech.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-f37c094734bddb8232786612", "src_port": 55614, "tcp_stream": null, "udp_stream": 350, "frame_number": 23846, "timestamp_epoch": "1583962652.619274000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "13.107.6.158", "dns.cname": "edge-microsoft-com.b-0005.b-msedge.net,b-0005.b-msedge.net", "dns.qry.name": "edge.microsoft.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 61563, "event_id": "evt-9caa2b2fba5185282432325c", "src_port": 53, "tcp_stream": null, "udp_stream": 349, "frame_number": 23849, "timestamp_epoch": "1583962652.620832000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "cm.everesttech.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-efde7292e04f08dd415c7115", "src_port": 55614, "tcp_stream": null, "udp_stream": 350, "frame_number": 23889, "timestamp_epoch": "1583962652.649600000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "192.243.232.58", "dns.cname": "cm.everesttech.net.akadns.net", "dns.qry.name": "cm.everesttech.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 55614, "event_id": "evt-c2d1e5b1726b5a6bad802b63", "src_port": 53, "tcp_stream": null, "udp_stream": 350, "frame_number": 23890, "timestamp_epoch": "1583962652.656673000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "www.googlecommerce.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-ef9fb37184865f17067e8789", "src_port": 64697, "tcp_stream": null, "udp_stream": 351, "frame_number": 24051, "timestamp_epoch": "1583962652.857426000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "www.googletagservices.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-c5138bd6de27f697b3c5ec3b", "src_port": 54997, "tcp_stream": null, "udp_stream": 352, "frame_number": 24058, "timestamp_epoch": "1583962652.858903000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "www.googlecommerce.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-9b81235a0199225537dc8480", "src_port": 64697, "tcp_stream": null, "udp_stream": 351, "frame_number": 24062, "timestamp_epoch": "1583962652.888732000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "www.googletagservices.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-6033a212e611c6adbfe91d87", "src_port": 54997, "tcp_stream": null, "udp_stream": 352, "frame_number": 24063, "timestamp_epoch": "1583962652.890727000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "172.217.14.162", "dns.cname": "pagead46.l.doubleclick.net", "dns.qry.name": "www.googletagservices.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 54997, "event_id": "evt-8dff0c1c5cda5f6fa7c86ed2", "src_port": 53, "tcp_stream": null, "udp_stream": 352, "frame_number": 24064, "timestamp_epoch": "1583962652.905894000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "172.217.6.174", "dns.cname": "www3.l.google.com", "dns.qry.name": "www.googlecommerce.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 64697, "event_id": "evt-f57ad35f900f77afe5438cfe", "src_port": 53, "tcp_stream": null, "udp_stream": 351, "frame_number": 24065, "timestamp_epoch": "1583962652.905991000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "www.google.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-608dc134b83509f7b8277e0f", "src_port": 61444, "tcp_stream": null, "udp_stream": 353, "frame_number": 24218, "timestamp_epoch": "1583962653.093030000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "adservice.google.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-51fbd0d6198fc9fb02a3750c", "src_port": 56975, "tcp_stream": null, "udp_stream": 354, "frame_number": 24221, "timestamp_epoch": "1583962653.095219000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "securepubads.g.doubleclick.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-e3fc3df5eee3c36a0202fd7a", "src_port": 62209, "tcp_stream": null, "udp_stream": 355, "frame_number": 24222, "timestamp_epoch": "1583962653.095819000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "www.google.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-cc485ab967b593bfae51aa59", "src_port": 61444, "tcp_stream": null, "udp_stream": 353, "frame_number": 24223, "timestamp_epoch": "1583962653.124048000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "adservice.google.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-4120ab6573ddbb7f9c404838", "src_port": 56975, "tcp_stream": null, "udp_stream": 354, "frame_number": 24224, "timestamp_epoch": "1583962653.126042000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "securepubads.g.doubleclick.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-6d9bc8bc0e3372062eacaf2f", "src_port": 62209, "tcp_stream": null, "udp_stream": 355, "frame_number": 24225, "timestamp_epoch": "1583962653.126996000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "216.58.194.98", "dns.cname": "partnerad.l.doubleclick.net", "dns.qry.name": "securepubads.g.doubleclick.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 62209, "event_id": "evt-cd6fd8be9e4710d780d014c7", "src_port": 53, "tcp_stream": null, "udp_stream": 355, "frame_number": 24226, "timestamp_epoch": "1583962653.139608000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "172.217.9.4", "dns.qry.name": "www.google.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 61444, "event_id": "evt-d1b2064ee845da1029626df0", "src_port": 53, "tcp_stream": null, "udp_stream": 353, "frame_number": 24231, "timestamp_epoch": "1583962653.141149000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "172.217.14.162", "dns.cname": "pagead46.l.doubleclick.net", "dns.qry.name": "adservice.google.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 56975, "event_id": "evt-32cd4e0cd4e47ea7a4fae383", "src_port": 53, "tcp_stream": null, "udp_stream": 354, "frame_number": 24232, "timestamp_epoch": "1583962653.141217000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "apis.google.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-441a1612903c1df6ed5994fa", "src_port": 61809, "tcp_stream": null, "udp_stream": 356, "frame_number": 24434, "timestamp_epoch": "1583962654.458457000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "tpc.googlesyndication.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-c78b02b50976da3eb08c7c33", "src_port": 60213, "tcp_stream": null, "udp_stream": 358, "frame_number": 24519, "timestamp_epoch": "1583962654.479483000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "apis.google.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-1fac05c7eace0cf7604b61af", "src_port": 61809, "tcp_stream": null, "udp_stream": 356, "frame_number": 24522, "timestamp_epoch": "1583962654.490285000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "172.217.6.142", "dns.cname": "plus.l.google.com", "dns.qry.name": "apis.google.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 61809, "event_id": "evt-946c47641ee085c4c19e93cd", "src_port": 53, "tcp_stream": null, "udp_stream": 356, "frame_number": 24523, "timestamp_epoch": "1583962654.493084000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "172.217.14.161", "dns.qry.name": "tpc.googlesyndication.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 60213, "event_id": "evt-66e9211daebf86bbc618f5fe", "src_port": 53, "tcp_stream": null, "udp_stream": 358, "frame_number": 24531, "timestamp_epoch": "1583962654.503997000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "www.google-analytics.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-c890aa1ccd319b1eb7397c61", "src_port": 54273, "tcp_stream": null, "udp_stream": 359, "frame_number": 24663, "timestamp_epoch": "1583962654.581676000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "216.58.193.142", "dns.cname": "www-google-analytics.l.google.com", "dns.qry.name": "www.google-analytics.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 54273, "event_id": "evt-0647978b9b1359a0503cc787", "src_port": 53, "tcp_stream": null, "udp_stream": 359, "frame_number": 24672, "timestamp_epoch": "1583962654.604448000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "stats.g.doubleclick.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-7656e10d65586ad315a29072", "src_port": 65237, "tcp_stream": null, "udp_stream": 361, "frame_number": 24769, "timestamp_epoch": "1583962654.673446000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "stats.g.doubleclick.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-a29e37cd18dc932147a0f1ae", "src_port": 65237, "tcp_stream": null, "udp_stream": 361, "frame_number": 24781, "timestamp_epoch": "1583962654.704131000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "173.194.223.154,173.194.223.157,173.194.223.156,173.194.223.155", "dns.cname": "stats.l.doubleclick.net", "dns.qry.name": "stats.g.doubleclick.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 65237, "event_id": "evt-da5374eca29b172e2730343e", "src_port": 53, "tcp_stream": null, "udp_stream": 361, "frame_number": 24784, "timestamp_epoch": "1583962654.705612000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "play.google.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-3ce7c1fbe5e644de1c3d5a1e", "src_port": 56203, "tcp_stream": null, "udp_stream": 364, "frame_number": 25127, "timestamp_epoch": "1583962655.240794000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "play.google.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-75d12f0aefda6ffe965938fa", "src_port": 56203, "tcp_stream": null, "udp_stream": 364, "frame_number": 25129, "timestamp_epoch": "1583962655.272099000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "172.217.1.142", "dns.qry.name": "play.google.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 56203, "event_id": "evt-832bcbf5007e7bbdfbf47434", "src_port": 53, "tcp_stream": null, "udp_stream": 364, "frame_number": 25130, "timestamp_epoch": "1583962655.290011000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "www.googleadservices.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-8d1fb26cfc83410debe12c7c", "src_port": 49244, "tcp_stream": null, "udp_stream": 365, "frame_number": 25141, "timestamp_epoch": "1583962655.316585000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "172.217.2.226", "dns.cname": "pagead.l.doubleclick.net", "dns.qry.name": "www.googleadservices.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 49244, "event_id": "evt-9932ff5444dcb599dc98d7d0", "src_port": 53, "tcp_stream": null, "udp_stream": 365, "frame_number": 25148, "timestamp_epoch": "1583962655.347719000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "dx.steelhousemedia.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-c3d094579c70ac2a23f69abf", "src_port": 60709, "tcp_stream": null, "udp_stream": 366, "frame_number": 25216, "timestamp_epoch": "1583962655.433700000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "triggeredmail.appspot.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-573fad7a19badedc542acbda", "src_port": 64699, "tcp_stream": null, "udp_stream": 367, "frame_number": 25218, "timestamp_epoch": "1583962655.435019000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "www.googletagmanager.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-d39ab757be615c62c7c04e43", "src_port": 60660, "tcp_stream": null, "udp_stream": 368, "frame_number": 25221, "timestamp_epoch": "1583962655.435607000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "tag.rmp.rakuten.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-b962374697a6a945d3592859", "src_port": 50114, "tcp_stream": null, "udp_stream": 369, "frame_number": 25222, "timestamp_epoch": "1583962655.435701000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "sts.eccmp.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-62377a7cf537ed04c2b8411c", "src_port": 55143, "tcp_stream": null, "udp_stream": 370, "frame_number": 25223, "timestamp_epoch": "1583962655.435951000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "dx.steelhousemedia.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-64c157fbf6f5ba8b4c76476b", "src_port": 60709, "tcp_stream": null, "udp_stream": 366, "frame_number": 25225, "timestamp_epoch": "1583962655.464475000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "triggeredmail.appspot.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-e5990acea21c2603331f2adc", "src_port": 64699, "tcp_stream": null, "udp_stream": 367, "frame_number": 25226, "timestamp_epoch": "1583962655.465486000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "www.googletagmanager.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-f2cc6aee1b2390e19e8bde75", "src_port": 60660, "tcp_stream": null, "udp_stream": 368, "frame_number": 25227, "timestamp_epoch": "1583962655.466445000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "tag.rmp.rakuten.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-a4180580479543a76fb3af8c", "src_port": 50114, "tcp_stream": null, "udp_stream": 369, "frame_number": 25228, "timestamp_epoch": "1583962655.466524000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "sts.eccmp.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-b271d66bb58b48a2d5a2e9f7", "src_port": 55143, "tcp_stream": null, "udp_stream": 370, "frame_number": 25229, "timestamp_epoch": "1583962655.466589000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "34.102.147.248", "dns.qry.name": "tag.rmp.rakuten.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 50114, "event_id": "evt-170b67f99d07f598286a3bb2", "src_port": 53, "tcp_stream": null, "udp_stream": 369, "frame_number": 25241, "timestamp_epoch": "1583962655.496450000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "169.60.153.61", "dns.qry.name": "dx.steelhousemedia.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 60709, "event_id": "evt-5372586540f6f0a53a55b0da", "src_port": 53, "tcp_stream": null, "udp_stream": 366, "frame_number": 25242, "timestamp_epoch": "1583962655.496520000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "172.217.12.84", "dns.qry.name": "triggeredmail.appspot.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 64699, "event_id": "evt-1cb8d81d088b3618dc5ba394", "src_port": 53, "tcp_stream": null, "udp_stream": 367, "frame_number": 25243, "timestamp_epoch": "1583962655.496736000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "63.148.46.76", "dns.qry.name": "sts.eccmp.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 55143, "event_id": "evt-e93732ecff964eee2c6c35d2", "src_port": 53, "tcp_stream": null, "udp_stream": 370, "frame_number": 25244, "timestamp_epoch": "1583962655.496790000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "216.58.194.104", "dns.cname": "www-googletagmanager.l.google.com", "dns.qry.name": "www.googletagmanager.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 60660, "event_id": "evt-41c9fe67de08b974884024c9", "src_port": 53, "tcp_stream": null, "udp_stream": 368, "frame_number": 25254, "timestamp_epoch": "1583962655.506747000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "bid.g.doubleclick.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-668704248c19409afa2ab3be", "src_port": 52438, "tcp_stream": null, "udp_stream": 371, "frame_number": 25262, "timestamp_epoch": "1583962655.531120000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "googleads.g.doubleclick.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-2aead41a65bb651c97ac20d9", "src_port": 58921, "tcp_stream": null, "udp_stream": 372, "frame_number": 25263, "timestamp_epoch": "1583962655.532578000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "bid.g.doubleclick.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-a1f2e91f5410a2a439a53b0f", "src_port": 52438, "tcp_stream": null, "udp_stream": 371, "frame_number": 25277, "timestamp_epoch": "1583962655.563393000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "googleads.g.doubleclick.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-96f070a2a26df77d967b6f56", "src_port": 58921, "tcp_stream": null, "udp_stream": 372, "frame_number": 25278, "timestamp_epoch": "1583962655.564369000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "172.217.14.162", "dns.cname": "pagead46.l.doubleclick.net", "dns.qry.name": "googleads.g.doubleclick.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 58921, "event_id": "evt-a62c16e7e3f676a1444b1896", "src_port": 53, "tcp_stream": null, "udp_stream": 372, "frame_number": 25283, "timestamp_epoch": "1583962655.597916000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "173.194.223.154,173.194.223.155,173.194.223.157,173.194.223.156", "dns.cname": "ads-bid.l.doubleclick.net", "dns.qry.name": "bid.g.doubleclick.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 52438, "event_id": "evt-527051a775ae62a9dae57f98", "src_port": 53, "tcp_stream": null, "udp_stream": 371, "frame_number": 25284, "timestamp_epoch": "1583962655.597976000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "storage.googleapis.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-ff0f149f3faeb3dd526d8cb3", "src_port": 63814, "tcp_stream": null, "udp_stream": 374, "frame_number": 25497, "timestamp_epoch": "1583962655.838210000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "216.58.194.112", "dns.qry.name": "storage.googleapis.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 63814, "event_id": "evt-99c7a7c4b23facba496b2068", "src_port": 53, "tcp_stream": null, "udp_stream": 374, "frame_number": 25499, "timestamp_epoch": "1583962655.863798000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "ut.ra.linksynergy.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-0d803cfcd9b07ffeeab19be1", "src_port": 64754, "tcp_stream": null, "udp_stream": 375, "frame_number": 25507, "timestamp_epoch": "1583962655.894777000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "tags.rd.linksynergy.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-8d1c1ceda6ab81b85a8a7530", "src_port": 62712, "tcp_stream": null, "udp_stream": 376, "frame_number": 25508, "timestamp_epoch": "1583962655.895642000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "consent.linksynergy.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-d4a3d99b63ea8e6007537417", "src_port": 58194, "tcp_stream": null, "udp_stream": 377, "frame_number": 25509, "timestamp_epoch": "1583962655.895821000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "consent.nxtck.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-0d1dbd0b1b54292b4ad6193b", "src_port": 50983, "tcp_stream": null, "udp_stream": 378, "frame_number": 25510, "timestamp_epoch": "1583962655.895972000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "consent.mediaforge.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-7c8361ee01a783121957e25d", "src_port": 56354, "tcp_stream": null, "udp_stream": 379, "frame_number": 25511, "timestamp_epoch": "1583962655.896684000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "consent.jrs5.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-104dfb833a6a6e970b4e4b6e", "src_port": 53792, "tcp_stream": null, "udp_stream": 380, "frame_number": 25512, "timestamp_epoch": "1583962655.896748000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "consent.jrs5.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-4907b58a36051becbcaf5f86", "src_port": 53792, "tcp_stream": null, "udp_stream": 380, "frame_number": 25526, "timestamp_epoch": "1583962655.921391000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "consent.mediaforge.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-15fce6ae11a24eb1050e5536", "src_port": 56354, "tcp_stream": null, "udp_stream": 379, "frame_number": 25527, "timestamp_epoch": "1583962655.921483000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "consent.nxtck.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-71858af78f55d6ca397162fe", "src_port": 50983, "tcp_stream": null, "udp_stream": 378, "frame_number": 25528, "timestamp_epoch": "1583962655.921556000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "consent.linksynergy.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-a4e6b8a5a2d0a1b3c6e7be90", "src_port": 58194, "tcp_stream": null, "udp_stream": 377, "frame_number": 25529, "timestamp_epoch": "1583962655.921656000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "tags.rd.linksynergy.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-1c036f0fadcf8f180ab291d6", "src_port": 62712, "tcp_stream": null, "udp_stream": 376, "frame_number": 25530, "timestamp_epoch": "1583962655.921742000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "ut.ra.linksynergy.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-12d36043d24b8b87f805d96b", "src_port": 64754, "tcp_stream": null, "udp_stream": 375, "frame_number": 25531, "timestamp_epoch": "1583962655.921875000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "34.98.67.3", "dns.cname": "tags-cluster.rd.linksynergy.com", "dns.qry.name": "tags.rd.linksynergy.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 62712, "event_id": "evt-434a279109538b950bdf4160", "src_port": 53, "tcp_stream": null, "udp_stream": 376, "frame_number": 25538, "timestamp_epoch": "1583962655.936276000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "35.241.23.116", "dns.qry.name": "ut.ra.linksynergy.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 64754, "event_id": "evt-959f9d4365c2779438253dd5", "src_port": 53, "tcp_stream": null, "udp_stream": 375, "frame_number": 25539, "timestamp_epoch": "1583962655.936347000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "35.241.23.116", "dns.qry.name": "consent.nxtck.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 50983, "event_id": "evt-c9cf3a9f74b84c49398aa666", "src_port": 53, "tcp_stream": null, "udp_stream": 378, "frame_number": 25540, "timestamp_epoch": "1583962655.936451000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "35.241.23.116", "dns.qry.name": "consent.jrs5.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 53792, "event_id": "evt-d71781957b0973a8079d7cf8", "src_port": 53, "tcp_stream": null, "udp_stream": 380, "frame_number": 25541, "timestamp_epoch": "1583962655.936519000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "35.241.23.116", "dns.qry.name": "consent.mediaforge.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 56354, "event_id": "evt-f13ce5c0b71fb620ceff83a0", "src_port": 53, "tcp_stream": null, "udp_stream": 379, "frame_number": 25542, "timestamp_epoch": "1583962655.936624000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "consent.dc-storm.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-8253c1fd2f60de6d0d046636", "src_port": 63763, "tcp_stream": null, "udp_stream": 381, "frame_number": 25544, "timestamp_epoch": "1583962655.937905000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "35.241.23.116", "dns.qry.name": "consent.dc-storm.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 63763, "event_id": "evt-677fd7faaf8876dfd17fe850", "src_port": 53, "tcp_stream": null, "udp_stream": 381, "frame_number": 25557, "timestamp_epoch": "1583962655.958527000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "35.241.23.116", "dns.qry.name": "consent.linksynergy.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 58194, "event_id": "evt-03f3a2c00863d3f413d84788", "src_port": 53, "tcp_stream": null, "udp_stream": 377, "frame_number": 25648, "timestamp_epoch": "1583962656.140330000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "loadus.exelator.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-b02017b90fbe60a840fad4e8", "src_port": 54599, "tcp_stream": null, "udp_stream": 382, "frame_number": 25903, "timestamp_epoch": "1583962656.768455000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "idsync.rlcdn.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-7bedb0ed876543473df0ef46", "src_port": 61961, "tcp_stream": null, "udp_stream": 383, "frame_number": 25904, "timestamp_epoch": "1583962656.769038000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "35.190.72.21", "dns.qry.name": "idsync.rlcdn.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 61961, "event_id": "evt-db0dbe365a436193fb82dbee", "src_port": 53, "tcp_stream": null, "udp_stream": 383, "frame_number": 25912, "timestamp_epoch": "1583962656.790277000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "nypi.dc-storm.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-6e138b4ae33a90d1e91c245a", "src_port": 50804, "tcp_stream": null, "udp_stream": 384, "frame_number": 25914, "timestamp_epoch": "1583962656.791774000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "loadus.exelator.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-7a8a12c929808c6161b08f51", "src_port": 54599, "tcp_stream": null, "udp_stream": 382, "frame_number": 25915, "timestamp_epoch": "1583962656.799530000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "35.241.23.116", "dns.qry.name": "nypi.dc-storm.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 50804, "event_id": "evt-6b7715746e470bc2561683c6", "src_port": 53, "tcp_stream": null, "udp_stream": 384, "frame_number": 25919, "timestamp_epoch": "1583962656.815109000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "139.178.81.9", "dns.cname": "loadus.tm.ssl.exelator.com,us-central.load.exelator.com,load-dfw2.exelator.com", "dns.qry.name": "loadus.exelator.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 54599, "event_id": "evt-8d8b856de6b210e1175388b2", "src_port": 53, "tcp_stream": null, "udp_stream": 382, "frame_number": 25928, "timestamp_epoch": "1583962656.834296000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "act-us.rd.linksynergy.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-03b8f6eb26f459449fb29846", "src_port": 50155, "tcp_stream": null, "udp_stream": 330, "frame_number": 25994, "timestamp_epoch": "1583962656.928365000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "match.adsrvr.org", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-e4c5c602be2e2df237c16564", "src_port": 56974, "tcp_stream": null, "udp_stream": 385, "frame_number": 25995, "timestamp_epoch": "1583962656.929467000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "insight.adsrvr.org", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-b7c617be84e401c403506fce", "src_port": 56845, "tcp_stream": null, "udp_stream": 386, "frame_number": 25998, "timestamp_epoch": "1583962656.931409000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "130.211.21.54", "dns.qry.name": "act-us.rd.linksynergy.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 50155, "event_id": "evt-2421805f74a6863233d9d050", "src_port": 53, "tcp_stream": null, "udp_stream": 330, "frame_number": 26006, "timestamp_epoch": "1583962656.958202000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "3.225.102.19,34.236.165.152,18.232.32.205,52.201.53.231,3.212.136.177,52.23.116.187,52.3.121.18,54.83.97.43", "dns.cname": "match-975362022.us-east-1.elb.amazonaws.com", "dns.qry.name": "match.adsrvr.org", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 56974, "event_id": "evt-1956ff511ab5d23776a6bfcb", "src_port": 53, "tcp_stream": null, "udp_stream": 385, "frame_number": 26007, "timestamp_epoch": "1583962656.958475000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "18.213.117.209,3.92.109.57,34.192.244.88,18.204.46.201,34.194.253.146,54.86.220.14,54.83.179.223,18.208.78.141", "dns.cname": "insight-760077375.us-east-1.elb.amazonaws.com", "dns.qry.name": "insight.adsrvr.org", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 56845, "event_id": "evt-91fe344414566dd3636ad611", "src_port": 53, "tcp_stream": null, "udp_stream": 386, "frame_number": 26010, "timestamp_epoch": "1583962656.960973000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "load77.exelator.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-ad58bc58024bb9561bee8b07", "src_port": 51185, "tcp_stream": null, "udp_stream": 387, "frame_number": 26056, "timestamp_epoch": "1583962657.099368000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "eu-u.openx.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-fdecefdd5939fa142bc9adbb", "src_port": 55664, "tcp_stream": null, "udp_stream": 388, "frame_number": 26057, "timestamp_epoch": "1583962657.102978000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "pixel.advertising.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-753deedb52c160bd68e3ff67", "src_port": 53590, "tcp_stream": null, "udp_stream": 389, "frame_number": 26058, "timestamp_epoch": "1583962657.103947000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "pixel.rubiconproject.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-593a595b9ed3100a4de4f618", "src_port": 56269, "tcp_stream": null, "udp_stream": 390, "frame_number": 26059, "timestamp_epoch": "1583962657.104542000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "secure.adnxs.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-33261cca3f8b56376b264a5d", "src_port": 50978, "tcp_stream": null, "udp_stream": 391, "frame_number": 26060, "timestamp_epoch": "1583962657.105078000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "cm.g.doubleclick.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-e6913dff1637e813da9082fe", "src_port": 54600, "tcp_stream": null, "udp_stream": 392, "frame_number": 26061, "timestamp_epoch": "1583962657.105888000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "8.43.72.97,8.43.72.98", "dns.cname": "pixel.rubiconproject.net.akadns.net", "dns.qry.name": "pixel.rubiconproject.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 56269, "event_id": "evt-3aa82eb3994d2cfbe1195987", "src_port": 53, "tcp_stream": null, "udp_stream": 390, "frame_number": 26082, "timestamp_epoch": "1583962657.125860000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "104.254.148.166,104.254.149.68,104.254.149.100,104.254.149.101,104.254.148.133,104.254.148.196,104.254.149.69,104.254.148.165", "dns.cname": "g.geogslb.com,ib.anycast.adnxs.com", "dns.qry.name": "secure.adnxs.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 50978, "event_id": "evt-72b974e48ebedf142088c023", "src_port": 53, "tcp_stream": null, "udp_stream": 391, "frame_number": 26083, "timestamp_epoch": "1583962657.125928000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "dsum-sec.casalemedia.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-017aafef9caf53265f4a7c91", "src_port": 51848, "tcp_stream": null, "udp_stream": 393, "frame_number": 26085, "timestamp_epoch": "1583962657.127019000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "rtb-csync.smartadserver.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-df58ed5d54bdbda73dae6dc7", "src_port": 63298, "tcp_stream": null, "udp_stream": 394, "frame_number": 26087, "timestamp_epoch": "1583962657.128132000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "load77.exelator.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-4be197ed8da5fd20fcf34d65", "src_port": 51185, "tcp_stream": null, "udp_stream": 387, "frame_number": 26088, "timestamp_epoch": "1583962657.129850000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "89.187.164.37", "dns.cname": "1605158521.rsc.cdn77.org", "dns.qry.name": "load77.exelator.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 51185, "event_id": "evt-3df1872e12cff93d82b246d2", "src_port": 53, "tcp_stream": null, "udp_stream": 387, "frame_number": 26089, "timestamp_epoch": "1583962657.131237000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "172.217.2.226", "dns.cname": "pagead.l.doubleclick.net", "dns.qry.name": "cm.g.doubleclick.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 54600, "event_id": "evt-58a57f988829f1072cf96b46", "src_port": 53, "tcp_stream": null, "udp_stream": 392, "frame_number": 26090, "timestamp_epoch": "1583962657.131301000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "match.360yield.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-f09c2248bcda430bc245b735", "src_port": 57992, "tcp_stream": null, "udp_stream": 395, "frame_number": 26092, "timestamp_epoch": "1583962657.132574000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "eu-u.openx.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-4255a4780bf422ab5bbe0ca5", "src_port": 55664, "tcp_stream": null, "udp_stream": 388, "frame_number": 26094, "timestamp_epoch": "1583962657.134765000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "pixel.advertising.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-321f2ec7a35ca968a33cf93d", "src_port": 53590, "tcp_stream": null, "udp_stream": 389, "frame_number": 26095, "timestamp_epoch": "1583962657.134863000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "35.244.140.139", "dns.qry.name": "eu-u.openx.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 55664, "event_id": "evt-ea10df111b91796af45919f8", "src_port": 53, "tcp_stream": null, "udp_stream": 388, "frame_number": 26097, "timestamp_epoch": "1583962657.136998000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "3.215.9.190,3.213.24.71,34.193.215.190,18.211.91.10,3.211.188.196,3.217.52.69,52.70.73.113,54.197.51.7", "dns.cname": "prod.ups-adcom.aolp-ds-prd.aws.oath.cloud,prod.ups-us-east-1.aolp-ds-prd.aws.oath.cloud", "dns.qry.name": "pixel.advertising.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 53590, "event_id": "evt-62ab15dd28bd6957ad5f540f", "src_port": 53, "tcp_stream": null, "udp_stream": 389, "frame_number": 26098, "timestamp_epoch": "1583962657.137080000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "dsum-sec.casalemedia.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-c326a82bc85d45ffccc6217c", "src_port": 51848, "tcp_stream": null, "udp_stream": 393, "frame_number": 26109, "timestamp_epoch": "1583962657.157861000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "rtb-csync.smartadserver.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-d5e3a9ebb70fecdf6b460d4b", "src_port": 63298, "tcp_stream": null, "udp_stream": 394, "frame_number": 26110, "timestamp_epoch": "1583962657.158825000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "match.360yield.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-96ab356f1e62a1b15e7783e7", "src_port": 57992, "tcp_stream": null, "udp_stream": 395, "frame_number": 26111, "timestamp_epoch": "1583962657.163780000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "34.231.157.146,34.224.92.105,34.225.211.231,52.204.222.100,52.2.35.4,34.206.247.240,54.173.98.209,52.73.178.122", "dns.cname": "ice.360yield.com,na-ice.360yield.com", "dns.qry.name": "match.360yield.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 57992, "event_id": "evt-127773844f91af0b99faf83f", "src_port": 53, "tcp_stream": null, "udp_stream": 395, "frame_number": 26128, "timestamp_epoch": "1583962657.176778000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "23.199.253.53", "dns.cname": "dsum-sec.casalemedia.com.edgekey.net,e8037.g.akamaiedge.net", "dns.qry.name": "dsum-sec.casalemedia.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 51848, "event_id": "evt-a4fa6b15771531b3360cd41b", "src_port": 53, "tcp_stream": null, "udp_stream": 393, "frame_number": 26147, "timestamp_epoch": "1583962657.208179000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "199.187.193.166", "dns.cname": "2-01-275d-002d.cdx.cedexis.net,rtb-csync-tmk.smartadserver.com", "dns.qry.name": "rtb-csync.smartadserver.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 63298, "event_id": "evt-93e40e4fd61acef6ae05355a", "src_port": 53, "tcp_stream": null, "udp_stream": 394, "frame_number": 26180, "timestamp_epoch": "1583962657.266607000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "mapping.nxtck.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-2e6138c75405d3eba5e3ead1", "src_port": 50547, "tcp_stream": null, "udp_stream": 396, "frame_number": 26212, "timestamp_epoch": "1583962657.289583000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "mapping.nxtck.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-994eeaedd164e273e24a660f", "src_port": 50547, "tcp_stream": null, "udp_stream": 396, "frame_number": 26215, "timestamp_epoch": "1583962657.320871000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "130.211.28.134", "dns.qry.name": "mapping.nxtck.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 50547, "event_id": "evt-7043032f8056e023ce1933ea", "src_port": 53, "tcp_stream": null, "udp_stream": 396, "frame_number": 26217, "timestamp_epoch": "1583962657.348534000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "image2.pubmatic.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-3b7cae9575627786e5dee478", "src_port": 54613, "tcp_stream": null, "udp_stream": 397, "frame_number": 26221, "timestamp_epoch": "1583962657.352782000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "104.36.113.17", "dns.cname": "pug33000nfc.pubmatic.com,pug33000nf.pubmatic.com", "dns.qry.name": "image2.pubmatic.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 54613, "event_id": "evt-179ed64441c0341963ea9a08", "src_port": 53, "tcp_stream": null, "udp_stream": 397, "frame_number": 26254, "timestamp_epoch": "1583962657.367426000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "ups.analytics.yahoo.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-9d77ee9bcee642922a315067", "src_port": 64649, "tcp_stream": null, "udp_stream": 398, "frame_number": 26390, "timestamp_epoch": "1583962657.753969000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "ups.analytics.yahoo.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-9263cd5d963d9a063d45c58f", "src_port": 64649, "tcp_stream": null, "udp_stream": 398, "frame_number": 26391, "timestamp_epoch": "1583962657.784497000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "52.45.33.138,3.218.90.66,54.175.87.114", "dns.cname": "prod.ups-ats.aolp-ds-prd.aws.oath.cloud,prod.ups-ats.us-east-1.aolp-ds-prd.aws.oath.cloud", "dns.qry.name": "ups.analytics.yahoo.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 64649, "event_id": "evt-05bd19399487bfcdf69aa03c", "src_port": 53, "tcp_stream": null, "udp_stream": 398, "frame_number": 26392, "timestamp_epoch": "1583962657.788154000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "px.steelhousemedia.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-340f334e3b7091efb9a5ad81", "src_port": 62904, "tcp_stream": null, "udp_stream": 399, "frame_number": 26432, "timestamp_epoch": "1583962658.957656000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "169.46.74.216", "dns.cname": "pxtm.steelhousemedia.com", "dns.qry.name": "px.steelhousemedia.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 62904, "event_id": "evt-2da40bc7ed27c766f48cd479", "src_port": 53, "tcp_stream": null, "udp_stream": 399, "frame_number": 26433, "timestamp_epoch": "1583962658.985207000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "ww.steelhousemedia.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-b99bbe2512723cd9ad20fd1c", "src_port": 49360, "tcp_stream": null, "udp_stream": 400, "frame_number": 26454, "timestamp_epoch": "1583962659.156343000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "ww.steelhousemedia.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-c1917b40c6227c402cc26ed7", "src_port": 49360, "tcp_stream": null, "udp_stream": 400, "frame_number": 26455, "timestamp_epoch": "1583962659.187302000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "ww.steelhousemedia.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-c106fe26fef1e4b8cc067413", "src_port": 49360, "tcp_stream": null, "udp_stream": 400, "frame_number": 26458, "timestamp_epoch": "1583962660.218284000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "match.prod.bidr.io", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-17dc2123d40ae2040992d95a", "src_port": 63410, "tcp_stream": null, "udp_stream": 401, "frame_number": 26527, "timestamp_epoch": "1583962661.413763000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "match.prod.bidr.io", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-c68e56e3fe3f034a72f13177", "src_port": 63410, "tcp_stream": null, "udp_stream": 401, "frame_number": 26534, "timestamp_epoch": "1583962661.444881000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "34.234.197.182,52.202.136.43,34.232.94.82,35.169.43.149,52.0.81.73,34.231.65.133,52.202.7.233,52.204.219.227", "dns.qry.name": "match.prod.bidr.io", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 63410, "event_id": "evt-c9213216d2f2982799fd9e3b", "src_port": 53, "tcp_stream": null, "udp_stream": 401, "frame_number": 26535, "timestamp_epoch": "1583962661.464277000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "cookie-sync-service-prod.steelhousemedia.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-3e8b36f0e07e5a7b506c0c73", "src_port": 58304, "tcp_stream": null, "udp_stream": 402, "frame_number": 26574, "timestamp_epoch": "1583962661.807697000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "cookie-sync-service-prod.steelhousemedia.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-8c7cdeecb83dc3bcb03ddd5d", "src_port": 58304, "tcp_stream": null, "udp_stream": 402, "frame_number": 26575, "timestamp_epoch": "1583962661.827699000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "54.244.36.123,54.213.212.101,54.68.183.142", "dns.cname": "cookie.coreprod.west2.steelhouse.com", "dns.qry.name": "cookie-sync-service-prod.steelhousemedia.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 58304, "event_id": "evt-0ed9a167f935779481062026", "src_port": 53, "tcp_stream": null, "udp_stream": 402, "frame_number": 26577, "timestamp_epoch": "1583962661.873966000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "ww.steelhousemedia.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-8dfc1991da03841178c48efc", "src_port": 49360, "tcp_stream": null, "udp_stream": 400, "frame_number": 26599, "timestamp_epoch": "1583962662.232347000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "169.60.140.161", "dns.qry.name": "ww.steelhousemedia.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 49360, "event_id": "evt-2c7052379c519f3dec9a1a8c", "src_port": 53, "tcp_stream": null, "udp_stream": 400, "frame_number": 26616, "timestamp_epoch": "1583962663.610644000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "login.live.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": 53, "event_id": "evt-f647ef7a99c5c57a6340a447", "src_port": 56144, "tcp_stream": null, "udp_stream": 404, "frame_number": 26722, "timestamp_epoch": "1583962683.947152000" }, { "kind": "dns", "dst_ip": "10.3.11.194", "fields": { "dns.a": "40.90.22.187,40.90.22.190,40.90.22.185", "dns.cname": "login.msa.msidentity.com,lgin.msa.trafficmanager.net", "dns.qry.name": "login.live.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 56144, "event_id": "evt-074cc6443166e86c6e87120e", "src_port": 53, "tcp_stream": null, "udp_stream": 404, "frame_number": 26723, "timestamp_epoch": "1583962683.965713000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "watson.telemetry.microsoft.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": 53, "event_id": "evt-aba8551478a3109352082278", "src_port": 53595, "tcp_stream": null, "udp_stream": 405, "frame_number": 26765, "timestamp_epoch": "1583962684.318184000" }, { "kind": "dns", "dst_ip": "10.3.11.194", "fields": { "dns.a": "20.44.86.43", "dns.cname": "umwatson.trafficmanager.net", "dns.qry.name": "watson.telemetry.microsoft.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 53595, "event_id": "evt-ad7619a2076cbbd7d42e2193", "src_port": 53, "tcp_stream": null, "udp_stream": 405, "frame_number": 26766, "timestamp_epoch": "1583962684.331866000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "config.edge.skype.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.218", "dst_port": 53, "event_id": "evt-09311307de5ea12d93d69d85", "src_port": 53550, "tcp_stream": null, "udp_stream": 406, "frame_number": 26794, "timestamp_epoch": "1583962685.572318000" }, { "kind": "dns", "dst_ip": "10.3.11.218", "fields": { "dns.a": "13.107.3.128", "dns.cname": "s-0001.s-msedge.net", "dns.qry.name": "config.edge.skype.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 53550, "event_id": "evt-ead2adc9fbc937a05d1d9dc0", "src_port": 53, "tcp_stream": null, "udp_stream": 406, "frame_number": 26795, "timestamp_epoch": "1583962685.586418000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "config.edge.skype.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-04a65c910eee6e778af97330", "src_port": 61295, "tcp_stream": null, "udp_stream": 407, "frame_number": 27313, "timestamp_epoch": "1583962732.810115000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.a": "13.107.3.128", "dns.cname": "s-0001.s-msedge.net", "dns.qry.name": "config.edge.skype.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 61295, "event_id": "evt-0c7fc02e2991a06f267f4aaa", "src_port": 53, "tcp_stream": null, "udp_stream": 407, "frame_number": 27314, "timestamp_epoch": "1583962732.810552000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "ctldl.windowsupdate.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": 53, "event_id": "evt-87dcef0d69d5552238ae2fcf", "src_port": 60724, "tcp_stream": null, "udp_stream": 408, "frame_number": 27386, "timestamp_epoch": "1583962744.495077000" }, { "kind": "dns", "dst_ip": "10.3.11.194", "fields": { "dns.a": "205.185.216.42,205.185.216.10", "dns.cname": "audownload.windowsupdate.nsatc.net,au.download.windowsupdate.com.hwcdn.net,cds.d2s7q6s2.hwcdn.net", "dns.qry.name": "ctldl.windowsupdate.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 60724, "event_id": "evt-0ac4a1f276efb65b8db03f66", "src_port": 53, "tcp_stream": null, "udp_stream": 408, "frame_number": 27387, "timestamp_epoch": "1583962744.515705000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "licensing.mp.microsoft.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": 53, "event_id": "evt-440acc684741735edd13485f", "src_port": 53486, "tcp_stream": null, "udp_stream": 409, "frame_number": 27434, "timestamp_epoch": "1583962857.458795000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "licensing.mp.microsoft.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": 53, "event_id": "evt-85ad5b49dc315c2c6cdce4f1", "src_port": 53486, "tcp_stream": null, "udp_stream": 409, "frame_number": 27435, "timestamp_epoch": "1583962857.474997000" }, { "kind": "dns", "dst_ip": "10.3.11.194", "fields": { "dns.a": "40.91.76.238", "dns.cname": "licensing.md.mp.microsoft.com.akadns.net,licensing-uswesteap.md.mp.microsoft.com.akadns.net,mw1.licensing.md.mp.microsoft.com.akadns.net", "dns.qry.name": "licensing.mp.microsoft.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 53486, "event_id": "evt-24cffb8990eb2bdd0f00eb97", "src_port": 53, "tcp_stream": null, "udp_stream": 409, "frame_number": 27436, "timestamp_epoch": "1583962857.635043000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "storecatalogrevocation.storequality.microsoft.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": 53, "event_id": "evt-ca9eebcadcd16c00b6487f37", "src_port": 65286, "tcp_stream": null, "udp_stream": 410, "frame_number": 27476, "timestamp_epoch": "1583962861.337942000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "storecatalogrevocation.storequality.microsoft.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": 53, "event_id": "evt-8dafabe0070da15fd7f1c51b", "src_port": 65286, "tcp_stream": null, "udp_stream": 410, "frame_number": 27477, "timestamp_epoch": "1583962861.365380000" }, { "kind": "dns", "dst_ip": "10.3.11.194", "fields": { "dns.a": "23.206.213.111", "dns.cname": "storecatalogrevocation.storequality.microsoft.com.edgekey.net,e10198.b.akamaiedge.net", "dns.qry.name": "storecatalogrevocation.storequality.microsoft.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 65286, "event_id": "evt-203c0c15bf2b9426413c7a4c", "src_port": 53, "tcp_stream": null, "udp_stream": 410, "frame_number": 27478, "timestamp_epoch": "1583962861.371315000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "slscr.update.microsoft.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": 53, "event_id": "evt-b0194b833d242e70243d7273", "src_port": 56438, "tcp_stream": null, "udp_stream": 411, "frame_number": 27536, "timestamp_epoch": "1583962904.728695000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "slscr.update.microsoft.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": 53, "event_id": "evt-a9547834b864ca541ac2f7e4", "src_port": 56438, "tcp_stream": null, "udp_stream": 411, "frame_number": 27537, "timestamp_epoch": "1583962904.757302000" }, { "kind": "dns", "dst_ip": "10.3.11.194", "fields": { "dns.a": "13.78.168.230", "dns.cname": "slscr.update.microsoft.com.akadns.net,sls.update.microsoft.com.akadns.net,sls.row.update.microsoft.com.akadns.net", "dns.qry.name": "slscr.update.microsoft.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 56438, "event_id": "evt-7cff16db16654bfa5c977400", "src_port": 53, "tcp_stream": null, "udp_stream": 411, "frame_number": 27538, "timestamp_epoch": "1583962904.881940000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "hakunamatatata.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": 53, "event_id": "evt-aebe07ca505eed4ab2786816", "src_port": 49943, "tcp_stream": null, "udp_stream": 412, "frame_number": 27773, "timestamp_epoch": "1583963020.371821000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "hakunamatatata.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": 53, "event_id": "evt-8a3f21ef08ca00f58e6a056c", "src_port": 49943, "tcp_stream": null, "udp_stream": 412, "frame_number": 27774, "timestamp_epoch": "1583963020.402252000" }, { "kind": "dns", "dst_ip": "10.3.11.194", "fields": { "dns.a": "199.247.13.144", "dns.qry.name": "hakunamatatata.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 49943, "event_id": "evt-b036b5d7fba3da500c24840d", "src_port": 53, "tcp_stream": null, "udp_stream": 412, "frame_number": 27775, "timestamp_epoch": "1583963020.430853000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "helpforyourservice.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": 53, "event_id": "evt-b91b5cfa33537db1d3979157", "src_port": 56810, "tcp_stream": null, "udp_stream": 413, "frame_number": 28319, "timestamp_epoch": "1583963031.180089000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "helpforyourservice.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": 53, "event_id": "evt-c7592f2a88446aea17115134", "src_port": 56810, "tcp_stream": null, "udp_stream": 413, "frame_number": 28320, "timestamp_epoch": "1583963031.199448000" }, { "kind": "dns", "dst_ip": "10.3.11.194", "fields": { "dns.a": "209.97.130.197", "dns.qry.name": "helpforyourservice.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 56810, "event_id": "evt-42af9f116a9bc63139cac887", "src_port": 53, "tcp_stream": null, "udp_stream": 413, "frame_number": 28321, "timestamp_epoch": "1583963031.223332000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "wpad.mondogreek.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.218", "dst_port": 53, "event_id": "evt-de4b6d449b911d08be7632b4", "src_port": 58264, "tcp_stream": null, "udp_stream": 414, "frame_number": 28846, "timestamp_epoch": "1583963065.465244000" }, { "kind": "dns", "dst_ip": "10.3.11.218", "fields": { "dns.qry.name": "wpad.mondogreek.com", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 58264, "event_id": "evt-a8d832a7c49291d9637157a6", "src_port": 53, "tcp_stream": null, "udp_stream": 414, "frame_number": 28847, "timestamp_epoch": "1583963065.465635000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "wpad.mondogreek.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-042a2d8f5bfba27520ae269c", "src_port": 59835, "tcp_stream": null, "udp_stream": 415, "frame_number": 29346, "timestamp_epoch": "1583963112.169489000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.qry.name": "wpad.mondogreek.com", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 59835, "event_id": "evt-859f9f343382157ba6d942ac", "src_port": 53, "tcp_stream": null, "udp_stream": 415, "frame_number": 29347, "timestamp_epoch": "1583963112.169749000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "wpad.mondogreek.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": 53, "event_id": "evt-d45e3806da7158afb105c780", "src_port": 56399, "tcp_stream": null, "udp_stream": 416, "frame_number": 29837, "timestamp_epoch": "1583963223.504005000" }, { "kind": "dns", "dst_ip": "10.3.11.194", "fields": { "dns.qry.name": "wpad.mondogreek.com", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 56399, "event_id": "evt-5621b03cd2c07ee99d9e1110", "src_port": 53, "tcp_stream": null, "udp_stream": 416, "frame_number": 29838, "timestamp_epoch": "1583963223.504293000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "nexusrules.officeapps.live.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": 53, "event_id": "evt-b504510618a18a0393393761", "src_port": 49660, "tcp_stream": null, "udp_stream": 417, "frame_number": 29844, "timestamp_epoch": "1583963487.664315000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "nexusrules.officeapps.live.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": 53, "event_id": "evt-ca615e2cfe595d9827a0364b", "src_port": 49660, "tcp_stream": null, "udp_stream": 417, "frame_number": 29845, "timestamp_epoch": "1583963487.694128000" }, { "kind": "dns", "dst_ip": "10.3.11.194", "fields": { "dns.a": "52.109.88.36", "dns.cname": "prod.nexusrules.live.com.akadns.net", "dns.qry.name": "nexusrules.officeapps.live.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 49660, "event_id": "evt-69d680cd8625e8b728fcf5ee", "src_port": 53, "tcp_stream": null, "udp_stream": 417, "frame_number": 29846, "timestamp_epoch": "1583963487.731856000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "wpad.mondogreek.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.218", "dst_port": 53, "event_id": "evt-bdc6825987e5ce77a8646aa0", "src_port": 64762, "tcp_stream": null, "udp_stream": 418, "frame_number": 30005, "timestamp_epoch": "1583963665.508882000" }, { "kind": "dns", "dst_ip": "10.3.11.218", "fields": { "dns.qry.name": "wpad.mondogreek.com", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 64762, "event_id": "evt-15daa6b169e12f840ef86b6e", "src_port": 53, "tcp_stream": null, "udp_stream": 418, "frame_number": 30006, "timestamp_epoch": "1583963665.509255000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "wpad.mondogreek.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-03a7e964e27736b2dc2b7be7", "src_port": 59701, "tcp_stream": null, "udp_stream": 419, "frame_number": 30030, "timestamp_epoch": "1583963712.230639000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.qry.name": "wpad.mondogreek.com", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 59701, "event_id": "evt-4edcb607370c775f010e35fa", "src_port": 53, "tcp_stream": null, "udp_stream": 419, "frame_number": 30031, "timestamp_epoch": "1583963712.230956000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "wpad.mondogreek.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": 53, "event_id": "evt-20acc42ad1783d2a2fd43840", "src_port": 59379, "tcp_stream": null, "udp_stream": 420, "frame_number": 30067, "timestamp_epoch": "1583963823.567068000" }, { "kind": "dns", "dst_ip": "10.3.11.194", "fields": { "dns.qry.name": "wpad.mondogreek.com", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 59379, "event_id": "evt-67c2d661e1b5ce2e6eed236e", "src_port": 53, "tcp_stream": null, "udp_stream": 420, "frame_number": 30068, "timestamp_epoch": "1583963823.567432000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "wpad.mondogreek.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.218", "dst_port": 53, "event_id": "evt-29c111d3d432714085c45cbc", "src_port": 54061, "tcp_stream": null, "udp_stream": 421, "frame_number": 30224, "timestamp_epoch": "1583964265.574197000" }, { "kind": "dns", "dst_ip": "10.3.11.218", "fields": { "dns.qry.name": "wpad.mondogreek.com", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 54061, "event_id": "evt-5431f755a97f8d5eccf821d2", "src_port": 53, "tcp_stream": null, "udp_stream": 421, "frame_number": 30225, "timestamp_epoch": "1583964265.574619000" }, { "kind": "dns", "dst_ip": "10.3.11.3", "fields": { "dns.qry.name": "wpad.mondogreek.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": 53, "event_id": "evt-aa1c7ccc936c08a99b3aade9", "src_port": 63731, "tcp_stream": null, "udp_stream": 422, "frame_number": 30226, "timestamp_epoch": "1583964312.292454000" }, { "kind": "dns", "dst_ip": "10.3.11.119", "fields": { "dns.qry.name": "wpad.mondogreek.com", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.3.11.3", "dst_port": 63731, "event_id": "evt-07c067d224684b75a6342c11", "src_port": 53, "tcp_stream": null, "udp_stream": 422, "frame_number": 30227, "timestamp_epoch": "1583964312.292695000" } ], "dhcp": [], "smtp": [], "identity": [ { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:1d:60:b5:5e:94", "nbns.name": "LAPTOP-I9ZPI04<00>,LAPTOP-I9ZPI04<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-6044cd043fd7260324383074", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 1, "timestamp_epoch": "1583961754.987241000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:1d:60:b5:5e:94", "nbns.name": "MONDOGREEK<00>,MONDOGREEK<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-b4305724835b407b9248c539", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 2, "timestamp_epoch": "1583961754.987734000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94", "kerberos.msg_type": "10", "kerberos.CNameString": "laptop-i9zpi04$" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-c1f7499d23b7d9d2c4f52778", "src_port": null, "tcp_stream": 4, "udp_stream": null, "frame_number": 61, "timestamp_epoch": "1583961755.452893000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "30" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-72f677143292d700afafbc96", "src_port": null, "tcp_stream": 4, "udp_stream": null, "frame_number": 62, "timestamp_epoch": "1583961755.453352000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94", "kerberos.msg_type": "10", "kerberos.CNameString": "laptop-i9zpi04$" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-f9af4e11253478846a6c8515", "src_port": null, "tcp_stream": 5, "udp_stream": null, "frame_number": 69, "timestamp_epoch": "1583961755.470258000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "11", "kerberos.CNameString": "LAPTOP-I9ZPI04$" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-3811c1c6e6e3d4ca890c46bb", "src_port": null, "tcp_stream": 5, "udp_stream": null, "frame_number": 71, "timestamp_epoch": "1583961755.471000000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94", "kerberos.msg_type": "12,14" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-4fb146a389bbcca738ca6769", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 80, "timestamp_epoch": "1583961755.487493000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "LAPTOP-I9ZPI04$" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-a0405bf33ace98cbc6e2d6f5", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 83, "timestamp_epoch": "1583961755.488695000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94", "kerberos.msg_type": "14" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-1a7bedb3aea220ac1e9231c3", "src_port": null, "tcp_stream": 3, "udp_stream": null, "frame_number": 89, "timestamp_epoch": "1583961755.490610000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-106aef6dcc162f68eaea43e8", "src_port": null, "tcp_stream": 3, "udp_stream": null, "frame_number": 91, "timestamp_epoch": "1583961755.491373000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94", "kerberos.msg_type": "10", "kerberos.CNameString": "laptop-i9zpi04$" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-83e80441e8ea826aa07d4029", "src_port": null, "tcp_stream": 7, "udp_stream": null, "frame_number": 103, "timestamp_epoch": "1583961755.529870000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "30" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-8fa649f35790278e695dc08c", "src_port": null, "tcp_stream": 7, "udp_stream": null, "frame_number": 104, "timestamp_epoch": "1583961755.530439000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94", "kerberos.msg_type": "10", "kerberos.CNameString": "laptop-i9zpi04$" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-9ead2911d7ad9d18a54f7e82", "src_port": null, "tcp_stream": 8, "udp_stream": null, "frame_number": 111, "timestamp_epoch": "1583961755.531579000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "11", "kerberos.CNameString": "LAPTOP-I9ZPI04$" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-103e330fe01e68ca9cfa1891", "src_port": null, "tcp_stream": 8, "udp_stream": null, "frame_number": 113, "timestamp_epoch": "1583961755.532443000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94", "kerberos.msg_type": "14" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-1aff2b8a42451c32ec0c71cf", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 119, "timestamp_epoch": "1583961755.533460000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-a3ded2a678c155c22bc2ccdd", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 121, "timestamp_epoch": "1583961755.534245000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94", "kerberos.msg_type": "15" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-e89ffeef3cabfdc62f60f4d4", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 122, "timestamp_epoch": "1583961755.534730000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94", "kerberos.msg_type": "14" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-a0d2fe03ca8a9b567885e6bc", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 136, "timestamp_epoch": "1583961755.539064000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-1a2e612caad5f0c2019448e2", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 139, "timestamp_epoch": "1583961755.539883000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94", "kerberos.msg_type": "15" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-29d449a2cbb023bb6a69d37e", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 140, "timestamp_epoch": "1583961755.540939000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-6bdb657a188192c9becd5b43", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 151, "timestamp_epoch": "1583961755.609837000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-d8cd73ff8053c4103c541a95", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 152, "timestamp_epoch": "1583961755.609996000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-237b0168e5c1c0e359ee0f09", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 153, "timestamp_epoch": "1583961755.610460000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94", "kerberos.msg_type": "10", "kerberos.CNameString": "laptop-i9zpi04$" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-89f2af590936c04fabd74acb", "src_port": null, "tcp_stream": 11, "udp_stream": null, "frame_number": 167, "timestamp_epoch": "1583961755.683879000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "30" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-04fc466fb15aa6882c892de6", "src_port": null, "tcp_stream": 11, "udp_stream": null, "frame_number": 168, "timestamp_epoch": "1583961755.684527000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94", "kerberos.msg_type": "10", "kerberos.CNameString": "laptop-i9zpi04$" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-191ea4a73dc9bc5fbdf257e1", "src_port": null, "tcp_stream": 12, "udp_stream": null, "frame_number": 175, "timestamp_epoch": "1583961755.693307000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "11", "kerberos.CNameString": "LAPTOP-I9ZPI04$" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-31b5ba16fcdeaf81c21e44b5", "src_port": null, "tcp_stream": 12, "udp_stream": null, "frame_number": 177, "timestamp_epoch": "1583961755.694410000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94", "kerberos.msg_type": "12,14" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-9556b2a90b2bfcb276e2bf73", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 186, "timestamp_epoch": "1583961755.700095000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "LAPTOP-I9ZPI04$" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-96cc6ad3fb8244647b47f6bb", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 189, "timestamp_epoch": "1583961755.700892000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94", "kerberos.msg_type": "12,14" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-31b9b60dc230c43c6ae08fa2", "src_port": null, "tcp_stream": 14, "udp_stream": null, "frame_number": 198, "timestamp_epoch": "1583961755.701843000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "LAPTOP-I9ZPI04$" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-768632e5e9dafe9daad7779d", "src_port": null, "tcp_stream": 14, "udp_stream": null, "frame_number": 201, "timestamp_epoch": "1583961755.702258000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94", "kerberos.msg_type": "14" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-b7dd0abd4d1efd602774a395", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 208, "timestamp_epoch": "1583961755.703021000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-84959e60dbcde39a70bea04d", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 210, "timestamp_epoch": "1583961755.704761000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-64eb4cced52c909bcb1ed6f1", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 211, "timestamp_epoch": "1583961755.705206000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-c641a62488b32bb36355b527", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 212, "timestamp_epoch": "1583961755.705477000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-969170b9173a599efa67d389", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 213, "timestamp_epoch": "1583961755.705607000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-6d1f467d7dde91afe2d330c2", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 214, "timestamp_epoch": "1583961755.705740000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-e16c21b8ada71ec11e66a34e", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 217, "timestamp_epoch": "1583961755.725804000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-f3548bde8c61860a991c9510", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 218, "timestamp_epoch": "1583961755.726413000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:1d:60:b5:5e:94", "nbns.name": "MONDOGREEK<00>,MONDOGREEK<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-637e8d7d2663ab8f01489ca5", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 219, "timestamp_epoch": "1583961755.742874000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:1d:60:b5:5e:94", "nbns.name": "LAPTOP-I9ZPI04<00>,LAPTOP-I9ZPI04<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-722f94d91a159e03d7e71bca", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 220, "timestamp_epoch": "1583961755.742965000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94", "kerberos.msg_type": "10", "kerberos.CNameString": "laptop-i9zpi04$" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-f693bfd95ebc2ccef3804f60", "src_port": null, "tcp_stream": 15, "udp_stream": null, "frame_number": 227, "timestamp_epoch": "1583961755.852836000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "30" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-629cd85c3975ddc20f7d8f64", "src_port": null, "tcp_stream": 15, "udp_stream": null, "frame_number": 228, "timestamp_epoch": "1583961755.853335000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94", "kerberos.msg_type": "10", "kerberos.CNameString": "laptop-i9zpi04$" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-5977eb4818f177e535665025", "src_port": null, "tcp_stream": 16, "udp_stream": null, "frame_number": 235, "timestamp_epoch": "1583961755.855356000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "11", "kerberos.CNameString": "LAPTOP-I9ZPI04$" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-7300776941230c827fc4c8b4", "src_port": null, "tcp_stream": 16, "udp_stream": null, "frame_number": 237, "timestamp_epoch": "1583961755.856211000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94", "kerberos.msg_type": "12,14" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-84f3b100b6fdc8d9c18fbcf1", "src_port": null, "tcp_stream": 17, "udp_stream": null, "frame_number": 246, "timestamp_epoch": "1583961755.858072000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "LAPTOP-I9ZPI04$" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-e2290408707e295943837426", "src_port": null, "tcp_stream": 17, "udp_stream": null, "frame_number": 249, "timestamp_epoch": "1583961755.859063000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94", "kerberos.msg_type": "14" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-920fe1c5c6979e13553e8229", "src_port": null, "tcp_stream": 18, "udp_stream": null, "frame_number": 255, "timestamp_epoch": "1583961755.860435000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-5d7c2cf59e53e218f07ae3fa", "src_port": null, "tcp_stream": 18, "udp_stream": null, "frame_number": 257, "timestamp_epoch": "1583961755.861278000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-4a0bdedceb6c41b61d07aff4", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 273, "timestamp_epoch": "1583961755.944181000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-fefd627005c20caf7a31aede", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 274, "timestamp_epoch": "1583961755.944655000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:1d:60:b5:5e:94", "nbns.name": "LAPTOP-I9ZPI04<20>,LAPTOP-I9ZPI04<20> (Server service)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-7f237e0d32cb7b1871102fdb", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 277, "timestamp_epoch": "1583961755.973947000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94", "kerberos.msg_type": "14" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-4dd804bc80e7b953c829d098", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 304, "timestamp_epoch": "1583961756.106364000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-845115abbc802f3248c8b9d6", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 306, "timestamp_epoch": "1583961756.107065000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94", "kerberos.msg_type": "15" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-ac9e4819c132ca991318d1c8", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 307, "timestamp_epoch": "1583961756.107280000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:1d:60:b5:5e:94", "nbns.name": "MONDOGREEK<00>,MONDOGREEK<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-778bdfb1c2273cffbd32a7e1", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 321, "timestamp_epoch": "1583961756.492941000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:1d:60:b5:5e:94", "nbns.name": "LAPTOP-I9ZPI04<00>,LAPTOP-I9ZPI04<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-434b6ffbc9e164cf5b695a8a", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 322, "timestamp_epoch": "1583961756.493146000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94", "kerberos.msg_type": "14" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-44a89f0992d01cee78b8d97c", "src_port": null, "tcp_stream": 22, "udp_stream": null, "frame_number": 331, "timestamp_epoch": "1583961756.521469000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-65188bfa9639cd9da41ba4a5", "src_port": null, "tcp_stream": 22, "udp_stream": null, "frame_number": 333, "timestamp_epoch": "1583961756.522379000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94", "kerberos.msg_type": "12,14" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-50df5a93acdefadd5fd02529", "src_port": null, "tcp_stream": 23, "udp_stream": null, "frame_number": 339, "timestamp_epoch": "1583961756.579320000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "LAPTOP-I9ZPI04$" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-b1ba221336873dada2f97fa8", "src_port": null, "tcp_stream": 23, "udp_stream": null, "frame_number": 342, "timestamp_epoch": "1583961756.580274000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94", "kerberos.msg_type": "14" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-49517429b5d4c5f5836c7e80", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 353, "timestamp_epoch": "1583961756.594953000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-fc10f07b4a09812e2a464d42", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 355, "timestamp_epoch": "1583961756.596262000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:1d:60:b5:5e:94", "nbns.name": "LAPTOP-I9ZPI04<20>,LAPTOP-I9ZPI04<20> (Server service)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-3348592581142d26dfe7befa", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 364, "timestamp_epoch": "1583961756.711779000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94", "kerberos.msg_type": "12,14" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-eaf7a92da824dd98888eb097", "src_port": null, "tcp_stream": 25, "udp_stream": null, "frame_number": 369, "timestamp_epoch": "1583961756.722981000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "LAPTOP-I9ZPI04$" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-19f1e7e57bf543e803f87275", "src_port": null, "tcp_stream": 25, "udp_stream": null, "frame_number": 372, "timestamp_epoch": "1583961756.723910000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94", "kerberos.msg_type": "12,14" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-bbd49b749a15da2a20c092da", "src_port": null, "tcp_stream": 26, "udp_stream": null, "frame_number": 381, "timestamp_epoch": "1583961756.725447000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "LAPTOP-I9ZPI04$" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-c55eb6f26960134fb2baf9d2", "src_port": null, "tcp_stream": 26, "udp_stream": null, "frame_number": 384, "timestamp_epoch": "1583961756.725906000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94", "kerberos.msg_type": "14" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-3822add94f0a52b4a4c8e89e", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 391, "timestamp_epoch": "1583961756.726841000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-3e7c50d731a42f0276cc18fb", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 393, "timestamp_epoch": "1583961756.729098000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-ba1401bab10cfd6dc1b31030", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 394, "timestamp_epoch": "1583961756.730172000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-51d87ea133be57772ac11bb7", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 395, "timestamp_epoch": "1583961756.730444000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-65e745b3e6115922d37a812a", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 397, "timestamp_epoch": "1583961756.788608000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-409141a4c549ceb5f02a2fe4", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 398, "timestamp_epoch": "1583961756.789018000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-88fb0d4c9dc359c61fc2d76a", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 399, "timestamp_epoch": "1583961756.806172000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-b36a0fcbb5b4562117be31b1", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 400, "timestamp_epoch": "1583961756.806465000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-516efce261b4a5f18aa27af3", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 401, "timestamp_epoch": "1583961756.839367000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-8ef76c890ee8da6f34787dad", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 402, "timestamp_epoch": "1583961756.839632000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-e0a8e4614f56cdc0449028d4", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 403, "timestamp_epoch": "1583961756.876942000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-a05a88c69672cc4990bd4658", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 404, "timestamp_epoch": "1583961756.877331000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-3f41697904b08411ba00e3a9", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 405, "timestamp_epoch": "1583961756.877758000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-0f2a24e42971e6dfdc11266d", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 406, "timestamp_epoch": "1583961756.877953000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-7693d3b3a9883d9ff6893daa", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 407, "timestamp_epoch": "1583961756.879612000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-2b8dc384b7ef48efc8925d6e", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 408, "timestamp_epoch": "1583961756.879839000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-ea33f424b3ba3015dc5c9c70", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 409, "timestamp_epoch": "1583961756.881299000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-601319cc1a858be28f602abc", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 410, "timestamp_epoch": "1583961756.881612000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-65b98dfcc09e7cc43f7de823", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 411, "timestamp_epoch": "1583961756.881898000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-01183d12fbe316af736b1cb9", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 412, "timestamp_epoch": "1583961756.882052000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-9548fd3a94fb3edf1a66e37b", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 413, "timestamp_epoch": "1583961756.882230000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-4b1bb9f2aea06f7bec5b8505", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 414, "timestamp_epoch": "1583961756.882406000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-82bd155d95c855c83047f1a9", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 415, "timestamp_epoch": "1583961756.883085000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-0bfd92fc629e7a89b626e94d", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 416, "timestamp_epoch": "1583961756.883456000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-786ddb66f82a29b56c49aaaf", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 417, "timestamp_epoch": "1583961756.883796000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-d8e7f2d5d8d04530891e5d1d", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 418, "timestamp_epoch": "1583961756.884017000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-26078b0c0c7a92e1d7ba53fc", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 419, "timestamp_epoch": "1583961756.884428000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-82b3b1ed605d8bea62c39908", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 420, "timestamp_epoch": "1583961756.884666000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-c6dcd6c0df6b229fa9c241a0", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 421, "timestamp_epoch": "1583961756.885705000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-914e2a7b02ef54eb8bed7fd0", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 422, "timestamp_epoch": "1583961756.886056000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-4bf494c8572a80c6b5bc3a84", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 423, "timestamp_epoch": "1583961756.886884000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-2ce68a012833865a8a740641", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 424, "timestamp_epoch": "1583961756.887083000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-2f19d9fcc6771d23df8470e2", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 425, "timestamp_epoch": "1583961756.888044000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-727214055a5cde02b8470ee7", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 426, "timestamp_epoch": "1583961756.888365000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-a1f1c9a29a77b8ccbc254517", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 427, "timestamp_epoch": "1583961756.888736000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-d91a2ac7ba87a45785cd68bd", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 428, "timestamp_epoch": "1583961756.889009000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-2de4b6ca18ee75e4bcda8db2", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 429, "timestamp_epoch": "1583961756.891022000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-5bb99ea5b6c8548acc1b6356", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 430, "timestamp_epoch": "1583961756.891216000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-e60e143aa413de6895bfafbb", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 431, "timestamp_epoch": "1583961756.891439000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-9973ad0300cc72542bd4eb29", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 432, "timestamp_epoch": "1583961756.891607000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-6bc8c77fc1b1c3605116f5ea", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 433, "timestamp_epoch": "1583961756.891866000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-b28f484c4570044f7cc04b25", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 434, "timestamp_epoch": "1583961756.892125000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-c2b1a8e03bcdc318a8739c97", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 435, "timestamp_epoch": "1583961756.892647000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-e4776894468c73586428c23a", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 436, "timestamp_epoch": "1583961756.892801000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-d128489ce172711b8196f645", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 437, "timestamp_epoch": "1583961756.893082000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-d6f5928af2918c9e5ba439a8", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 438, "timestamp_epoch": "1583961756.893244000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-1b45d72e398d6efb5f4f0ac2", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 439, "timestamp_epoch": "1583961756.893505000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-7c3adcfd0c628e41ad9be1b1", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 440, "timestamp_epoch": "1583961756.893670000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-bb159f5d30bcaf984a276cac", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 441, "timestamp_epoch": "1583961756.893927000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-009d862b84031b3aede1d42b", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 442, "timestamp_epoch": "1583961756.894058000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-9e04620c11bdcb5decf9f205", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 443, "timestamp_epoch": "1583961756.894335000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-a2d55212f37ebf9e302a01e6", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 444, "timestamp_epoch": "1583961756.894464000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-7f3211e237f3328c1f509345", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 445, "timestamp_epoch": "1583961756.896045000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-60820a2464dea27115b82c1d", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 446, "timestamp_epoch": "1583961756.896249000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-a72d5fc30db1c0ab16afdd64", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 447, "timestamp_epoch": "1583961756.897557000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-cff2e9d200e483c9b534c481", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 448, "timestamp_epoch": "1583961756.897747000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-e2a5e6423d0635c8bf671d3d", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 449, "timestamp_epoch": "1583961756.898499000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-fb3ec189d253a964cf417a47", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 450, "timestamp_epoch": "1583961756.898712000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-a1d59e239ae4720ec546bd03", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 451, "timestamp_epoch": "1583961756.899140000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-f6c693e750947de7f2a109d2", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 452, "timestamp_epoch": "1583961756.899357000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-bcc55d3e431a14b7f3f7093c", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 453, "timestamp_epoch": "1583961756.899741000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-0f0560f4da3e762e6067ee76", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 454, "timestamp_epoch": "1583961756.900008000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-0f1416429dc5844a7c26b1dc", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 455, "timestamp_epoch": "1583961756.901107000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-d2c9f1929d01dac4155f8353", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 456, "timestamp_epoch": "1583961756.901305000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-3d8a861cb57433ea1fac5a33", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 457, "timestamp_epoch": "1583961756.901838000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-812d0d5277f216826b4eb997", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 458, "timestamp_epoch": "1583961756.902000000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-4080aa8bc323f3d93e3b9996", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 459, "timestamp_epoch": "1583961756.902273000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-e37af259637400e2f0643670", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 460, "timestamp_epoch": "1583961756.902429000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-e3fc8e7be54c811c5554c957", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 461, "timestamp_epoch": "1583961756.903530000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-65056c0084bb644abfd52fe7", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 462, "timestamp_epoch": "1583961756.903710000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-54705a8008b3824d7b4e9ded", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 463, "timestamp_epoch": "1583961756.904126000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-bfe60ccc95667371152573ad", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 464, "timestamp_epoch": "1583961756.904313000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-76e31fe21ed6c872faf7ab4e", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 465, "timestamp_epoch": "1583961756.904461000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-71beb1cef4f17cc293f6510d", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 466, "timestamp_epoch": "1583961756.904599000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-ced4b8767d53d1ded4e88552", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 467, "timestamp_epoch": "1583961756.905210000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-749eaf97c59be9eb8a707cd4", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 468, "timestamp_epoch": "1583961756.905370000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-10127e5de0eadd27e502afaa", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 469, "timestamp_epoch": "1583961756.905758000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-de06e1d9eed5b9357fbae1ef", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 470, "timestamp_epoch": "1583961756.905889000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-1b9207473091fbb8c6ee8d68", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 471, "timestamp_epoch": "1583961756.906922000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-c551f07106797a1d015fdc3d", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 472, "timestamp_epoch": "1583961756.907103000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-33f3aaf96d367270bcfd868e", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 473, "timestamp_epoch": "1583961756.907323000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-fd0ea39401d91118fe048a60", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 475, "timestamp_epoch": "1583961756.907560000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-fe61f94f6fc9256c12c70fe2", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 477, "timestamp_epoch": "1583961756.908177000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-7545090faba60c3dec140c36", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 478, "timestamp_epoch": "1583961756.908345000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-0d87281f211367a000e854ce", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 479, "timestamp_epoch": "1583961756.908717000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-8106cbdb2de9137e91aaafa2", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 480, "timestamp_epoch": "1583961756.908981000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-5b8ef254b001c104c7c491df", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 481, "timestamp_epoch": "1583961756.909182000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-f8d7e7f6541e25225a4e630a", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 482, "timestamp_epoch": "1583961756.909316000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-f8d3a3f0cae5442192d35aa1", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 483, "timestamp_epoch": "1583961756.910057000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-8a3fac6db7133065c22a7f9f", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 484, "timestamp_epoch": "1583961756.910202000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-3492b48e690769f68e12e54a", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 485, "timestamp_epoch": "1583961756.910486000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-731bacccd4c634267bdfe9e6", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 486, "timestamp_epoch": "1583961756.910616000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-d0ce42a77013ca55b85fd3d0", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 487, "timestamp_epoch": "1583961756.910821000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-eea7052fa8837f63a73189d4", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 488, "timestamp_epoch": "1583961756.910979000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-671fd072e691e41b4c57a0cd", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 489, "timestamp_epoch": "1583961756.911208000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-18c4198ade88b7cae595e35e", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 490, "timestamp_epoch": "1583961756.911370000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-620debeb70033e2d831d7a10", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 491, "timestamp_epoch": "1583961756.911534000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-6d03ef5e4c1ba97c3a248f44", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 492, "timestamp_epoch": "1583961756.911701000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-712833d030a0c88f8ae73093", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 493, "timestamp_epoch": "1583961756.911843000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-5490b27e081d6f0c341b4d7d", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 494, "timestamp_epoch": "1583961756.911985000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-9598821262f1610a48776369", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 495, "timestamp_epoch": "1583961756.912169000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-e82bd711a0be7838074f17c1", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 496, "timestamp_epoch": "1583961756.912327000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-589d63947a8d695a3f0aec54", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 497, "timestamp_epoch": "1583961756.912540000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-8acd574d0d757d0590a8c43c", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 498, "timestamp_epoch": "1583961756.912685000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-27a2c480996222b142069c4f", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 499, "timestamp_epoch": "1583961756.913117000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-da6d5f735614bc7d94c2b58c", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 500, "timestamp_epoch": "1583961756.913260000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-8a7916ff6a4c409dbbf55744", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 502, "timestamp_epoch": "1583961756.938395000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-3d811bf8daa9dee87e8cc9a0", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 503, "timestamp_epoch": "1583961756.938692000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-91d81eef3b5b3c72f0077914", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 504, "timestamp_epoch": "1583961756.940389000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-b4b5664c701cf274b87d927a", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 505, "timestamp_epoch": "1583961756.940639000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:1d:60:b5:5e:94", "nbns.name": "LAPTOP-I9ZPI04<00>,LAPTOP-I9ZPI04<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-dbf7816db6356ff36a158fc5", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 519, "timestamp_epoch": "1583961757.258574000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:1d:60:b5:5e:94", "nbns.name": "MONDOGREEK<00>,MONDOGREEK<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-35119bc8ea68d8c540d3d2ce", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 520, "timestamp_epoch": "1583961757.258725000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:1d:60:b5:5e:94", "nbns.name": "LAPTOP-I9ZPI04<20>,LAPTOP-I9ZPI04<20> (Server service)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-9e80eaca91a4a96638e2ff4f", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 524, "timestamp_epoch": "1583961757.477321000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:1d:60:b5:5e:94", "nbns.name": "LAPTOP-I9ZPI04<20>,LAPTOP-I9ZPI04<20> (Server service)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-a808b4d1533f75bc7bce1d9b", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 537, "timestamp_epoch": "1583961758.227379000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94", "kerberos.msg_type": "14" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-db37f3eb8b734c541cbbba3a", "src_port": null, "tcp_stream": 29, "udp_stream": null, "frame_number": 565, "timestamp_epoch": "1583961758.484031000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-7d6c251ac1463d167b1773e0", "src_port": null, "tcp_stream": 29, "udp_stream": null, "frame_number": 567, "timestamp_epoch": "1583961758.484756000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94", "kerberos.msg_type": "15" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-fa476f8618125341381fb6ba", "src_port": null, "tcp_stream": 29, "udp_stream": null, "frame_number": 568, "timestamp_epoch": "1583961758.485148000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94", "kerberos.msg_type": "14" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-6bd664a79a3132838d3c5c63", "src_port": null, "tcp_stream": 30, "udp_stream": null, "frame_number": 601, "timestamp_epoch": "1583961758.614413000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-7414ad1ead31109bc76470ea", "src_port": null, "tcp_stream": 30, "udp_stream": null, "frame_number": 603, "timestamp_epoch": "1583961758.615249000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94", "kerberos.msg_type": "14" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-a918ec4f9cfc83e15dd6adad", "src_port": null, "tcp_stream": 32, "udp_stream": null, "frame_number": 616, "timestamp_epoch": "1583961758.626812000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-7f3422d666351fdbe51c3a5c", "src_port": null, "tcp_stream": 32, "udp_stream": null, "frame_number": 618, "timestamp_epoch": "1583961758.627969000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:1d:60:b5:5e:94", "browser.server": "LAPTOP-I9ZPI04" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-1822058e420b155b1c0e6cdb", "src_port": null, "tcp_stream": null, "udp_stream": 23, "frame_number": 659, "timestamp_epoch": "1583961759.046463000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94", "kerberos.msg_type": "14" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-1ecbe125e28af8827e026b62", "src_port": null, "tcp_stream": 45, "udp_stream": null, "frame_number": 947, "timestamp_epoch": "1583961764.279535000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-c92aafe67c382fa0d88e2e08", "src_port": null, "tcp_stream": 45, "udp_stream": null, "frame_number": 949, "timestamp_epoch": "1583961764.280459000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94", "kerberos.msg_type": "14" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-d19d2a563eef54900abd69b3", "src_port": null, "tcp_stream": 46, "udp_stream": null, "frame_number": 964, "timestamp_epoch": "1583961764.307177000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-ddb421f56f4800a91667d2ba", "src_port": null, "tcp_stream": 46, "udp_stream": null, "frame_number": 967, "timestamp_epoch": "1583961764.308415000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94", "kerberos.msg_type": "10", "kerberos.CNameString": "LAPTOP-I9ZPI04$" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-e911b6e92b2eb9071bb9f41c", "src_port": null, "tcp_stream": 47, "udp_stream": null, "frame_number": 973, "timestamp_epoch": "1583961764.313051000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "30" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-f40197b4e6091b2a0f76959f", "src_port": null, "tcp_stream": 47, "udp_stream": null, "frame_number": 974, "timestamp_epoch": "1583961764.313570000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94", "kerberos.msg_type": "10", "kerberos.CNameString": "LAPTOP-I9ZPI04$" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-9d8ae7b9df5fa004ace351b0", "src_port": null, "tcp_stream": 48, "udp_stream": null, "frame_number": 981, "timestamp_epoch": "1583961764.314481000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "11", "kerberos.CNameString": "LAPTOP-I9ZPI04$" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-018116ed6b2e33ff37b79f08", "src_port": null, "tcp_stream": 48, "udp_stream": null, "frame_number": 983, "timestamp_epoch": "1583961764.315239000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94", "kerberos.msg_type": "12,14" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-be3f9941029883e881ff25f0", "src_port": null, "tcp_stream": 49, "udp_stream": null, "frame_number": 992, "timestamp_epoch": "1583961764.316385000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "LAPTOP-I9ZPI04$" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-efb6bd2585b06d895e98c64c", "src_port": null, "tcp_stream": 49, "udp_stream": null, "frame_number": 995, "timestamp_epoch": "1583961764.317300000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-2d82a10b3e1cc563096f3f0f", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 1012, "timestamp_epoch": "1583961766.461924000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-2dbb553526f3e7e9c7e538c0", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 1013, "timestamp_epoch": "1583961766.462191000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-707e7a730614ed246b066271", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 1014, "timestamp_epoch": "1583961766.462347000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-05bd8ea295352053ee99e7ed", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 1015, "timestamp_epoch": "1583961766.462528000" }, { "kind": "identity", "dst_ip": "224.0.0.251", "fields": { "eth.dst": "01:00:5e:00:00:fb", "eth.src": "b8:ca:3a:ec:3b:8f", "dns.qry.name": "LAPTOP-7XMV2SN.local" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-96390484eeb6b6eb59f13d93", "src_port": null, "tcp_stream": null, "udp_stream": 30, "frame_number": 1055, "timestamp_epoch": "1583961778.958984000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "b8:ca:3a:ec:3b:8f", "dns.qry.name": "LAPTOP-7XMV2SN" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-454613e6d806f5a17dbda286", "src_port": null, "tcp_stream": null, "udp_stream": 31, "frame_number": 1056, "timestamp_epoch": "1583961778.962152000" }, { "kind": "identity", "dst_ip": "224.0.0.251", "fields": { "eth.dst": "01:00:5e:00:00:fb", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-2eb0b50b33dba28a71f19869", "src_port": null, "tcp_stream": null, "udp_stream": 30, "frame_number": 1057, "timestamp_epoch": "1583961778.968591000" }, { "kind": "identity", "dst_ip": "224.0.0.251", "fields": { "eth.dst": "01:00:5e:00:00:fb", "eth.src": "b8:ca:3a:ec:3b:8f", "dns.qry.name": "LAPTOP-7XMV2SN.local" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-ad4646f9847f5b7c7c5fc9a2", "src_port": null, "tcp_stream": null, "udp_stream": 30, "frame_number": 1060, "timestamp_epoch": "1583961778.990773000" }, { "kind": "identity", "dst_ip": "224.0.0.251", "fields": { "eth.dst": "01:00:5e:00:00:fb", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-ed641b92b2b8638ba91e3662", "src_port": null, "tcp_stream": null, "udp_stream": 30, "frame_number": 1061, "timestamp_epoch": "1583961778.990889000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "b8:ca:3a:ec:3b:8f", "dns.qry.name": "LAPTOP-7XMV2SN" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-997e4707d2ca55ff27e37014", "src_port": null, "tcp_stream": null, "udp_stream": 32, "frame_number": 1062, "timestamp_epoch": "1583961778.991213000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "b8:ca:3a:ec:3b:8f", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-77d87d05beca8bfe8e2c4a5f", "src_port": null, "tcp_stream": null, "udp_stream": 38, "frame_number": 1083, "timestamp_epoch": "1583961780.312982000" }, { "kind": "identity", "dst_ip": "224.0.0.251", "fields": { "eth.dst": "01:00:5e:00:00:fb", "eth.src": "b8:ca:3a:ec:3b:8f", "dns.qry.name": "wpad.local" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-8bb0556ed10d903dca5f4681", "src_port": null, "tcp_stream": null, "udp_stream": 30, "frame_number": 1084, "timestamp_epoch": "1583961780.313258000" }, { "kind": "identity", "dst_ip": "224.0.0.251", "fields": { "eth.dst": "01:00:5e:00:00:fb", "eth.src": "b8:ca:3a:ec:3b:8f", "dns.qry.name": "wpad.local" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-f07c737771960720f88c066a", "src_port": null, "tcp_stream": null, "udp_stream": 30, "frame_number": 1085, "timestamp_epoch": "1583961780.313966000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "b8:ca:3a:ec:3b:8f", "dns.qry.name": "wpad" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-6cec3191b8499a8dcbafb1b1", "src_port": null, "tcp_stream": null, "udp_stream": 39, "frame_number": 1086, "timestamp_epoch": "1583961780.314297000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "b8:ca:3a:ec:3b:8f", "dns.qry.name": "wpad" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-420b7f1821637d75b9f92019", "src_port": null, "tcp_stream": null, "udp_stream": 40, "frame_number": 1087, "timestamp_epoch": "1583961780.314594000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "b8:ca:3a:ec:3b:8f", "dns.qry.name": "wpad" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-3c033acac75f5e135989309d", "src_port": null, "tcp_stream": null, "udp_stream": 40, "frame_number": 1088, "timestamp_epoch": "1583961780.722736000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "b8:ca:3a:ec:3b:8f", "dns.qry.name": "wpad" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-56336bffabf4273e23d700e4", "src_port": null, "tcp_stream": null, "udp_stream": 39, "frame_number": 1089, "timestamp_epoch": "1583961780.723011000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "b8:ca:3a:ec:3b:8f", "nbns.name": "LAPTOP-7XMV2SN<00>,LAPTOP-7XMV2SN<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-9c3649d2e5d2fbbad33a720f", "src_port": null, "tcp_stream": null, "udp_stream": 38, "frame_number": 1090, "timestamp_epoch": "1583961780.759485000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "b8:ca:3a:ec:3b:8f", "nbns.name": "MONDOGREEK<00>,MONDOGREEK<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-09393e6d73e56e96287e178f", "src_port": null, "tcp_stream": null, "udp_stream": 38, "frame_number": 1091, "timestamp_epoch": "1583961780.760115000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "b8:ca:3a:ec:3b:8f", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-f23f3f0fb3b3e80b630fd5d5", "src_port": null, "tcp_stream": null, "udp_stream": 38, "frame_number": 1102, "timestamp_epoch": "1583961781.066440000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f", "kerberos.msg_type": "10", "kerberos.CNameString": "laptop-7xmv2sn$" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-7b36bd92576f28ed4301d6b8", "src_port": null, "tcp_stream": 55, "udp_stream": null, "frame_number": 1130, "timestamp_epoch": "1583961781.185267000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "30" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-e6953cccd4915efa3c6c560c", "src_port": null, "tcp_stream": 55, "udp_stream": null, "frame_number": 1131, "timestamp_epoch": "1583961781.185703000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f", "kerberos.msg_type": "10", "kerberos.CNameString": "laptop-7xmv2sn$" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-36d0a893dab3df8eee9e8ce4", "src_port": null, "tcp_stream": 56, "udp_stream": null, "frame_number": 1139, "timestamp_epoch": "1583961781.200487000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "11", "kerberos.CNameString": "LAPTOP-7XMV2SN$" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-0cff0a97c0dc42a14a215eb0", "src_port": null, "tcp_stream": 56, "udp_stream": null, "frame_number": 1141, "timestamp_epoch": "1583961781.201495000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f", "kerberos.msg_type": "12,14" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-7733c9dcfac9012556641d95", "src_port": null, "tcp_stream": 57, "udp_stream": null, "frame_number": 1154, "timestamp_epoch": "1583961781.225408000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "LAPTOP-7XMV2SN$" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-4512955a369d0cf61a9577aa", "src_port": null, "tcp_stream": 57, "udp_stream": null, "frame_number": 1157, "timestamp_epoch": "1583961781.226373000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f", "kerberos.msg_type": "10", "kerberos.CNameString": "laptop-7xmv2sn$" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-29c70ca7ac02dedea70b5c7c", "src_port": null, "tcp_stream": 59, "udp_stream": null, "frame_number": 1169, "timestamp_epoch": "1583961781.230257000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f", "kerberos.msg_type": "14" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-3605bcccddc81a1205a38d86", "src_port": null, "tcp_stream": 52, "udp_stream": null, "frame_number": 1171, "timestamp_epoch": "1583961781.230479000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "30" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-1e2dee0c9ae4524c09a61ce7", "src_port": null, "tcp_stream": 59, "udp_stream": null, "frame_number": 1172, "timestamp_epoch": "1583961781.230862000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-475af8b282ca2831f72c3975", "src_port": null, "tcp_stream": 52, "udp_stream": null, "frame_number": 1177, "timestamp_epoch": "1583961781.231691000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f", "kerberos.msg_type": "10", "kerberos.CNameString": "laptop-7xmv2sn$" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-74991e691121b53613f6bff8", "src_port": null, "tcp_stream": 60, "udp_stream": null, "frame_number": 1183, "timestamp_epoch": "1583961781.242751000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "11", "kerberos.CNameString": "LAPTOP-7XMV2SN$" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-c40e7c4788ae3e83e9f48a3a", "src_port": null, "tcp_stream": 60, "udp_stream": null, "frame_number": 1185, "timestamp_epoch": "1583961781.243510000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f", "kerberos.msg_type": "12,14" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-c034f3f0092fea28dd7b8817", "src_port": null, "tcp_stream": 62, "udp_stream": null, "frame_number": 1202, "timestamp_epoch": "1583961781.249759000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "LAPTOP-7XMV2SN$" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-ef3eaba9e8ec4e61c781c236", "src_port": null, "tcp_stream": 62, "udp_stream": null, "frame_number": 1205, "timestamp_epoch": "1583961781.250902000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f", "kerberos.msg_type": "14" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-7996cd037344eddafcad2a7e", "src_port": null, "tcp_stream": 58, "udp_stream": null, "frame_number": 1211, "timestamp_epoch": "1583961781.251687000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-09eae98ad2b7897aaaef02b4", "src_port": null, "tcp_stream": 58, "udp_stream": null, "frame_number": 1213, "timestamp_epoch": "1583961781.252762000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f", "kerberos.msg_type": "15" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-6c86a58b10d2d603d5d51e59", "src_port": null, "tcp_stream": 58, "udp_stream": null, "frame_number": 1214, "timestamp_epoch": "1583961781.253284000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f", "kerberos.msg_type": "14" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-2e5d164d3b1efe4b219761d6", "src_port": null, "tcp_stream": 58, "udp_stream": null, "frame_number": 1225, "timestamp_epoch": "1583961781.258074000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-fbf51e3f73d36289762bacc3", "src_port": null, "tcp_stream": 58, "udp_stream": null, "frame_number": 1227, "timestamp_epoch": "1583961781.258618000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f", "kerberos.msg_type": "15" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-d019e5e2927a0cc9a1ce70b7", "src_port": null, "tcp_stream": 58, "udp_stream": null, "frame_number": 1228, "timestamp_epoch": "1583961781.258823000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f", "kerberos.msg_type": "14" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-16a4dc9a7b3d23b4bb1cf794", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 1244, "timestamp_epoch": "1583961781.265476000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-f0a3610b0b8c87da9bd75dfd", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 1246, "timestamp_epoch": "1583961781.266459000" }, { "kind": "identity", "dst_ip": "224.0.0.251", "fields": { "eth.dst": "01:00:5e:00:00:fb", "eth.src": "b8:ca:3a:ec:3b:8f", "dns.qry.name": "wpad.local" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-ec04fd75150cfcbe02748329", "src_port": null, "tcp_stream": null, "udp_stream": 30, "frame_number": 1262, "timestamp_epoch": "1583961781.394799000" }, { "kind": "identity", "dst_ip": "224.0.0.251", "fields": { "eth.dst": "01:00:5e:00:00:fb", "eth.src": "b8:ca:3a:ec:3b:8f", "dns.qry.name": "wpad.local" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-84396f005b78b23e49db35cd", "src_port": null, "tcp_stream": null, "udp_stream": 30, "frame_number": 1263, "timestamp_epoch": "1583961781.395737000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-064b46b27424ead3d24b7722", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1278, "timestamp_epoch": "1583961781.466042000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-372e008dba0b65c3b2d0ea4f", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1279, "timestamp_epoch": "1583961781.466324000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-7098cede0d23bea29cc029bd", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1280, "timestamp_epoch": "1583961781.466763000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f", "kerberos.msg_type": "12,14" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-e2fce4a3ba76ed2c3dac140a", "src_port": null, "tcp_stream": 66, "udp_stream": null, "frame_number": 1285, "timestamp_epoch": "1583961781.469425000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "LAPTOP-7XMV2SN$" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-8d6de61fd549f116d5cd11e1", "src_port": null, "tcp_stream": 66, "udp_stream": null, "frame_number": 1288, "timestamp_epoch": "1583961781.470704000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f", "kerberos.msg_type": "12,14" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-db5d91423b2fb4454d06e878", "src_port": null, "tcp_stream": 67, "udp_stream": null, "frame_number": 1297, "timestamp_epoch": "1583961781.471641000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "LAPTOP-7XMV2SN$" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-9b83de7c3b02f024d6054558", "src_port": null, "tcp_stream": 67, "udp_stream": null, "frame_number": 1300, "timestamp_epoch": "1583961781.471999000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f", "kerberos.msg_type": "14" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-e9d9479a7bba43a03a10b9ec", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1307, "timestamp_epoch": "1583961781.472932000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-60a0309ae199549f3cee55a4", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1309, "timestamp_epoch": "1583961781.474577000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-bb5beb0a1a1921e32070d1d2", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1310, "timestamp_epoch": "1583961781.475030000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-57df072bd61fa03f8114ce9c", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1311, "timestamp_epoch": "1583961781.475239000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-d4cdf223a72c4aa72a8d7f8d", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1312, "timestamp_epoch": "1583961781.475503000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-6f8c4a555dbaf22728132a9d", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1313, "timestamp_epoch": "1583961781.475664000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "b8:ca:3a:ec:3b:8f", "nbns.name": "LAPTOP-7XMV2SN<00>,LAPTOP-7XMV2SN<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-330c6775539ebb475bb515b1", "src_port": null, "tcp_stream": null, "udp_stream": 38, "frame_number": 1317, "timestamp_epoch": "1583961781.512484000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "b8:ca:3a:ec:3b:8f", "nbns.name": "MONDOGREEK<00>,MONDOGREEK<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-5bebd693aa0d3b99eaabefbe", "src_port": null, "tcp_stream": null, "udp_stream": 38, "frame_number": 1318, "timestamp_epoch": "1583961781.512620000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-7bc475b12ef06a12f78e3c62", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1319, "timestamp_epoch": "1583961781.527418000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-1b4a16361e1a0bf145e281ef", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1320, "timestamp_epoch": "1583961781.528058000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-70a63c13988628a207a1db81", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1321, "timestamp_epoch": "1583961781.551147000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-6707f8d694f5700b434ae90e", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1322, "timestamp_epoch": "1583961781.551578000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f", "kerberos.msg_type": "14" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-6d9e081b520137d602b52fa9", "src_port": null, "tcp_stream": 58, "udp_stream": null, "frame_number": 1362, "timestamp_epoch": "1583961781.756165000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-893d256684c4014d579809a2", "src_port": null, "tcp_stream": 58, "udp_stream": null, "frame_number": 1364, "timestamp_epoch": "1583961781.756791000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f", "kerberos.msg_type": "15" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-1a488c15304b82e81b20e540", "src_port": null, "tcp_stream": 58, "udp_stream": null, "frame_number": 1365, "timestamp_epoch": "1583961781.757068000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "b8:ca:3a:ec:3b:8f", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-966a9873f23d66ef0ebc63f0", "src_port": null, "tcp_stream": null, "udp_stream": 38, "frame_number": 1377, "timestamp_epoch": "1583961781.825007000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "b8:ca:3a:ec:3b:8f", "nbns.name": "LAPTOP-7XMV2SN<20>,LAPTOP-7XMV2SN<20> (Server service)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-57b7f23b37f166ded5366278", "src_port": null, "tcp_stream": null, "udp_stream": 38, "frame_number": 1380, "timestamp_epoch": "1583961782.084124000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f", "kerberos.msg_type": "14" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-c2de73c0e8bf4bc84bb37aa3", "src_port": null, "tcp_stream": 71, "udp_stream": null, "frame_number": 1389, "timestamp_epoch": "1583961782.231459000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-31e3684d04879901636b5cc8", "src_port": null, "tcp_stream": 71, "udp_stream": null, "frame_number": 1391, "timestamp_epoch": "1583961782.232292000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f", "kerberos.msg_type": "12,14" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-ac9123b1a85b37b625a486d9", "src_port": null, "tcp_stream": 72, "udp_stream": null, "frame_number": 1404, "timestamp_epoch": "1583961782.252437000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "LAPTOP-7XMV2SN$" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-8f269e4bd32564b5a15dab27", "src_port": null, "tcp_stream": 72, "udp_stream": null, "frame_number": 1407, "timestamp_epoch": "1583961782.253307000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f", "kerberos.msg_type": "14" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-886ad5e7a181ec3d2ba1274a", "src_port": null, "tcp_stream": 73, "udp_stream": null, "frame_number": 1419, "timestamp_epoch": "1583961782.266315000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-16f2a55b73c77ed43145ad1f", "src_port": null, "tcp_stream": 73, "udp_stream": null, "frame_number": 1421, "timestamp_epoch": "1583961782.267321000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "b8:ca:3a:ec:3b:8f", "nbns.name": "MONDOGREEK<00>,MONDOGREEK<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-c09fb4a9fbb3d97a70bd8f2e", "src_port": null, "tcp_stream": null, "udp_stream": 38, "frame_number": 1428, "timestamp_epoch": "1583961782.278124000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "b8:ca:3a:ec:3b:8f", "nbns.name": "LAPTOP-7XMV2SN<00>,LAPTOP-7XMV2SN<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-502f9e00dccf9673dfa8df4c", "src_port": null, "tcp_stream": null, "udp_stream": 38, "frame_number": 1429, "timestamp_epoch": "1583961782.278241000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f", "kerberos.msg_type": "12,14" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-5740091e50d8445f400458ed", "src_port": null, "tcp_stream": 74, "udp_stream": null, "frame_number": 1436, "timestamp_epoch": "1583961782.405816000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "LAPTOP-7XMV2SN$" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-41b07b50101b4d64cfdf10df", "src_port": null, "tcp_stream": 74, "udp_stream": null, "frame_number": 1439, "timestamp_epoch": "1583961782.406705000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f", "kerberos.msg_type": "12,14" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-f14f385ee6c9ea23d25a5b1a", "src_port": null, "tcp_stream": 75, "udp_stream": null, "frame_number": 1448, "timestamp_epoch": "1583961782.407846000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "LAPTOP-7XMV2SN$" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-f3d5bb584de4f5345926412a", "src_port": null, "tcp_stream": 75, "udp_stream": null, "frame_number": 1451, "timestamp_epoch": "1583961782.408253000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f", "kerberos.msg_type": "14" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-88a203e7c6baeb438c8d7125", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1458, "timestamp_epoch": "1583961782.409282000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-909fb2f1f0c77a70c4df91aa", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1460, "timestamp_epoch": "1583961782.411240000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-4878aab964d17372c4fba6b2", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1461, "timestamp_epoch": "1583961782.412113000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-d2a4f072200b4d434c3869ef", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1462, "timestamp_epoch": "1583961782.412475000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-d296a17267d4cbe5c4651848", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1463, "timestamp_epoch": "1583961782.429018000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-4506a2c18f6b2f2095105b19", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1464, "timestamp_epoch": "1583961782.429446000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-405a4223857eb6d1d16f6408", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1465, "timestamp_epoch": "1583961782.446114000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-1d5170f735b28acaff1540c4", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1466, "timestamp_epoch": "1583961782.446435000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-1835643c0a781150d250534d", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1467, "timestamp_epoch": "1583961782.453180000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-8d65dfb804806bab857f7df8", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1468, "timestamp_epoch": "1583961782.453639000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-30f63c283c9a2a7cf4d9e7b8", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1469, "timestamp_epoch": "1583961782.462062000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-60537c926fdccecc50ae0dcd", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1470, "timestamp_epoch": "1583961782.462463000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-fd41bdd5c74a5e46d0d32dad", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1471, "timestamp_epoch": "1583961782.462722000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-bb79387e6b1e0f0fda0eb530", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1472, "timestamp_epoch": "1583961782.462878000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-bb2a8be59c558f3777ea6231", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1473, "timestamp_epoch": "1583961782.463186000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-6ddc88598147616b51e44cb2", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1474, "timestamp_epoch": "1583961782.463457000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-3b733e8a05c2d00d1c4d1000", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1475, "timestamp_epoch": "1583961782.464788000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-0e5ce5e639ec5899023b3ace", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1476, "timestamp_epoch": "1583961782.465068000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-2e388e46b99a3407b69102e1", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1477, "timestamp_epoch": "1583961782.465231000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-40b734422f4d4d5831982b9d", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1478, "timestamp_epoch": "1583961782.465340000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-687747e433833587e73e7904", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1479, "timestamp_epoch": "1583961782.465452000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-a53ad6302d4a8c7c5c12374b", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1480, "timestamp_epoch": "1583961782.465623000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-25cbe38a64077794709a723e", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1481, "timestamp_epoch": "1583961782.467477000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-86a6386d5401459accb85ea3", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1482, "timestamp_epoch": "1583961782.467812000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-731df99bab60b2a2e9c211fa", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1483, "timestamp_epoch": "1583961782.468133000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-3dee5a6400b3afba69a5aba0", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1484, "timestamp_epoch": "1583961782.468324000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-bd5285337b2b1632f61a2780", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1485, "timestamp_epoch": "1583961782.468916000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-d0bc9edaa283df932d081334", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1486, "timestamp_epoch": "1583961782.469287000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-677ffb09181d562074870a3c", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1487, "timestamp_epoch": "1583961782.471105000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-1f9195c7c9aa8e85b021ce8c", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1488, "timestamp_epoch": "1583961782.471502000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-414b8e3b2907a331ee7861ea", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1489, "timestamp_epoch": "1583961782.472261000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-af2ac833192bb7dc1331e36c", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1490, "timestamp_epoch": "1583961782.472456000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-6767fa1d029ca1935482ba56", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1491, "timestamp_epoch": "1583961782.473272000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-7d962e93e78a70576c865072", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1492, "timestamp_epoch": "1583961782.473587000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-5f6d7eaaa0bdfd889f6a9422", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1493, "timestamp_epoch": "1583961782.474474000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-da2583764b2dc8addebe2220", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1494, "timestamp_epoch": "1583961782.474998000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-b4b769ae85420c21a782414b", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1495, "timestamp_epoch": "1583961782.475449000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-d67015de4aaea408fc207675", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1496, "timestamp_epoch": "1583961782.475708000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-84a882d389f1d4906d8c852e", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1497, "timestamp_epoch": "1583961782.476499000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-6d17d068279e28889ccc375f", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1498, "timestamp_epoch": "1583961782.476691000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-0ef63dd71311c2d8e1e203b2", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1499, "timestamp_epoch": "1583961782.477369000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-c52ed98b313e416c2c92829c", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1500, "timestamp_epoch": "1583961782.477720000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-cc9aad0c8a3d796d7cf7177c", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1501, "timestamp_epoch": "1583961782.478052000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-9a95fa7a8ec88f855b42c6e9", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1502, "timestamp_epoch": "1583961782.478168000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-fb6d52e415e1b95dcd8ed0ab", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1503, "timestamp_epoch": "1583961782.478479000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-7ef3b97ec45ba759aaa9cbbf", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1504, "timestamp_epoch": "1583961782.478631000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-464b0a0dadd269056d7081d4", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1505, "timestamp_epoch": "1583961782.479001000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-2c213c1c2880f2fa0dd29818", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1506, "timestamp_epoch": "1583961782.479127000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-d315cd8c068893068ff6ce5e", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1507, "timestamp_epoch": "1583961782.479386000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-59e3aa77b9909dcb70234f44", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1508, "timestamp_epoch": "1583961782.479514000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-3db5422de162c3afb5e86672", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1509, "timestamp_epoch": "1583961782.479735000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-5e5a322431b2f0009113e8b0", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1510, "timestamp_epoch": "1583961782.479881000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-972a4a4ebe876b401aafa075", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1511, "timestamp_epoch": "1583961782.482939000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-5bb938749396757d1f656cba", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1512, "timestamp_epoch": "1583961782.483320000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-2f66e6a039925e93c43d27af", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1513, "timestamp_epoch": "1583961782.484823000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-51476bb66c40bcb8b22edc6a", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1514, "timestamp_epoch": "1583961782.485138000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-e7b98be395a4808b31c7cb2f", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1515, "timestamp_epoch": "1583961782.485777000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-da21b3a6ebffe65ef0d1cb85", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1516, "timestamp_epoch": "1583961782.486074000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-18731ef12c413b549dc33e11", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1517, "timestamp_epoch": "1583961782.486687000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-d4efa5e4a42eb85ea28a333b", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1518, "timestamp_epoch": "1583961782.486972000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-bfe73ad28559f90840d8f524", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1519, "timestamp_epoch": "1583961782.487300000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-4c854a822e6b1642f7be015e", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1520, "timestamp_epoch": "1583961782.487574000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-55ba638b642a757821b98651", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1521, "timestamp_epoch": "1583961782.487820000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-c0a5580b59376be0ba325753", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1522, "timestamp_epoch": "1583961782.488019000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-961c04a597c4c85cfa24c3c7", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1523, "timestamp_epoch": "1583961782.488292000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-848cd8cf7c2f985132fa6e8c", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1524, "timestamp_epoch": "1583961782.488462000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-bdb4826cf7bc138c513e3266", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1525, "timestamp_epoch": "1583961782.488707000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-cca42775e97511df7efbe3c5", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1526, "timestamp_epoch": "1583961782.488873000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-367deac6a5e820e8f338c02c", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1527, "timestamp_epoch": "1583961782.489067000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-33d326021d5ae1df89ba2f28", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1528, "timestamp_epoch": "1583961782.489223000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-e21576f751b9fe2219917af5", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1529, "timestamp_epoch": "1583961782.489610000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-b2b63900c64eab14b6ec40b6", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1530, "timestamp_epoch": "1583961782.489918000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-727bcc7bb6bf7013e04949d7", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1531, "timestamp_epoch": "1583961782.490400000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-3fc041783a3365672d4b329b", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1532, "timestamp_epoch": "1583961782.490560000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-7acea46745a901ad27ef004f", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1533, "timestamp_epoch": "1583961782.490699000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-e0f654bbd85a7c811b5bcf30", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1534, "timestamp_epoch": "1583961782.490860000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-388240302724592545d5f1a3", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1535, "timestamp_epoch": "1583961782.491097000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-5962a742c53d9cf0bee6d56f", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1536, "timestamp_epoch": "1583961782.491241000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-9d7104ca574531c55375f4e4", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1537, "timestamp_epoch": "1583961782.491842000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-8decc7861ac14051ededc616", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1538, "timestamp_epoch": "1583961782.492001000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-abb022df5e6c69a9190e4a33", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1539, "timestamp_epoch": "1583961782.492267000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-c7a9bf34cadf2b3c2b010b32", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1541, "timestamp_epoch": "1583961782.492550000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-66b7f41f2012053bbf0cd4ab", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1543, "timestamp_epoch": "1583961782.492986000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-a10c4341b0f966f8d55c10b5", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1544, "timestamp_epoch": "1583961782.493163000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-b2a12ce3a3be868a5da60b35", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1545, "timestamp_epoch": "1583961782.493394000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-4ae0bdc3b7347db80e0d8ff3", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1546, "timestamp_epoch": "1583961782.493661000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-dbd0adb91e845fb4593ddbf5", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1547, "timestamp_epoch": "1583961782.493807000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-b7360bec68941244da254f67", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1548, "timestamp_epoch": "1583961782.493995000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-d7f647ee79962dd5b3978986", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1549, "timestamp_epoch": "1583961782.494244000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-65bdb363925a35a5d13f5fd6", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1550, "timestamp_epoch": "1583961782.494397000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-9f5056f72d00f3d4c3cf9b05", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1551, "timestamp_epoch": "1583961782.494600000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-45adc71f265d7a7a2ecd0e90", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1552, "timestamp_epoch": "1583961782.494843000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-c685cad41b7e49094d5096a6", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1553, "timestamp_epoch": "1583961782.495019000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-01bfcc2dd560e8cc48157b0b", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1554, "timestamp_epoch": "1583961782.495492000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-df2841db82d843313557940c", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1555, "timestamp_epoch": "1583961782.495762000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-163ab1a46c173681791ae08d", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1556, "timestamp_epoch": "1583961782.495952000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-b3fa30ef32ca65a6e9619b89", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1557, "timestamp_epoch": "1583961782.496136000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-fdc3688d295ac28839c1ece5", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1558, "timestamp_epoch": "1583961782.496295000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-2c4fd805fdcf85f438f31b4d", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1559, "timestamp_epoch": "1583961782.496472000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-4ba897c4a6589e95b7a68a5a", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1560, "timestamp_epoch": "1583961782.496675000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-3f2afc7f26d1af0ea024d960", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1561, "timestamp_epoch": "1583961782.496922000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-8a061f479bb4eddc38acf64a", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1562, "timestamp_epoch": "1583961782.497095000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-127354a838da6c049eae54d8", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1563, "timestamp_epoch": "1583961782.497292000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-4d93d2dffaed10fd4522f887", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1564, "timestamp_epoch": "1583961782.497547000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-e091a6a1920189a09afd3e1e", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1565, "timestamp_epoch": "1583961782.498203000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-5648fa3af4c5b00c2a88c8e0", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1566, "timestamp_epoch": "1583961782.498431000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-aefb93f4738ad5549acf0e9a", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1567, "timestamp_epoch": "1583961782.500605000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-4a3aed150429a17db44d5f02", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1568, "timestamp_epoch": "1583961782.500951000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-a42bebd52363b27dd3f04701", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1569, "timestamp_epoch": "1583961782.501566000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-515c556897e1540a2ab96296", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1570, "timestamp_epoch": "1583961782.501799000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "b8:ca:3a:ec:3b:8f", "nbns.name": "LAPTOP-7XMV2SN<20>,LAPTOP-7XMV2SN<20> (Server service)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-9e127a61c5e4be9ff872ed19", "src_port": null, "tcp_stream": null, "udp_stream": 38, "frame_number": 1580, "timestamp_epoch": "1583961782.825053000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "b8:ca:3a:ec:3b:8f", "nbns.name": "LAPTOP-7XMV2SN<00>,LAPTOP-7XMV2SN<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-42bccf8a3d9977046e987879", "src_port": null, "tcp_stream": null, "udp_stream": 38, "frame_number": 1581, "timestamp_epoch": "1583961783.059501000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "b8:ca:3a:ec:3b:8f", "nbns.name": "MONDOGREEK<00>,MONDOGREEK<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-c4918cec172546f62563059f", "src_port": null, "tcp_stream": null, "udp_stream": 38, "frame_number": 1582, "timestamp_epoch": "1583961783.059649000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94", "kerberos.msg_type": "10", "kerberos.CNameString": "dominga.mcdowell" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-df0bb58261adeafbd4ac8abc", "src_port": null, "tcp_stream": 76, "udp_stream": null, "frame_number": 1586, "timestamp_epoch": "1583961783.076689000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "30" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-71e42793cf843a98523722d7", "src_port": null, "tcp_stream": 76, "udp_stream": null, "frame_number": 1587, "timestamp_epoch": "1583961783.077238000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94", "kerberos.msg_type": "10", "kerberos.CNameString": "dominga.mcdowell" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-4b3b7944bc46d6cd49fb6a73", "src_port": null, "tcp_stream": 77, "udp_stream": null, "frame_number": 1594, "timestamp_epoch": "1583961783.090540000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "11", "kerberos.CNameString": "dominga.mcdowell" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-3d60e063f2c434221b5005f4", "src_port": null, "tcp_stream": 77, "udp_stream": null, "frame_number": 1596, "timestamp_epoch": "1583961783.091267000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94", "kerberos.msg_type": "12,14" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-f116084f896ce1942c6a36a0", "src_port": null, "tcp_stream": 78, "udp_stream": null, "frame_number": 1605, "timestamp_epoch": "1583961783.093128000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "dominga.mcdowell" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-9a04a21c8a8f11e90e13b330", "src_port": null, "tcp_stream": 78, "udp_stream": null, "frame_number": 1608, "timestamp_epoch": "1583961783.094118000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94", "kerberos.msg_type": "12,14" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-2577488659f5204dafef9394", "src_port": null, "tcp_stream": 80, "udp_stream": null, "frame_number": 1627, "timestamp_epoch": "1583961783.480383000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "dominga.mcdowell" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-4748545cbfd79413baaaea6b", "src_port": null, "tcp_stream": 80, "udp_stream": null, "frame_number": 1630, "timestamp_epoch": "1583961783.481403000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94", "kerberos.msg_type": "14" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-235820c267f7706171481a77", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 1636, "timestamp_epoch": "1583961783.482135000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-faf951cda85b10716a5af31c", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 1638, "timestamp_epoch": "1583961783.482912000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94", "kerberos.msg_type": "15" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-05d40c2bf8c75072c3762076", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 1639, "timestamp_epoch": "1583961783.483647000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-372f2c5c414371f4bc295dfa", "src_port": null, "tcp_stream": 81, "udp_stream": null, "frame_number": 1653, "timestamp_epoch": "1583961783.495896000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-bbf69a0191fb87d2381b315d", "src_port": null, "tcp_stream": 81, "udp_stream": null, "frame_number": 1654, "timestamp_epoch": "1583961783.496058000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-221c9fd15c03055e45fe282f", "src_port": null, "tcp_stream": 81, "udp_stream": null, "frame_number": 1655, "timestamp_epoch": "1583961783.496325000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94", "kerberos.msg_type": "12,14" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-2fc96d839e741cef25cf6196", "src_port": null, "tcp_stream": 82, "udp_stream": null, "frame_number": 1660, "timestamp_epoch": "1583961783.500683000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "30" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-550bed37dfac77025e9e4182", "src_port": null, "tcp_stream": 82, "udp_stream": null, "frame_number": 1662, "timestamp_epoch": "1583961783.501475000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-fff3d7a265ae7eabb1fa1858", "src_port": null, "tcp_stream": 81, "udp_stream": null, "frame_number": 1666, "timestamp_epoch": "1583961783.521448000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-81bbeb1fbea44f704a1c5da8", "src_port": null, "tcp_stream": 81, "udp_stream": null, "frame_number": 1667, "timestamp_epoch": "1583961783.522056000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94", "ntlmssp.auth.domain": "MONDOGREEK", "ntlmssp.auth.hostname": "LAPTOP-I9ZPI04", "ntlmssp.auth.username": "dominga.mcdowell" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-947c96d508067ebcbf9562c3", "src_port": null, "tcp_stream": 81, "udp_stream": null, "frame_number": 1668, "timestamp_epoch": "1583961783.523575000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-b3eb0176569e069905619308", "src_port": null, "tcp_stream": 81, "udp_stream": null, "frame_number": 1669, "timestamp_epoch": "1583961783.524942000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-dcd1a5d010e63c3848e71639", "src_port": null, "tcp_stream": 81, "udp_stream": null, "frame_number": 1670, "timestamp_epoch": "1583961783.526393000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-a836c350a94a18a9c1e28434", "src_port": null, "tcp_stream": 81, "udp_stream": null, "frame_number": 1671, "timestamp_epoch": "1583961783.526677000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-6e7e776ead7f5996bf54c8c2", "src_port": null, "tcp_stream": 81, "udp_stream": null, "frame_number": 1672, "timestamp_epoch": "1583961783.526903000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-26ad40414ac58d606a8659bc", "src_port": null, "tcp_stream": 81, "udp_stream": null, "frame_number": 1673, "timestamp_epoch": "1583961783.527054000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-e162aed8edbe6375d8e52228", "src_port": null, "tcp_stream": 81, "udp_stream": null, "frame_number": 1674, "timestamp_epoch": "1583961783.532255000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-096a66946a5f29b4f023ec60", "src_port": null, "tcp_stream": 81, "udp_stream": null, "frame_number": 1675, "timestamp_epoch": "1583961783.532828000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-0065739de55738f15cbe491b", "src_port": null, "tcp_stream": 81, "udp_stream": null, "frame_number": 1676, "timestamp_epoch": "1583961783.538015000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-e77ff2444c661d94c1b28917", "src_port": null, "tcp_stream": 81, "udp_stream": null, "frame_number": 1677, "timestamp_epoch": "1583961783.538273000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-b92a553c4a2a424845732867", "src_port": null, "tcp_stream": 81, "udp_stream": null, "frame_number": 1679, "timestamp_epoch": "1583961783.542394000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-946e8ffdb0b742f90c6d88e7", "src_port": null, "tcp_stream": 81, "udp_stream": null, "frame_number": 1680, "timestamp_epoch": "1583961783.542652000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-ce0184efbb2f88acd7c51e02", "src_port": null, "tcp_stream": 81, "udp_stream": null, "frame_number": 1681, "timestamp_epoch": "1583961783.543334000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-c37c5a86da9735dfa861d21d", "src_port": null, "tcp_stream": 81, "udp_stream": null, "frame_number": 1682, "timestamp_epoch": "1583961783.543578000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-e7cb6895e7d4bfba034e5437", "src_port": null, "tcp_stream": 81, "udp_stream": null, "frame_number": 1683, "timestamp_epoch": "1583961783.543910000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-75ee8a19c861619cdd1c2080", "src_port": null, "tcp_stream": 81, "udp_stream": null, "frame_number": 1684, "timestamp_epoch": "1583961783.544429000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-1c368631c56d20b70fe74fc7", "src_port": null, "tcp_stream": 81, "udp_stream": null, "frame_number": 1685, "timestamp_epoch": "1583961783.545049000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-18fb274e7dd0ded60e7761b7", "src_port": null, "tcp_stream": 81, "udp_stream": null, "frame_number": 1686, "timestamp_epoch": "1583961783.545446000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-cde862089cc34d0e5f584c5a", "src_port": null, "tcp_stream": 81, "udp_stream": null, "frame_number": 1687, "timestamp_epoch": "1583961783.545711000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-d89b40a4d53f8c9482a8dde6", "src_port": null, "tcp_stream": 81, "udp_stream": null, "frame_number": 1688, "timestamp_epoch": "1583961783.546172000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-c3c3b7eab4a2083d774ece65", "src_port": null, "tcp_stream": 81, "udp_stream": null, "frame_number": 1689, "timestamp_epoch": "1583961783.546555000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-122d417409d1f832a74a8971", "src_port": null, "tcp_stream": 81, "udp_stream": null, "frame_number": 1690, "timestamp_epoch": "1583961783.547033000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-051b4a03b53202e26a2865bf", "src_port": null, "tcp_stream": 81, "udp_stream": null, "frame_number": 1691, "timestamp_epoch": "1583961783.547874000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-98c3181e9e23192ec0c37131", "src_port": null, "tcp_stream": 81, "udp_stream": null, "frame_number": 1692, "timestamp_epoch": "1583961783.548561000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-544aa2569a6a76b27e8b3826", "src_port": null, "tcp_stream": 81, "udp_stream": null, "frame_number": 1693, "timestamp_epoch": "1583961783.548844000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-578c6d49781b638dfddccdaf", "src_port": null, "tcp_stream": 81, "udp_stream": null, "frame_number": 1694, "timestamp_epoch": "1583961783.549391000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-a0ea1c2d522c5a078892448a", "src_port": null, "tcp_stream": 81, "udp_stream": null, "frame_number": 1695, "timestamp_epoch": "1583961783.550201000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-e249e03486bc734e7dd200ce", "src_port": null, "tcp_stream": 81, "udp_stream": null, "frame_number": 1696, "timestamp_epoch": "1583961783.551086000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-adcd9020dff1c57a836b30da", "src_port": null, "tcp_stream": 81, "udp_stream": null, "frame_number": 1697, "timestamp_epoch": "1583961783.551380000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a", "samr.samr_UserInfo21.full_name": "Dominga McDowell", "samr.samr_UserInfo21.account_name": "dominga.mcdowell" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-200e7989792f60b22c0e6c23", "src_port": null, "tcp_stream": 81, "udp_stream": null, "frame_number": 1698, "timestamp_epoch": "1583961783.552100000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-9315dbefa3157c5813ac83fe", "src_port": null, "tcp_stream": 81, "udp_stream": null, "frame_number": 1699, "timestamp_epoch": "1583961783.552725000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-67614a3f0b5f1cd22e4256d3", "src_port": null, "tcp_stream": 81, "udp_stream": null, "frame_number": 1700, "timestamp_epoch": "1583961783.553452000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-1fc661c9bac6db08d739266f", "src_port": null, "tcp_stream": 81, "udp_stream": null, "frame_number": 1701, "timestamp_epoch": "1583961783.554327000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-f9b40fa05a5c359988d2cb8c", "src_port": null, "tcp_stream": 81, "udp_stream": null, "frame_number": 1702, "timestamp_epoch": "1583961783.555084000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-7804cde73ed180e401531f70", "src_port": null, "tcp_stream": 81, "udp_stream": null, "frame_number": 1703, "timestamp_epoch": "1583961783.555640000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-75c1aa8920f5ea86ac203e98", "src_port": null, "tcp_stream": 81, "udp_stream": null, "frame_number": 1704, "timestamp_epoch": "1583961783.556146000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-172bc6422662e159fab2537f", "src_port": null, "tcp_stream": 81, "udp_stream": null, "frame_number": 1705, "timestamp_epoch": "1583961783.562945000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-ba51d7e6409e332875bd77d8", "src_port": null, "tcp_stream": 81, "udp_stream": null, "frame_number": 1706, "timestamp_epoch": "1583961783.563520000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-7cb1cf16ca428b3b5f6d9874", "src_port": null, "tcp_stream": 81, "udp_stream": null, "frame_number": 1707, "timestamp_epoch": "1583961783.564153000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-00dfbc06a6dead6a87fb2a78", "src_port": null, "tcp_stream": 81, "udp_stream": null, "frame_number": 1708, "timestamp_epoch": "1583961783.564640000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-61f1ce3dc837af76c6b33986", "src_port": null, "tcp_stream": 81, "udp_stream": null, "frame_number": 1709, "timestamp_epoch": "1583961783.565899000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-c109e86baa7400561a55c7c0", "src_port": null, "tcp_stream": 81, "udp_stream": null, "frame_number": 1710, "timestamp_epoch": "1583961783.566360000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-716d902d7fd5a98dec068a33", "src_port": null, "tcp_stream": 81, "udp_stream": null, "frame_number": 1711, "timestamp_epoch": "1583961783.572530000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-df8438924eacfd7517f4ecbd", "src_port": null, "tcp_stream": 81, "udp_stream": null, "frame_number": 1712, "timestamp_epoch": "1583961783.573165000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-b56a47a4045c3ca63a3535ef", "src_port": null, "tcp_stream": 81, "udp_stream": null, "frame_number": 1713, "timestamp_epoch": "1583961783.574576000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-6bff7fbc86422560b101c159", "src_port": null, "tcp_stream": 81, "udp_stream": null, "frame_number": 1714, "timestamp_epoch": "1583961783.574865000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "b8:ca:3a:ec:3b:8f", "nbns.name": "LAPTOP-7XMV2SN<20>,LAPTOP-7XMV2SN<20> (Server service)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-2468476f13bbf0b01af5b975", "src_port": null, "tcp_stream": null, "udp_stream": 38, "frame_number": 1715, "timestamp_epoch": "1583961783.575148000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-6790c71b33eede5ea1890cdd", "src_port": null, "tcp_stream": 83, "udp_stream": null, "frame_number": 1721, "timestamp_epoch": "1583961783.700302000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-f0a1dc48be7baa068a7e5cdb", "src_port": null, "tcp_stream": 83, "udp_stream": null, "frame_number": 1722, "timestamp_epoch": "1583961783.700615000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-ca72207b9a2a10f4adff134a", "src_port": null, "tcp_stream": 83, "udp_stream": null, "frame_number": 1723, "timestamp_epoch": "1583961783.701251000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94", "kerberos.msg_type": "12,14" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-736065063d98e0bfd42bb888", "src_port": null, "tcp_stream": 84, "udp_stream": null, "frame_number": 1728, "timestamp_epoch": "1583961783.704679000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "dominga.mcdowell" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-0768db1759589576ae1a2baf", "src_port": null, "tcp_stream": 84, "udp_stream": null, "frame_number": 1731, "timestamp_epoch": "1583961783.705651000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94", "kerberos.msg_type": "12,14" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-e7d3c3a33cbed4a1dfd2c157", "src_port": null, "tcp_stream": 85, "udp_stream": null, "frame_number": 1740, "timestamp_epoch": "1583961783.707270000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "dominga.mcdowell" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-159cae1343ad983b928d7207", "src_port": null, "tcp_stream": 85, "udp_stream": null, "frame_number": 1743, "timestamp_epoch": "1583961783.707718000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94", "kerberos.msg_type": "14" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-247a23be162ec51b68ec9aa9", "src_port": null, "tcp_stream": 83, "udp_stream": null, "frame_number": 1750, "timestamp_epoch": "1583961783.708545000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-a649bb588343cf919a155181", "src_port": null, "tcp_stream": 83, "udp_stream": null, "frame_number": 1752, "timestamp_epoch": "1583961783.710891000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-c298fded18dbe8b747a6fedf", "src_port": null, "tcp_stream": 83, "udp_stream": null, "frame_number": 1753, "timestamp_epoch": "1583961783.711605000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-4e14d9f76d5231f8eea00dbb", "src_port": null, "tcp_stream": 83, "udp_stream": null, "frame_number": 1754, "timestamp_epoch": "1583961783.711955000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-b8b50ae492877643c95417ec", "src_port": null, "tcp_stream": 83, "udp_stream": null, "frame_number": 1755, "timestamp_epoch": "1583961783.712503000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-28a2db665c0bbf3a59947ec5", "src_port": null, "tcp_stream": 83, "udp_stream": null, "frame_number": 1756, "timestamp_epoch": "1583961783.712712000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-eeeac404989d1d26d99410e2", "src_port": null, "tcp_stream": 83, "udp_stream": null, "frame_number": 1757, "timestamp_epoch": "1583961783.712842000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-dbffef6d1d7fb5a190098973", "src_port": null, "tcp_stream": 83, "udp_stream": null, "frame_number": 1758, "timestamp_epoch": "1583961783.731200000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-d1bdd8f2e3f74b0ea0dd7d74", "src_port": null, "tcp_stream": 83, "udp_stream": null, "frame_number": 1760, "timestamp_epoch": "1583961783.826805000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94", "kerberos.msg_type": "14" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-644932fadecbf05ee285ed73", "src_port": null, "tcp_stream": 86, "udp_stream": null, "frame_number": 1765, "timestamp_epoch": "1583961783.845560000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-29ba9db8fc01060c4fae5ca8", "src_port": null, "tcp_stream": 86, "udp_stream": null, "frame_number": 1767, "timestamp_epoch": "1583961783.846852000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94", "kerberos.msg_type": "14" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-5f9587da3c8e890fd0afd80f", "src_port": null, "tcp_stream": 87, "udp_stream": null, "frame_number": 1774, "timestamp_epoch": "1583961783.867213000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-40e72e431f814b6ffb6d3c15", "src_port": null, "tcp_stream": 87, "udp_stream": null, "frame_number": 1776, "timestamp_epoch": "1583961783.868270000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-1a9b42ec803838ca903aa31d", "src_port": null, "tcp_stream": 83, "udp_stream": null, "frame_number": 1786, "timestamp_epoch": "1583961783.944987000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-b1a68cfd5ee13f6108635cec", "src_port": null, "tcp_stream": 83, "udp_stream": null, "frame_number": 1787, "timestamp_epoch": "1583961783.945458000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "b8:ca:3a:ec:3b:8f", "nbns.name": "LAPTOP-7XMV2SN<20>,LAPTOP-7XMV2SN<20> (Server service)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-a524376d83cff385726acd0e", "src_port": null, "tcp_stream": null, "udp_stream": 38, "frame_number": 1799, "timestamp_epoch": "1583961784.342626000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "b8:ca:3a:ec:3b:8f", "browser.server": "LAPTOP-7XMV2SN" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-7ae8d046664b6a8171858a18", "src_port": null, "tcp_stream": null, "udp_stream": 58, "frame_number": 1800, "timestamp_epoch": "1583961785.150290000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f", "kerberos.msg_type": "14" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-bd0bd4867437827bacdc2eec", "src_port": null, "tcp_stream": 95, "udp_stream": null, "frame_number": 1960, "timestamp_epoch": "1583961789.909925000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-11a9d68f8f2473903c1a44a0", "src_port": null, "tcp_stream": 95, "udp_stream": null, "frame_number": 1962, "timestamp_epoch": "1583961789.910946000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f", "kerberos.msg_type": "10", "kerberos.CNameString": "LAPTOP-7XMV2SN$" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-f144a7833d504ac888835c22", "src_port": null, "tcp_stream": 96, "udp_stream": null, "frame_number": 1978, "timestamp_epoch": "1583961789.925749000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "30" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-87a43a7944af071de0b9709e", "src_port": null, "tcp_stream": 96, "udp_stream": null, "frame_number": 1979, "timestamp_epoch": "1583961789.926329000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f", "kerberos.msg_type": "10", "kerberos.CNameString": "LAPTOP-7XMV2SN$" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-3e777f2578a355b1269b8588", "src_port": null, "tcp_stream": 97, "udp_stream": null, "frame_number": 1986, "timestamp_epoch": "1583961789.927399000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "11", "kerberos.CNameString": "LAPTOP-7XMV2SN$" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-e12aff5561470dce600ccf68", "src_port": null, "tcp_stream": 97, "udp_stream": null, "frame_number": 1988, "timestamp_epoch": "1583961789.928682000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f", "kerberos.msg_type": "12,14" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-ddaa8dedca7882decf804cb9", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 1997, "timestamp_epoch": "1583961789.929970000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "LAPTOP-7XMV2SN$" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-c6fb7b7f2d0b81bdf33c48b9", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 2000, "timestamp_epoch": "1583961789.931037000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-6944e8814e62f476db160907", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 2014, "timestamp_epoch": "1583961792.247231000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-25f579546dc12794f1166400", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 2015, "timestamp_epoch": "1583961792.247415000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-bba744620b58fe2ca7a8e106", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 2016, "timestamp_epoch": "1583961792.249558000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-0fa2b51d73c3a97d0188b60e", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 2017, "timestamp_epoch": "1583961792.249861000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-9645e89faff4a22cbc74ff42", "src_port": null, "tcp_stream": 81, "udp_stream": null, "frame_number": 2062, "timestamp_epoch": "1583961798.760354000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-6be8a71d6ba3c642eac019c0", "src_port": null, "tcp_stream": 83, "udp_stream": null, "frame_number": 2063, "timestamp_epoch": "1583961798.760633000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-b82c67d7f6aebc8a691c9411", "src_port": null, "tcp_stream": 81, "udp_stream": null, "frame_number": 2064, "timestamp_epoch": "1583961798.760738000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-fc2a526a3833b6efc33bf968", "src_port": null, "tcp_stream": 83, "udp_stream": null, "frame_number": 2065, "timestamp_epoch": "1583961798.761052000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-5b5e8f93a71baae637eb6723", "src_port": null, "tcp_stream": 81, "udp_stream": null, "frame_number": 2066, "timestamp_epoch": "1583961798.761072000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-c9f5818f6d32e92f676738aa", "src_port": null, "tcp_stream": 81, "udp_stream": null, "frame_number": 2067, "timestamp_epoch": "1583961798.761279000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f", "kerberos.msg_type": "10", "kerberos.CNameString": "otis.witherspoon" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-5bbe11f0819c66e346c7af30", "src_port": null, "tcp_stream": 100, "udp_stream": null, "frame_number": 2075, "timestamp_epoch": "1583961800.718687000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "30" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-d9e412afcb8ab7e53f0f969f", "src_port": null, "tcp_stream": 100, "udp_stream": null, "frame_number": 2076, "timestamp_epoch": "1583961800.719262000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f", "kerberos.msg_type": "10", "kerberos.CNameString": "otis.witherspoon" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-74f511d61d895c5b7fe05780", "src_port": null, "tcp_stream": 101, "udp_stream": null, "frame_number": 2083, "timestamp_epoch": "1583961800.726351000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "11", "kerberos.CNameString": "otis.witherspoon" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-66c69061429ff6d79ccadde8", "src_port": null, "tcp_stream": 101, "udp_stream": null, "frame_number": 2085, "timestamp_epoch": "1583961800.727214000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f", "kerberos.msg_type": "12,14" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-c0f40cb70e3bb81aeb5ab11e", "src_port": null, "tcp_stream": 102, "udp_stream": null, "frame_number": 2094, "timestamp_epoch": "1583961800.736394000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "otis.witherspoon" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-9882c6b725f7015e04bf0bb9", "src_port": null, "tcp_stream": 102, "udp_stream": null, "frame_number": 2097, "timestamp_epoch": "1583961800.737457000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f", "kerberos.msg_type": "12,14" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-38e16da09af0d9906b1beb76", "src_port": null, "tcp_stream": 103, "udp_stream": null, "frame_number": 2108, "timestamp_epoch": "1583961800.963018000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "otis.witherspoon" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-4c30d209ebd7941d135cce16", "src_port": null, "tcp_stream": 103, "udp_stream": null, "frame_number": 2111, "timestamp_epoch": "1583961800.964549000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f", "kerberos.msg_type": "14" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-84c3f08d5535c7457731d859", "src_port": null, "tcp_stream": 58, "udp_stream": null, "frame_number": 2117, "timestamp_epoch": "1583961800.965730000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-d182f12af3caa8a8987d6d2e", "src_port": null, "tcp_stream": 58, "udp_stream": null, "frame_number": 2119, "timestamp_epoch": "1583961800.966485000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f", "kerberos.msg_type": "15" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-8a22d89a6ff48f755e8ce1be", "src_port": null, "tcp_stream": 58, "udp_stream": null, "frame_number": 2120, "timestamp_epoch": "1583961800.967597000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-2cb7da9a31f0c81c44d52857", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2136, "timestamp_epoch": "1583961800.982027000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-01db397261fec75bc7d84be0", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2137, "timestamp_epoch": "1583961800.982629000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-2647a8c7cf7604a2735c779f", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2138, "timestamp_epoch": "1583961800.983067000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f", "kerberos.msg_type": "12,14" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-0104e1d592be9e9952a38271", "src_port": null, "tcp_stream": 105, "udp_stream": null, "frame_number": 2143, "timestamp_epoch": "1583961800.988059000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "30" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-58b58b43e06c2a4b295bbe23", "src_port": null, "tcp_stream": 105, "udp_stream": null, "frame_number": 2145, "timestamp_epoch": "1583961800.988556000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-6bc8bb2393359b8a5717a87b", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2151, "timestamp_epoch": "1583961801.004175000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-de446f295efc84bc0d35be7b", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2152, "timestamp_epoch": "1583961801.004819000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f", "ntlmssp.auth.domain": "MONDOGREEK", "ntlmssp.auth.hostname": "LAPTOP-7XMV2SN", "ntlmssp.auth.username": "otis.witherspoon" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-7eaa8395dc074a343e8199dd", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2153, "timestamp_epoch": "1583961801.006208000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-685316e78eb21c18bfc5e9e2", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2154, "timestamp_epoch": "1583961801.007526000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-d3943d30821579f525d50eaa", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2155, "timestamp_epoch": "1583961801.008192000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-a435afb3d87a31edf78aac85", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2156, "timestamp_epoch": "1583961801.008394000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-147253a4425f5a481b6f6d9e", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2157, "timestamp_epoch": "1583961801.008894000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-5fd23d2654d48c090496f895", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2158, "timestamp_epoch": "1583961801.009049000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-32a7c8cf1115b0bacb9c986e", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2159, "timestamp_epoch": "1583961801.010565000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-e37c61ad61144c2f008d4a37", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2160, "timestamp_epoch": "1583961801.011018000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-32e2853bd0efc68a840cd826", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2161, "timestamp_epoch": "1583961801.013851000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-74ec859c1235ab15e43d5f79", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2162, "timestamp_epoch": "1583961801.014075000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-ccddd0ad65d1a1732af63bb7", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2163, "timestamp_epoch": "1583961801.015781000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-839dbc4b54aebcab55518929", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2164, "timestamp_epoch": "1583961801.016228000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-7d007184934901b4ee1bcca8", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2165, "timestamp_epoch": "1583961801.016498000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-fd44959d7a7557fe91768bcf", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2166, "timestamp_epoch": "1583961801.016673000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-3c9488616cd17c64b8f10df0", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2167, "timestamp_epoch": "1583961801.016998000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-d190e3a36bb35a347717d1a3", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2168, "timestamp_epoch": "1583961801.017613000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-23741490f787a6b2620399f3", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2169, "timestamp_epoch": "1583961801.017867000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-2fe6559ec16702cad7e64b70", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2170, "timestamp_epoch": "1583961801.018252000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-bd0a952572ced441319fdc50", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2171, "timestamp_epoch": "1583961801.018566000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-e756b72db23792c9f20de57e", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2172, "timestamp_epoch": "1583961801.018989000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-453993edb81d2f2fcee43aad", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2173, "timestamp_epoch": "1583961801.019419000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-4500b01ed84484b2ea6c6cb7", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2174, "timestamp_epoch": "1583961801.019828000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-de570b2ba7592157e18435c9", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2175, "timestamp_epoch": "1583961801.020054000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-fbb26230028778d33f05d4ea", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2176, "timestamp_epoch": "1583961801.020459000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-21bcbc66bfda688b53b6866a", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2177, "timestamp_epoch": "1583961801.020634000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-89e9f008886d68097d03e59c", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2178, "timestamp_epoch": "1583961801.021192000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-cfe91b17f1a6e44b504e497a", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2179, "timestamp_epoch": "1583961801.021406000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-3d3e5d188b1d3199bff384bf", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2180, "timestamp_epoch": "1583961801.022083000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-57832cc527890f9b41a3d441", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2181, "timestamp_epoch": "1583961801.022294000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a", "samr.samr_UserInfo21.full_name": "Otis Witherspoon", "samr.samr_UserInfo21.account_name": "otis.witherspoon" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-58d3f1e4890fe7dc88cc028e", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2182, "timestamp_epoch": "1583961801.022721000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-587a6c2c21aa7ecba25a2ff7", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2183, "timestamp_epoch": "1583961801.022946000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-a54be091b144976e8b3b8293", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2184, "timestamp_epoch": "1583961801.023523000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-4a7bf933285b2fa413ec6251", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2185, "timestamp_epoch": "1583961801.023789000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-aef2da7391b63a1370350dfe", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2186, "timestamp_epoch": "1583961801.024248000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-14690198a74c629b9e2141fa", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2187, "timestamp_epoch": "1583961801.024530000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-770a21f0dd3a1df97c8465e0", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2188, "timestamp_epoch": "1583961801.024886000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-8ab02fda1d6dfbec7ae91f5c", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2189, "timestamp_epoch": "1583961801.025244000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-0acade8d0ca57f87d57411c7", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2190, "timestamp_epoch": "1583961801.025678000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-1c3a5322ad8c78a684414bf8", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2191, "timestamp_epoch": "1583961801.025958000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-0ed1da6218ee4b5ee2041b49", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2192, "timestamp_epoch": "1583961801.026402000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-f81cf96953b2ce8a6aa31fc1", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2193, "timestamp_epoch": "1583961801.026642000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-7b7560e61785512dee1ce9fb", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2194, "timestamp_epoch": "1583961801.026991000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-7e1a4168b912fd988a782253", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2195, "timestamp_epoch": "1583961801.027216000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-9b2bbfb0c3ffa455c9b205d5", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2196, "timestamp_epoch": "1583961801.027543000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-4ef46d070ec2cffdfc96926f", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2197, "timestamp_epoch": "1583961801.027882000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-934d88df98587420c25207fe", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2198, "timestamp_epoch": "1583961801.028102000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-0695bb1710827c58e422448e", "src_port": null, "tcp_stream": 106, "udp_stream": null, "frame_number": 2204, "timestamp_epoch": "1583961801.119499000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-cc8b3593713cfce841eb1c58", "src_port": null, "tcp_stream": 106, "udp_stream": null, "frame_number": 2205, "timestamp_epoch": "1583961801.119683000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-811e21ced1e14aa42a2e2f6c", "src_port": null, "tcp_stream": 106, "udp_stream": null, "frame_number": 2206, "timestamp_epoch": "1583961801.120067000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f", "kerberos.msg_type": "12,14" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-b22aa378a2d2e367edba359a", "src_port": null, "tcp_stream": 107, "udp_stream": null, "frame_number": 2211, "timestamp_epoch": "1583961801.141340000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "otis.witherspoon" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-e5caef62c0ecc9d45e35fc34", "src_port": null, "tcp_stream": 107, "udp_stream": null, "frame_number": 2214, "timestamp_epoch": "1583961801.142312000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f", "kerberos.msg_type": "12,14" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-bfe34e5c208ceafdd5e3212b", "src_port": null, "tcp_stream": 108, "udp_stream": null, "frame_number": 2223, "timestamp_epoch": "1583961801.143590000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "otis.witherspoon" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-afaa4162e26ff33a81d4043f", "src_port": null, "tcp_stream": 108, "udp_stream": null, "frame_number": 2226, "timestamp_epoch": "1583961801.143966000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f", "kerberos.msg_type": "14" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-9b3ad477f5c7391eef26a4fc", "src_port": null, "tcp_stream": 106, "udp_stream": null, "frame_number": 2233, "timestamp_epoch": "1583961801.144703000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-2f187b2b56ad223e3eff5dda", "src_port": null, "tcp_stream": 106, "udp_stream": null, "frame_number": 2235, "timestamp_epoch": "1583961801.146847000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-74d57a088602d620534edd2f", "src_port": null, "tcp_stream": 106, "udp_stream": null, "frame_number": 2236, "timestamp_epoch": "1583961801.147369000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-18a37eba4f620b2d72a5cd83", "src_port": null, "tcp_stream": 106, "udp_stream": null, "frame_number": 2237, "timestamp_epoch": "1583961801.147755000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-23674678ae1e63ceb6f12a7d", "src_port": null, "tcp_stream": 106, "udp_stream": null, "frame_number": 2238, "timestamp_epoch": "1583961801.148091000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-e6e0474968cbb4a15a6a45ca", "src_port": null, "tcp_stream": 106, "udp_stream": null, "frame_number": 2239, "timestamp_epoch": "1583961801.148285000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-e50b73d2c4c02def61e1757c", "src_port": null, "tcp_stream": 106, "udp_stream": null, "frame_number": 2240, "timestamp_epoch": "1583961801.158561000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-4d14c1947048964c5aac36b8", "src_port": null, "tcp_stream": 106, "udp_stream": null, "frame_number": 2241, "timestamp_epoch": "1583961801.167541000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-d52ee487493102fce6fdca61", "src_port": null, "tcp_stream": 106, "udp_stream": null, "frame_number": 2243, "timestamp_epoch": "1583961801.264909000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f", "kerberos.msg_type": "14" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-d76c8e067f61a8b231c63dcd", "src_port": null, "tcp_stream": 109, "udp_stream": null, "frame_number": 2248, "timestamp_epoch": "1583961801.304771000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-8f7b90d286a05e62f4880054", "src_port": null, "tcp_stream": 109, "udp_stream": null, "frame_number": 2250, "timestamp_epoch": "1583961801.305753000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-f24a03b5444d318270629a60", "src_port": null, "tcp_stream": 106, "udp_stream": null, "frame_number": 2257, "timestamp_epoch": "1583961801.321994000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-de3684473649f1cd077541b3", "src_port": null, "tcp_stream": 106, "udp_stream": null, "frame_number": 2258, "timestamp_epoch": "1583961801.322282000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f", "kerberos.msg_type": "14" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-5b9f43005d71d14a2059bd65", "src_port": null, "tcp_stream": 110, "udp_stream": null, "frame_number": 2260, "timestamp_epoch": "1583961801.332921000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-571c86504be5f8a65c22bcc9", "src_port": null, "tcp_stream": 110, "udp_stream": null, "frame_number": 2262, "timestamp_epoch": "1583961801.333878000" }, { "kind": "identity", "dst_ip": "224.0.0.251", "fields": { "eth.dst": "01:00:5e:00:00:fb", "eth.src": "10:98:36:59:9d:cc", "dns.qry.name": "LAPTOP-SQSA42O.local" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-2aecc1b27a2606f5fbdae568", "src_port": null, "tcp_stream": null, "udp_stream": 80, "frame_number": 2481, "timestamp_epoch": "1583961810.441797000" }, { "kind": "identity", "dst_ip": "224.0.0.251", "fields": { "eth.dst": "01:00:5e:00:00:fb", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-521ef985eec9b4289cc95fda", "src_port": null, "tcp_stream": null, "udp_stream": 80, "frame_number": 2482, "timestamp_epoch": "1583961810.442645000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "10:98:36:59:9d:cc", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-a35654bd2bfc98a371503439", "src_port": null, "tcp_stream": null, "udp_stream": 86, "frame_number": 2501, "timestamp_epoch": "1583961811.521662000" }, { "kind": "identity", "dst_ip": "224.0.0.251", "fields": { "eth.dst": "01:00:5e:00:00:fb", "eth.src": "10:98:36:59:9d:cc", "dns.qry.name": "wpad.local" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-bb0f33abcee24a636ec3d775", "src_port": null, "tcp_stream": null, "udp_stream": 80, "frame_number": 2502, "timestamp_epoch": "1583961811.522363000" }, { "kind": "identity", "dst_ip": "224.0.0.251", "fields": { "eth.dst": "01:00:5e:00:00:fb", "eth.src": "10:98:36:59:9d:cc", "dns.qry.name": "wpad.local" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-728477d3fb7d0d3d669a0803", "src_port": null, "tcp_stream": null, "udp_stream": 80, "frame_number": 2503, "timestamp_epoch": "1583961811.522912000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "10:98:36:59:9d:cc", "dns.qry.name": "wpad" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-4e5c224098859004eaf446ac", "src_port": null, "tcp_stream": null, "udp_stream": 87, "frame_number": 2504, "timestamp_epoch": "1583961811.523758000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "10:98:36:59:9d:cc", "dns.qry.name": "wpad" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-785cda4630063eda8048d598", "src_port": null, "tcp_stream": null, "udp_stream": 88, "frame_number": 2505, "timestamp_epoch": "1583961811.524156000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "10:98:36:59:9d:cc", "dns.qry.name": "wpad" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-e2f6eebe9871840a11c00f2e", "src_port": null, "tcp_stream": null, "udp_stream": 88, "frame_number": 2506, "timestamp_epoch": "1583961811.933093000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "10:98:36:59:9d:cc", "dns.qry.name": "wpad" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-2b522b415bc8f2789f1aab22", "src_port": null, "tcp_stream": null, "udp_stream": 87, "frame_number": 2507, "timestamp_epoch": "1583961811.933247000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "10:98:36:59:9d:cc", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-344b0bb68a7d287ae1c1fe2d", "src_port": null, "tcp_stream": null, "udp_stream": 86, "frame_number": 2512, "timestamp_epoch": "1583961812.261008000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "10:98:36:59:9d:cc", "nbns.name": "LAPTOP-SQSA42O<00>,LAPTOP-SQSA42O<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-7661c75a2b533a2732e5dd59", "src_port": null, "tcp_stream": null, "udp_stream": 86, "frame_number": 2513, "timestamp_epoch": "1583961812.431480000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "10:98:36:59:9d:cc", "nbns.name": "MONDOGREEK<00>,MONDOGREEK<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-88959ee3b23b449b758fc38f", "src_port": null, "tcp_stream": null, "udp_stream": 86, "frame_number": 2514, "timestamp_epoch": "1583961812.434381000" }, { "kind": "identity", "dst_ip": "224.0.0.251", "fields": { "eth.dst": "01:00:5e:00:00:fb", "eth.src": "10:98:36:59:9d:cc", "dns.qry.name": "wpad.local" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-833aa2554ddcc7f52ef6f11b", "src_port": null, "tcp_stream": null, "udp_stream": 80, "frame_number": 2525, "timestamp_epoch": "1583961812.524183000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "10:98:36:59:9d:cc", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-80739ca12c855628fac0ce65", "src_port": null, "tcp_stream": null, "udp_stream": 86, "frame_number": 2559, "timestamp_epoch": "1583961813.010993000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc", "kerberos.msg_type": "10", "kerberos.CNameString": "laptop-sqsa42o$" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-90442eb14e03bc6770340d9c", "src_port": null, "tcp_stream": 123, "udp_stream": null, "frame_number": 2573, "timestamp_epoch": "1583961813.120143000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "30" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-9d59b76cc6b773d14a415951", "src_port": null, "tcp_stream": 123, "udp_stream": null, "frame_number": 2574, "timestamp_epoch": "1583961813.120827000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc", "kerberos.msg_type": "10", "kerberos.CNameString": "laptop-sqsa42o$" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-e88d209d38f0c7faa4ac20cf", "src_port": null, "tcp_stream": 124, "udp_stream": null, "frame_number": 2581, "timestamp_epoch": "1583961813.124106000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "30" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-6a1944f3a86db3e3bf3be560", "src_port": null, "tcp_stream": 124, "udp_stream": null, "frame_number": 2582, "timestamp_epoch": "1583961813.124962000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc", "kerberos.msg_type": "10", "kerberos.CNameString": "laptop-sqsa42o$" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-38329718a52847c038042ba3", "src_port": null, "tcp_stream": 125, "udp_stream": null, "frame_number": 2589, "timestamp_epoch": "1583961813.135703000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "11", "kerberos.CNameString": "LAPTOP-SQSA42O$" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-b0a421496f8b226d8907d61f", "src_port": null, "tcp_stream": 125, "udp_stream": null, "frame_number": 2592, "timestamp_epoch": "1583961813.136719000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc", "kerberos.msg_type": "10", "kerberos.CNameString": "laptop-sqsa42o$" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-ba597cb9c6265dab0069d957", "src_port": null, "tcp_stream": 126, "udp_stream": null, "frame_number": 2596, "timestamp_epoch": "1583961813.137385000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "11", "kerberos.CNameString": "LAPTOP-SQSA42O$" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-363c5157d62157b5957dcdaf", "src_port": null, "tcp_stream": 126, "udp_stream": null, "frame_number": 2600, "timestamp_epoch": "1583961813.138260000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc", "kerberos.msg_type": "12,14" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-9f2ed093afb443729dfdf8e5", "src_port": null, "tcp_stream": 127, "udp_stream": null, "frame_number": 2612, "timestamp_epoch": "1583961813.153754000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "LAPTOP-SQSA42O$" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-f10485dcc25869b34a62b79f", "src_port": null, "tcp_stream": 127, "udp_stream": null, "frame_number": 2615, "timestamp_epoch": "1583961813.154456000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc", "kerberos.msg_type": "12,14" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-49e3b65566de4ccb9321d606", "src_port": null, "tcp_stream": 128, "udp_stream": null, "frame_number": 2624, "timestamp_epoch": "1583961813.157514000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc", "kerberos.msg_type": "14" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-50268d68ce28841e1ef8fd13", "src_port": null, "tcp_stream": 122, "udp_stream": null, "frame_number": 2627, "timestamp_epoch": "1583961813.157646000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "LAPTOP-SQSA42O$" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-cc00ec85567bf86c1b709a41", "src_port": null, "tcp_stream": 128, "udp_stream": null, "frame_number": 2630, "timestamp_epoch": "1583961813.158443000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-0590e8c403ffa6a3bb4c01de", "src_port": null, "tcp_stream": 122, "udp_stream": null, "frame_number": 2631, "timestamp_epoch": "1583961813.158489000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc", "kerberos.msg_type": "14" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-6c45007002e86c0d4bc0f647", "src_port": null, "tcp_stream": 129, "udp_stream": null, "frame_number": 2640, "timestamp_epoch": "1583961813.160067000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc", "kerberos.msg_type": "14" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-af8c873f5f9120969f5f03e1", "src_port": null, "tcp_stream": 119, "udp_stream": null, "frame_number": 2643, "timestamp_epoch": "1583961813.160499000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-43d2e9e2f7ec6414082f57c5", "src_port": null, "tcp_stream": 129, "udp_stream": null, "frame_number": 2645, "timestamp_epoch": "1583961813.160820000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-d662d9cf49b2df302b1e5c95", "src_port": null, "tcp_stream": 119, "udp_stream": null, "frame_number": 2647, "timestamp_epoch": "1583961813.161220000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc", "kerberos.msg_type": "15" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-210ed4df2e8d20a0ae8135a6", "src_port": null, "tcp_stream": 129, "udp_stream": null, "frame_number": 2649, "timestamp_epoch": "1583961813.161902000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc", "kerberos.msg_type": "14" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-ef22072a75c927dd5b563eb1", "src_port": null, "tcp_stream": 129, "udp_stream": null, "frame_number": 2668, "timestamp_epoch": "1583961813.166752000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-54be72ce40c5ba4c8377e0f7", "src_port": null, "tcp_stream": 129, "udp_stream": null, "frame_number": 2670, "timestamp_epoch": "1583961813.167475000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc", "kerberos.msg_type": "15" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-11c52041eaa2b6301c5db7ed", "src_port": null, "tcp_stream": 129, "udp_stream": null, "frame_number": 2671, "timestamp_epoch": "1583961813.168202000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "10:98:36:59:9d:cc", "nbns.name": "LAPTOP-SQSA42O<00>,LAPTOP-SQSA42O<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-c4418ff56f1095df9d60d6ce", "src_port": null, "tcp_stream": null, "udp_stream": 86, "frame_number": 2679, "timestamp_epoch": "1583961813.182867000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "10:98:36:59:9d:cc", "nbns.name": "MONDOGREEK<00>,MONDOGREEK<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-b155e63077361cb495721e7d", "src_port": null, "tcp_stream": null, "udp_stream": 86, "frame_number": 2680, "timestamp_epoch": "1583961813.198494000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-7a1fe1f49c14fa8ffff866b6", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2703, "timestamp_epoch": "1583961813.400546000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-1f2511e0bcc68d352dfdbc1f", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2704, "timestamp_epoch": "1583961813.400905000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-5e49a87f0051de8082e60ffa", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2705, "timestamp_epoch": "1583961813.401358000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc", "kerberos.msg_type": "12,14" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-39ab6135fdf6de4e26daffc5", "src_port": null, "tcp_stream": 132, "udp_stream": null, "frame_number": 2710, "timestamp_epoch": "1583961813.420211000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "LAPTOP-SQSA42O$" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-54fa1115677decfb91701731", "src_port": null, "tcp_stream": 132, "udp_stream": null, "frame_number": 2713, "timestamp_epoch": "1583961813.421776000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc", "kerberos.msg_type": "12,14" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-2db82549f969c36e77d9ba52", "src_port": null, "tcp_stream": 133, "udp_stream": null, "frame_number": 2722, "timestamp_epoch": "1583961813.424285000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "LAPTOP-SQSA42O$" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-0a540e8b7adcafb0bbbf4a8d", "src_port": null, "tcp_stream": 133, "udp_stream": null, "frame_number": 2725, "timestamp_epoch": "1583961813.424596000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc", "kerberos.msg_type": "14" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-430a49baa35ab49fa8e949ce", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2732, "timestamp_epoch": "1583961813.425373000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-56160a162696fa85a34ac3ad", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2734, "timestamp_epoch": "1583961813.427216000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-79b0136eea8fbe0124efd981", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2735, "timestamp_epoch": "1583961813.427709000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-7befc96c988d3c1e7abb3d02", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2736, "timestamp_epoch": "1583961813.427906000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-fe8e8f010e3e7d5ed7198c85", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2737, "timestamp_epoch": "1583961813.428053000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-0a0bba4c232360fcf1e152cf", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2738, "timestamp_epoch": "1583961813.428199000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-03bba5891742973db21d5ee4", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2753, "timestamp_epoch": "1583961813.484309000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-c3154d5264b5e876c7d98802", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2754, "timestamp_epoch": "1583961813.484952000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-d2a8bd1fa366237a00057fb9", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2772, "timestamp_epoch": "1583961813.562879000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-d85c202e832127d8f0a375d1", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2774, "timestamp_epoch": "1583961813.563142000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "10:98:36:59:9d:cc", "nbns.name": "LAPTOP-SQSA42O<20>,LAPTOP-SQSA42O<20> (Server service)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-47e50dfa6e1488c4d3e3bac1", "src_port": null, "tcp_stream": null, "udp_stream": 86, "frame_number": 2780, "timestamp_epoch": "1583961813.592694000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc", "kerberos.msg_type": "14" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-b51707754e89174e8010c47d", "src_port": null, "tcp_stream": 129, "udp_stream": null, "frame_number": 2785, "timestamp_epoch": "1583961813.618042000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-ba10c3063a852cfa4a14c193", "src_port": null, "tcp_stream": 129, "udp_stream": null, "frame_number": 2787, "timestamp_epoch": "1583961813.618773000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc", "kerberos.msg_type": "15" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-7f74cd06a58970fcfbfe55ac", "src_port": null, "tcp_stream": 129, "udp_stream": null, "frame_number": 2788, "timestamp_epoch": "1583961813.619026000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-df5cc088eb8fed8e144fa07e", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2800, "timestamp_epoch": "1583961813.686927000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-0f45e6582551cbccd0061a34", "src_port": null, "tcp_stream": 106, "udp_stream": null, "frame_number": 2801, "timestamp_epoch": "1583961813.687058000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-f794fce6b2394ba99e4047b2", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2802, "timestamp_epoch": "1583961813.687307000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-a74a2a6e9d915dfc20344e1e", "src_port": null, "tcp_stream": 106, "udp_stream": null, "frame_number": 2803, "timestamp_epoch": "1583961813.687390000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-f77de1547377682c8f146ea7", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2804, "timestamp_epoch": "1583961813.687582000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-7ec94a17858f80dc0faea924", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2805, "timestamp_epoch": "1583961813.687744000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "10:98:36:59:9d:cc", "nbns.name": "LAPTOP-SQSA42O<00>,LAPTOP-SQSA42O<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-1156888124ba305c991d6f6a", "src_port": null, "tcp_stream": null, "udp_stream": 86, "frame_number": 2810, "timestamp_epoch": "1583961813.932929000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "10:98:36:59:9d:cc", "nbns.name": "MONDOGREEK<00>,MONDOGREEK<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-038c05fd0e83b24b1daaa87b", "src_port": null, "tcp_stream": null, "udp_stream": 86, "frame_number": 2811, "timestamp_epoch": "1583961813.964143000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc", "kerberos.msg_type": "14" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-a897e9315ffbdd2ee37bd487", "src_port": null, "tcp_stream": 137, "udp_stream": null, "frame_number": 2820, "timestamp_epoch": "1583961814.058784000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-1e5a650a05ecde4066cb4cc0", "src_port": null, "tcp_stream": 137, "udp_stream": null, "frame_number": 2822, "timestamp_epoch": "1583961814.059565000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc", "kerberos.msg_type": "12,14" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-7ecb8623b8a9b0ed71bd603d", "src_port": null, "tcp_stream": 138, "udp_stream": null, "frame_number": 2828, "timestamp_epoch": "1583961814.109011000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "LAPTOP-SQSA42O$" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-9e3236377232a2ca3a3cebad", "src_port": null, "tcp_stream": 138, "udp_stream": null, "frame_number": 2831, "timestamp_epoch": "1583961814.109917000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc", "kerberos.msg_type": "14" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-120dbe5871d8ed9193920d23", "src_port": null, "tcp_stream": 139, "udp_stream": null, "frame_number": 2842, "timestamp_epoch": "1583961814.133631000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-24ad41f00272cb5d3a6d641a", "src_port": null, "tcp_stream": 139, "udp_stream": null, "frame_number": 2844, "timestamp_epoch": "1583961814.135186000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc", "kerberos.msg_type": "12,14" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-8e33d3e6a329ff84c38b0f58", "src_port": null, "tcp_stream": 140, "udp_stream": null, "frame_number": 2858, "timestamp_epoch": "1583961814.328389000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "LAPTOP-SQSA42O$" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-417e426904dcf4b55268e8da", "src_port": null, "tcp_stream": 140, "udp_stream": null, "frame_number": 2861, "timestamp_epoch": "1583961814.330193000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc", "kerberos.msg_type": "12,14" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-04bfaeb719f623ee08090b05", "src_port": null, "tcp_stream": 141, "udp_stream": null, "frame_number": 2870, "timestamp_epoch": "1583961814.331227000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "LAPTOP-SQSA42O$" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-da607bb7afa283be5469d1af", "src_port": null, "tcp_stream": 141, "udp_stream": null, "frame_number": 2873, "timestamp_epoch": "1583961814.331599000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc", "kerberos.msg_type": "14" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-401adec6f80bacca4bcabfc7", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2880, "timestamp_epoch": "1583961814.332123000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-149c9673f0ef9b342ffadf78", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2882, "timestamp_epoch": "1583961814.334105000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-cbcb8f3ed3752f896a3c0bbf", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2883, "timestamp_epoch": "1583961814.334592000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-b07e084f4a41d59b9b1f7e61", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2884, "timestamp_epoch": "1583961814.334872000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "10:98:36:59:9d:cc", "nbns.name": "LAPTOP-SQSA42O<20>,LAPTOP-SQSA42O<20> (Server service)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-90ac40b21bd97fb5e6055bb0", "src_port": null, "tcp_stream": null, "udp_stream": 86, "frame_number": 2885, "timestamp_epoch": "1583961814.339155000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-e65ec59b2b3da261000199ae", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2886, "timestamp_epoch": "1583961814.348685000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-afbc4e6f7498a528ed18e256", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2887, "timestamp_epoch": "1583961814.349147000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-76dfd36863623418031cf4ac", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2888, "timestamp_epoch": "1583961814.368893000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-c61ad0d0c463c591ee8ec7fe", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2889, "timestamp_epoch": "1583961814.369168000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-f85b2b00cd26a769d6ae9d7f", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2890, "timestamp_epoch": "1583961814.382695000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-160ce6a7d1759a78a1bfdf81", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2891, "timestamp_epoch": "1583961814.383058000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-5be91fd2b2d37d76b2ab76f8", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2892, "timestamp_epoch": "1583961814.392786000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-c53c4e5514ae4026839a05eb", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2893, "timestamp_epoch": "1583961814.393162000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-a2b6c2ecfa731530ab17ebf7", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2894, "timestamp_epoch": "1583961814.393390000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-17f76b6c136abc1504f9689c", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2895, "timestamp_epoch": "1583961814.393552000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-598554de8a1472bf462214f4", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2896, "timestamp_epoch": "1583961814.393694000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-30308419e21b0a4a9bd9d10c", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2897, "timestamp_epoch": "1583961814.394061000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-91a244bf96476d136ecff6d1", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2898, "timestamp_epoch": "1583961814.395013000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-0756ca3c3535ced7711259ee", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2899, "timestamp_epoch": "1583961814.395263000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-b291dbc813166c9846f76dce", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2900, "timestamp_epoch": "1583961814.395420000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-43c7ca7f03f3f6d39f01b015", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2901, "timestamp_epoch": "1583961814.395545000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-5284ea89cbcbd994450a059d", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2902, "timestamp_epoch": "1583961814.395717000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-d3a9fadbaafa93ae98f97dfe", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2903, "timestamp_epoch": "1583961814.396101000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-5a56b9f6c394302a62386d32", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2904, "timestamp_epoch": "1583961814.396703000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-6025b53e200cbcba96a1051f", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2905, "timestamp_epoch": "1583961814.396960000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-aa1611e663c07751971efd87", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2906, "timestamp_epoch": "1583961814.397109000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-5f8db6f662906cdffdc999f3", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2907, "timestamp_epoch": "1583961814.397276000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-b0f0f15eeda8b3e0aa9b60c3", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2908, "timestamp_epoch": "1583961814.397442000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-d0bbdf311b54c8b78f13f868", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2909, "timestamp_epoch": "1583961814.397849000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-e458dba833b07b020a568b7f", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2910, "timestamp_epoch": "1583961814.398640000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-484b0f9abc3e41818d72ebbe", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2911, "timestamp_epoch": "1583961814.398960000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-8e9b550ac2d0babb73b71bc5", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2912, "timestamp_epoch": "1583961814.399284000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-99b54d8893b186be20c35267", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2913, "timestamp_epoch": "1583961814.399446000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-e3d49ece8f9ed58883c51b6b", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2914, "timestamp_epoch": "1583961814.399654000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-294661742086734840638f60", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2915, "timestamp_epoch": "1583961814.400022000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-57b359b8f68992b0144e5163", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2916, "timestamp_epoch": "1583961814.400901000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-93b76e73829b4223ed66b7ae", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2917, "timestamp_epoch": "1583961814.401239000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-9cfb5f2c1383e1aefd41d7e3", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2918, "timestamp_epoch": "1583961814.401510000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-c57867c0fe9848b1a9fb21ed", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2919, "timestamp_epoch": "1583961814.401664000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-6157e89285d6e24d79139180", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2920, "timestamp_epoch": "1583961814.401876000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-a39e531c4ba7525f053e35a4", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2921, "timestamp_epoch": "1583961814.402073000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-a006f9ae2622dc1ba623df95", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2922, "timestamp_epoch": "1583961814.402250000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-5a17ea2989108386af152e69", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2923, "timestamp_epoch": "1583961814.402432000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-17b3bd20db858d0c0aa09c34", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2924, "timestamp_epoch": "1583961814.402570000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-ad12eded47cb5b461c9602e6", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2925, "timestamp_epoch": "1583961814.402702000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-b748ebe01915628011b72baa", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2926, "timestamp_epoch": "1583961814.402860000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-cb459d16c9c9423b54a9314a", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2927, "timestamp_epoch": "1583961814.403007000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-33b4209720b9b3d70f20354f", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2928, "timestamp_epoch": "1583961814.403155000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-56a8cd1e644e44f896bd304c", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2929, "timestamp_epoch": "1583961814.403280000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-c3738d3079fba27d84938620", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2930, "timestamp_epoch": "1583961814.403394000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-92669831a5a9774fc4ee2c22", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2931, "timestamp_epoch": "1583961814.403570000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-7da7cc9725670d3c787830e3", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2932, "timestamp_epoch": "1583961814.403920000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-1751dc0e5294f51bbe1672c6", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2933, "timestamp_epoch": "1583961814.404063000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-9a7c56ef746873c343e11bc3", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2934, "timestamp_epoch": "1583961814.406668000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-30c06657c5ce76147fcf8672", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2935, "timestamp_epoch": "1583961814.406933000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-c3d03552e7d84a85794003ed", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2936, "timestamp_epoch": "1583961814.408308000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-706eb5d4f0e176f7b549d428", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2937, "timestamp_epoch": "1583961814.408507000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-30c071960c2df216341b0169", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2938, "timestamp_epoch": "1583961814.408880000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-da4c376b4bfbc83d67f67cbe", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2939, "timestamp_epoch": "1583961814.409072000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-43979f491f7be667b5f58695", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2940, "timestamp_epoch": "1583961814.409658000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-eb8f9cb13ff9495a5f230c56", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2941, "timestamp_epoch": "1583961814.409854000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-cf12b61858b252fbe6846423", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2942, "timestamp_epoch": "1583961814.410544000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-d1f1da8caad55f0c761fad48", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2943, "timestamp_epoch": "1583961814.410854000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-3520e4f4a236bdb3d71228fb", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2944, "timestamp_epoch": "1583961814.411088000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-45cbdcfbdba5eae9c10d0f97", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2945, "timestamp_epoch": "1583961814.411255000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-778954ac88bc945cabc096ae", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2946, "timestamp_epoch": "1583961814.411565000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-f799419db03c98776b9b4286", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2947, "timestamp_epoch": "1583961814.411734000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-02c05e9ecf742d7320ed9fcf", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2948, "timestamp_epoch": "1583961814.411961000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-0bfadf51532d09bdffd734e8", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2949, "timestamp_epoch": "1583961814.412154000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-57712bd23cecd47875e28c7b", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2950, "timestamp_epoch": "1583961814.412349000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-df20fce51f1f9799c5482a43", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2951, "timestamp_epoch": "1583961814.412499000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-9a090f4513789aa44751258c", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2952, "timestamp_epoch": "1583961814.412654000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-7947fd3a103a96cef68b9bfe", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2953, "timestamp_epoch": "1583961814.412819000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-fa683b47b03134da7682adbb", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2954, "timestamp_epoch": "1583961814.413479000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-c7d688e0aca53ff8abc27929", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2955, "timestamp_epoch": "1583961814.413684000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-84bb58d8765dd03f24e87501", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2956, "timestamp_epoch": "1583961814.414004000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-3b3f6ea7d37cd5f7b2c80b19", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2957, "timestamp_epoch": "1583961814.414158000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-5ba2e6761a356b3a0329ac8f", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2958, "timestamp_epoch": "1583961814.414472000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-34d076659348033cade106dc", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2959, "timestamp_epoch": "1583961814.414607000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-f3f672b7f27e93f46e40276e", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2960, "timestamp_epoch": "1583961814.415510000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-ef7e353d9fe0d55dd1709e94", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2961, "timestamp_epoch": "1583961814.415664000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-273c05f57d133db39156aaa7", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2962, "timestamp_epoch": "1583961814.415884000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-08d24d3cd6f5ad3018d3230e", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2964, "timestamp_epoch": "1583961814.416101000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-e5c398953559940cb957d8a5", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2966, "timestamp_epoch": "1583961814.416591000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-882ef501da3b9613d9e5afea", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2967, "timestamp_epoch": "1583961814.416812000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-3073e37bac8f9a7fe97b4eec", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2968, "timestamp_epoch": "1583961814.417455000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-b5f7fc08d1a887cb7a151320", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2969, "timestamp_epoch": "1583961814.417869000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-aac4ee4e07a48a5f39c6a1fd", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2970, "timestamp_epoch": "1583961814.418033000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-9ddd67a78db0e7a171198ebb", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2971, "timestamp_epoch": "1583961814.418225000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-2f47bb2e290e764f79d8c6b9", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2972, "timestamp_epoch": "1583961814.418468000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-d6cd15a700562eecb8fb2141", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2973, "timestamp_epoch": "1583961814.418623000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-8f405486939153a1327247b7", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2974, "timestamp_epoch": "1583961814.419025000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-b84e7811a377334333719938", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2975, "timestamp_epoch": "1583961814.419199000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-8edf5b91f737485ede0ca650", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2976, "timestamp_epoch": "1583961814.419429000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-e330ee856f4ab213017c2717", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2977, "timestamp_epoch": "1583961814.419627000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-ba55a15eb07d7f32f9262518", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2978, "timestamp_epoch": "1583961814.420198000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-a18b525970dda6e43a14daa2", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2979, "timestamp_epoch": "1583961814.420413000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-af04c5b03bc9f4b7bd618037", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2980, "timestamp_epoch": "1583961814.421079000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-7d31aa76dfbb6051f955accd", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2981, "timestamp_epoch": "1583961814.421290000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-3f76448437fc2174507fbe8f", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2982, "timestamp_epoch": "1583961814.421464000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-149e43b797f462e0f28c476a", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2983, "timestamp_epoch": "1583961814.421709000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-5d0cb36661adb8faeb69ba2d", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2984, "timestamp_epoch": "1583961814.422005000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-173485a016912b3431b30e5d", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2985, "timestamp_epoch": "1583961814.422214000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-0c68fd2d5dc4ee6ae92a3b80", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2986, "timestamp_epoch": "1583961814.422329000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-586bd4a7ca97f505458d5191", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2987, "timestamp_epoch": "1583961814.422537000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-cfda15fe17b8929df0ad5ea5", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2988, "timestamp_epoch": "1583961814.423072000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-87ed4ccc5c98822b2291c3b6", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2989, "timestamp_epoch": "1583961814.423244000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-c2c2bdad62a6997515827f79", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2990, "timestamp_epoch": "1583961814.436960000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-da0005b0c508e5b756fe1e67", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2991, "timestamp_epoch": "1583961814.437205000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-2fc31ed5e963b4724508c0b7", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2992, "timestamp_epoch": "1583961814.437816000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-9d1de4d6eae037d17190b385", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 2993, "timestamp_epoch": "1583961814.438073000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "10:98:36:59:9d:cc", "nbns.name": "LAPTOP-SQSA42O<00>,LAPTOP-SQSA42O<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-1e81af6259fc34b011ab6f6b", "src_port": null, "tcp_stream": null, "udp_stream": 86, "frame_number": 3003, "timestamp_epoch": "1583961814.729143000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "10:98:36:59:9d:cc", "nbns.name": "MONDOGREEK<00>,MONDOGREEK<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-dffe690962224c47a27ea8c5", "src_port": null, "tcp_stream": null, "udp_stream": 86, "frame_number": 3004, "timestamp_epoch": "1583961814.729297000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "10:98:36:59:9d:cc", "nbns.name": "LAPTOP-SQSA42O<20>,LAPTOP-SQSA42O<20> (Server service)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-6a7dcbc78ccf3ec3da8872aa", "src_port": null, "tcp_stream": null, "udp_stream": 86, "frame_number": 3005, "timestamp_epoch": "1583961815.089175000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc", "kerberos.msg_type": "14" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-c8020e19f48cc6fad11d67fd", "src_port": null, "tcp_stream": 144, "udp_stream": null, "frame_number": 3044, "timestamp_epoch": "1583961815.808130000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-752731c2ba0b78ee328bc846", "src_port": null, "tcp_stream": 144, "udp_stream": null, "frame_number": 3046, "timestamp_epoch": "1583961815.808804000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc", "kerberos.msg_type": "15" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-9be9dbfab78d695cdff19ab7", "src_port": null, "tcp_stream": 144, "udp_stream": null, "frame_number": 3047, "timestamp_epoch": "1583961815.809261000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "10:98:36:59:9d:cc", "nbns.name": "LAPTOP-SQSA42O<20>,LAPTOP-SQSA42O<20> (Server service)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-43016880d9bcf44b1458c102", "src_port": null, "tcp_stream": null, "udp_stream": 86, "frame_number": 3068, "timestamp_epoch": "1583961815.855229000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc", "kerberos.msg_type": "14" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-4d9d2ca808b338a5a0ed9264", "src_port": null, "tcp_stream": 145, "udp_stream": null, "frame_number": 3077, "timestamp_epoch": "1583961815.921016000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-40cf0eeb4531d843957cfa00", "src_port": null, "tcp_stream": 145, "udp_stream": null, "frame_number": 3079, "timestamp_epoch": "1583961815.921730000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc", "kerberos.msg_type": "14" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-75f18f748278816fd854fdfe", "src_port": null, "tcp_stream": 146, "udp_stream": null, "frame_number": 3090, "timestamp_epoch": "1583961815.926463000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-7f1c544fd5b01ca97d3dfc24", "src_port": null, "tcp_stream": 146, "udp_stream": null, "frame_number": 3092, "timestamp_epoch": "1583961815.927260000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "10:98:36:59:9d:cc", "browser.server": "LAPTOP-SQSA42O" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-5d40384c5607a52a389c4b3e", "src_port": null, "tcp_stream": null, "udp_stream": 109, "frame_number": 3120, "timestamp_epoch": "1583961816.676656000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc", "kerberos.msg_type": "14" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-33762a8c6ce001a568f94c3f", "src_port": null, "tcp_stream": 169, "udp_stream": null, "frame_number": 3627, "timestamp_epoch": "1583961821.348431000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-43c9b33ed83229c1d5a0b000", "src_port": null, "tcp_stream": 169, "udp_stream": null, "frame_number": 3629, "timestamp_epoch": "1583961821.349230000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc", "kerberos.msg_type": "14" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-d5d0ef2610d03f3f3d6c002a", "src_port": null, "tcp_stream": 170, "udp_stream": null, "frame_number": 3644, "timestamp_epoch": "1583961821.368228000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-5947e675ad34bbcdc2a89e90", "src_port": null, "tcp_stream": 170, "udp_stream": null, "frame_number": 3646, "timestamp_epoch": "1583961821.369171000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc", "kerberos.msg_type": "10", "kerberos.CNameString": "LAPTOP-SQSA42O$" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-c6efa959726e85ab93e9c47b", "src_port": null, "tcp_stream": 171, "udp_stream": null, "frame_number": 3652, "timestamp_epoch": "1583961821.373720000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "30" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-424bfe92916a9c3f3c7ef336", "src_port": null, "tcp_stream": 171, "udp_stream": null, "frame_number": 3653, "timestamp_epoch": "1583961821.374303000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc", "kerberos.msg_type": "10", "kerberos.CNameString": "LAPTOP-SQSA42O$" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-b3dd8073570bbb41ae40478f", "src_port": null, "tcp_stream": 172, "udp_stream": null, "frame_number": 3660, "timestamp_epoch": "1583961821.375280000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "11", "kerberos.CNameString": "LAPTOP-SQSA42O$" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-021c76399cdf9821b62601d7", "src_port": null, "tcp_stream": 172, "udp_stream": null, "frame_number": 3662, "timestamp_epoch": "1583961821.375852000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc", "kerberos.msg_type": "12,14" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-02828c04f6ee4f30e264c320", "src_port": null, "tcp_stream": 173, "udp_stream": null, "frame_number": 3671, "timestamp_epoch": "1583961821.377188000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "LAPTOP-SQSA42O$" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-ba2d66b0e7b9c5977958a4b0", "src_port": null, "tcp_stream": 173, "udp_stream": null, "frame_number": 3674, "timestamp_epoch": "1583961821.377829000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-1a0af78d8b304f9449b88d51", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 3724, "timestamp_epoch": "1583961824.167563000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-fe274c5c60bdff581838a016", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 3725, "timestamp_epoch": "1583961824.167817000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-3a08f9f1b11afe13831c55a9", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 3726, "timestamp_epoch": "1583961824.168199000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-d83ad16fad51872c20bd702e", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 3727, "timestamp_epoch": "1583961824.168357000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc", "kerberos.msg_type": "10", "kerberos.CNameString": "dorian.neff" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-18bb59e1383b6ff1d822dc0d", "src_port": null, "tcp_stream": 176, "udp_stream": null, "frame_number": 3774, "timestamp_epoch": "1583961831.211778000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "30" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-8760ae3780469395442759bf", "src_port": null, "tcp_stream": 176, "udp_stream": null, "frame_number": 3775, "timestamp_epoch": "1583961831.212292000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc", "kerberos.msg_type": "10", "kerberos.CNameString": "dorian.neff" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-8a22be72b3ffb6a65a307d4c", "src_port": null, "tcp_stream": 177, "udp_stream": null, "frame_number": 3782, "timestamp_epoch": "1583961831.218489000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "11", "kerberos.CNameString": "dorian.neff" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-e426cb3dac884107bb807208", "src_port": null, "tcp_stream": 177, "udp_stream": null, "frame_number": 3784, "timestamp_epoch": "1583961831.219139000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc", "kerberos.msg_type": "12,14" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-d39638c8c0dfe3a36cf1c68a", "src_port": null, "tcp_stream": 178, "udp_stream": null, "frame_number": 3793, "timestamp_epoch": "1583961831.220611000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "dorian.neff" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-00354df017e117f83f4cb19e", "src_port": null, "tcp_stream": 178, "udp_stream": null, "frame_number": 3796, "timestamp_epoch": "1583961831.221374000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc", "kerberos.msg_type": "12,14" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-4bc3cac5d918b78abd586e0f", "src_port": null, "tcp_stream": 179, "udp_stream": null, "frame_number": 3807, "timestamp_epoch": "1583961831.470713000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "dorian.neff" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-8154b70244f34f03a355e101", "src_port": null, "tcp_stream": 179, "udp_stream": null, "frame_number": 3810, "timestamp_epoch": "1583961831.471997000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc", "kerberos.msg_type": "14" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-c50a62d8ba16764712510738", "src_port": null, "tcp_stream": 129, "udp_stream": null, "frame_number": 3816, "timestamp_epoch": "1583961831.472833000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-17eb1dabd35e9a99e224a9a1", "src_port": null, "tcp_stream": 129, "udp_stream": null, "frame_number": 3818, "timestamp_epoch": "1583961831.473581000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc", "kerberos.msg_type": "15" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-2d3a829f0ef42d2fec6524e2", "src_port": null, "tcp_stream": 129, "udp_stream": null, "frame_number": 3819, "timestamp_epoch": "1583961831.474143000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-05774232a0b42b2190e0dba5", "src_port": null, "tcp_stream": 180, "udp_stream": null, "frame_number": 3835, "timestamp_epoch": "1583961831.489978000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-42b44470fcfe81b64eb4b623", "src_port": null, "tcp_stream": 180, "udp_stream": null, "frame_number": 3836, "timestamp_epoch": "1583961831.490153000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-6293a486877dc62050313874", "src_port": null, "tcp_stream": 180, "udp_stream": null, "frame_number": 3837, "timestamp_epoch": "1583961831.490519000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc", "kerberos.msg_type": "12,14" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-38629f49b5baeb9877b3e291", "src_port": null, "tcp_stream": 181, "udp_stream": null, "frame_number": 3842, "timestamp_epoch": "1583961831.500103000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "30" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-c155ea108a752e97c9a8d30e", "src_port": null, "tcp_stream": 181, "udp_stream": null, "frame_number": 3844, "timestamp_epoch": "1583961831.500646000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-01b4a9852c858643d41c23c1", "src_port": null, "tcp_stream": 180, "udp_stream": null, "frame_number": 3849, "timestamp_epoch": "1583961831.519474000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-7cdbb9a51d0d43fa5046671b", "src_port": null, "tcp_stream": 180, "udp_stream": null, "frame_number": 3850, "timestamp_epoch": "1583961831.519936000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc", "ntlmssp.auth.domain": "MONDOGREEK", "ntlmssp.auth.hostname": "LAPTOP-SQSA42O", "ntlmssp.auth.username": "dorian.neff" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-a886542cffb6b6ab13930ffa", "src_port": null, "tcp_stream": 180, "udp_stream": null, "frame_number": 3851, "timestamp_epoch": "1583961831.521451000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-8134c341107cf2828ca67073", "src_port": null, "tcp_stream": 180, "udp_stream": null, "frame_number": 3852, "timestamp_epoch": "1583961831.522540000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-a721647e69b8a99a563e9ca4", "src_port": null, "tcp_stream": 180, "udp_stream": null, "frame_number": 3853, "timestamp_epoch": "1583961831.523512000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-c2c2f66ce58142ca695987dd", "src_port": null, "tcp_stream": 180, "udp_stream": null, "frame_number": 3854, "timestamp_epoch": "1583961831.523777000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-0aec7dd08d22ac72efc51ce0", "src_port": null, "tcp_stream": 180, "udp_stream": null, "frame_number": 3855, "timestamp_epoch": "1583961831.524089000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-3556d9afa5db4c28e089781f", "src_port": null, "tcp_stream": 180, "udp_stream": null, "frame_number": 3856, "timestamp_epoch": "1583961831.524295000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-5a4a9634a635edb2a4ce4b02", "src_port": null, "tcp_stream": 180, "udp_stream": null, "frame_number": 3857, "timestamp_epoch": "1583961831.526173000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-0dcc7cf4ee6fb10c301e4db0", "src_port": null, "tcp_stream": 180, "udp_stream": null, "frame_number": 3858, "timestamp_epoch": "1583961831.526531000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-4d2bc2d0697ee8667fcc38ae", "src_port": null, "tcp_stream": 180, "udp_stream": null, "frame_number": 3860, "timestamp_epoch": "1583961831.533627000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-4146083a57f57d17d195c0b2", "src_port": null, "tcp_stream": 180, "udp_stream": null, "frame_number": 3861, "timestamp_epoch": "1583961831.533946000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-3f33218d5eee8b959c5af58d", "src_port": null, "tcp_stream": 180, "udp_stream": null, "frame_number": 3862, "timestamp_epoch": "1583961831.538032000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-8867527baf79ff29ef959f25", "src_port": null, "tcp_stream": 180, "udp_stream": null, "frame_number": 3863, "timestamp_epoch": "1583961831.538323000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-a5c57f6f4309e65f830b418b", "src_port": null, "tcp_stream": 180, "udp_stream": null, "frame_number": 3864, "timestamp_epoch": "1583961831.539095000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-221da26208ab3a69a7c82bcf", "src_port": null, "tcp_stream": 180, "udp_stream": null, "frame_number": 3865, "timestamp_epoch": "1583961831.539282000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-b3a32fa215a5f58ff8929ac7", "src_port": null, "tcp_stream": 180, "udp_stream": null, "frame_number": 3866, "timestamp_epoch": "1583961831.539577000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-1b02d4cd45a8d3ed02ad1c71", "src_port": null, "tcp_stream": 180, "udp_stream": null, "frame_number": 3867, "timestamp_epoch": "1583961831.540079000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-16e7df0d12e9fd65fb71122a", "src_port": null, "tcp_stream": 180, "udp_stream": null, "frame_number": 3868, "timestamp_epoch": "1583961831.540299000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-22baea509adeec75ce20d215", "src_port": null, "tcp_stream": 180, "udp_stream": null, "frame_number": 3869, "timestamp_epoch": "1583961831.540622000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-3a529af48a632db360e051c3", "src_port": null, "tcp_stream": 180, "udp_stream": null, "frame_number": 3870, "timestamp_epoch": "1583961831.543416000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-d155a2d7444fa9fce906b255", "src_port": null, "tcp_stream": 180, "udp_stream": null, "frame_number": 3871, "timestamp_epoch": "1583961831.543813000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-80e2be55df9cdb137fa93ca2", "src_port": null, "tcp_stream": 180, "udp_stream": null, "frame_number": 3872, "timestamp_epoch": "1583961831.544195000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-454d6f34a59b3f490890b26f", "src_port": null, "tcp_stream": 180, "udp_stream": null, "frame_number": 3873, "timestamp_epoch": "1583961831.544604000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-c6ca4dce382edf49b6077214", "src_port": null, "tcp_stream": 180, "udp_stream": null, "frame_number": 3874, "timestamp_epoch": "1583961831.544846000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-ce75d809a84e67e063a6be10", "src_port": null, "tcp_stream": 180, "udp_stream": null, "frame_number": 3875, "timestamp_epoch": "1583961831.545406000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-9cf49f83c3dac8501a535656", "src_port": null, "tcp_stream": 180, "udp_stream": null, "frame_number": 3876, "timestamp_epoch": "1583961831.545688000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-7702b0f0346e84e85dabef2b", "src_port": null, "tcp_stream": 180, "udp_stream": null, "frame_number": 3877, "timestamp_epoch": "1583961831.546356000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-b8748aa60b9511abeff6aca5", "src_port": null, "tcp_stream": 180, "udp_stream": null, "frame_number": 3878, "timestamp_epoch": "1583961831.546939000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-4cbe43cf39da66e7951ff113", "src_port": null, "tcp_stream": 180, "udp_stream": null, "frame_number": 3879, "timestamp_epoch": "1583961831.547559000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-c40bd50bd92ce0c30634f579", "src_port": null, "tcp_stream": 180, "udp_stream": null, "frame_number": 3880, "timestamp_epoch": "1583961831.547995000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a", "samr.samr_UserInfo21.full_name": "Dorian Neff", "samr.samr_UserInfo21.account_name": "dorian.neff" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-3c961a0f334560b2db68fbfe", "src_port": null, "tcp_stream": 180, "udp_stream": null, "frame_number": 3881, "timestamp_epoch": "1583961831.548512000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-94c910cbfcd2a4dbb70f1312", "src_port": null, "tcp_stream": 180, "udp_stream": null, "frame_number": 3882, "timestamp_epoch": "1583961831.548772000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-594df050d388ef1f4ac8c6db", "src_port": null, "tcp_stream": 180, "udp_stream": null, "frame_number": 3883, "timestamp_epoch": "1583961831.549303000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-b9f2db8ab45507814b11423b", "src_port": null, "tcp_stream": 180, "udp_stream": null, "frame_number": 3884, "timestamp_epoch": "1583961831.549532000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-6052af1a798b16b73533c9cc", "src_port": null, "tcp_stream": 180, "udp_stream": null, "frame_number": 3885, "timestamp_epoch": "1583961831.549976000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-799357d894a47c940dd49316", "src_port": null, "tcp_stream": 180, "udp_stream": null, "frame_number": 3886, "timestamp_epoch": "1583961831.550231000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-89977862e8af8e3c617d28b9", "src_port": null, "tcp_stream": 180, "udp_stream": null, "frame_number": 3887, "timestamp_epoch": "1583961831.550646000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-ed07164765d8ed1a7e896428", "src_port": null, "tcp_stream": 180, "udp_stream": null, "frame_number": 3888, "timestamp_epoch": "1583961831.550999000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-5e5b89393bb3a5e0893d3622", "src_port": null, "tcp_stream": 180, "udp_stream": null, "frame_number": 3889, "timestamp_epoch": "1583961831.551314000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-e13b1a6ca859ddc02d24c7c3", "src_port": null, "tcp_stream": 180, "udp_stream": null, "frame_number": 3890, "timestamp_epoch": "1583961831.551821000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-1a0dd93c19f41cc6601a01cd", "src_port": null, "tcp_stream": 180, "udp_stream": null, "frame_number": 3891, "timestamp_epoch": "1583961831.552217000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-6fbc2d2aef9541e4ecf1cd27", "src_port": null, "tcp_stream": 180, "udp_stream": null, "frame_number": 3892, "timestamp_epoch": "1583961831.552412000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-816a7b0e87a033b2f0821e08", "src_port": null, "tcp_stream": 180, "udp_stream": null, "frame_number": 3893, "timestamp_epoch": "1583961831.552745000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-9b3650ed3be19c5fd180afcf", "src_port": null, "tcp_stream": 180, "udp_stream": null, "frame_number": 3894, "timestamp_epoch": "1583961831.552964000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-21c2a97660c197df6fe33fb2", "src_port": null, "tcp_stream": 180, "udp_stream": null, "frame_number": 3895, "timestamp_epoch": "1583961831.553399000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-df8455c189e2738384cf1002", "src_port": null, "tcp_stream": 180, "udp_stream": null, "frame_number": 3896, "timestamp_epoch": "1583961831.553641000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-dbb9546edacd0233ab80aef7", "src_port": null, "tcp_stream": 180, "udp_stream": null, "frame_number": 3897, "timestamp_epoch": "1583961831.553842000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-0ecf27d5ce0dfff545e7b96e", "src_port": null, "tcp_stream": 182, "udp_stream": null, "frame_number": 3903, "timestamp_epoch": "1583961831.647095000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-eb5768b2cf5508b3de6af595", "src_port": null, "tcp_stream": 182, "udp_stream": null, "frame_number": 3904, "timestamp_epoch": "1583961831.647606000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-5a10d5a46726aae218a2bdbe", "src_port": null, "tcp_stream": 182, "udp_stream": null, "frame_number": 3905, "timestamp_epoch": "1583961831.647957000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc", "kerberos.msg_type": "12,14" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-c71e4726f04d05184dd4e89c", "src_port": null, "tcp_stream": 183, "udp_stream": null, "frame_number": 3910, "timestamp_epoch": "1583961831.664571000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "dorian.neff" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-e72be5ad1812ae1a338b1dbd", "src_port": null, "tcp_stream": 183, "udp_stream": null, "frame_number": 3913, "timestamp_epoch": "1583961831.665581000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc", "kerberos.msg_type": "12,14" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-778974bbdf3892e3f4f773e9", "src_port": null, "tcp_stream": 184, "udp_stream": null, "frame_number": 3921, "timestamp_epoch": "1583961831.666764000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "dorian.neff" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-30c4f6efb5e9657c397072e9", "src_port": null, "tcp_stream": 184, "udp_stream": null, "frame_number": 3923, "timestamp_epoch": "1583961831.667240000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc", "kerberos.msg_type": "14" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-647f38a3dbd0f0888fbb0ff2", "src_port": null, "tcp_stream": 182, "udp_stream": null, "frame_number": 3931, "timestamp_epoch": "1583961831.668838000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-801af19b6e51525ebe9dc7ce", "src_port": null, "tcp_stream": 182, "udp_stream": null, "frame_number": 3933, "timestamp_epoch": "1583961831.671035000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-7da92ca23b3f99a48faeba65", "src_port": null, "tcp_stream": 182, "udp_stream": null, "frame_number": 3934, "timestamp_epoch": "1583961831.671732000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-80a061a13cfdf03634d501d8", "src_port": null, "tcp_stream": 182, "udp_stream": null, "frame_number": 3935, "timestamp_epoch": "1583961831.671912000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-ba93b51bfdd91577ce3755e1", "src_port": null, "tcp_stream": 182, "udp_stream": null, "frame_number": 3936, "timestamp_epoch": "1583961831.672096000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-df07532a50193ddab1fcc0f8", "src_port": null, "tcp_stream": 182, "udp_stream": null, "frame_number": 3937, "timestamp_epoch": "1583961831.672147000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-d3c3e56b013ff01639efce2d", "src_port": null, "tcp_stream": 182, "udp_stream": null, "frame_number": 3939, "timestamp_epoch": "1583961831.672387000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-1e7b488abb5fc8afe1560496", "src_port": null, "tcp_stream": 182, "udp_stream": null, "frame_number": 3940, "timestamp_epoch": "1583961831.684824000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-fb45f3b620f0435492d5ab0d", "src_port": null, "tcp_stream": 182, "udp_stream": null, "frame_number": 3942, "timestamp_epoch": "1583961831.782168000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc", "kerberos.msg_type": "14" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-62c1d0f6c845df9a1dcdcb7a", "src_port": null, "tcp_stream": 185, "udp_stream": null, "frame_number": 3948, "timestamp_epoch": "1583961831.834781000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-b4a2184448fe542e1f821768", "src_port": null, "tcp_stream": 185, "udp_stream": null, "frame_number": 3950, "timestamp_epoch": "1583961831.835650000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc", "kerberos.msg_type": "14" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-5382035c5d5c036a094b01c4", "src_port": null, "tcp_stream": 186, "udp_stream": null, "frame_number": 3957, "timestamp_epoch": "1583961831.845532000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-245d5521b72c393082a9ed74", "src_port": null, "tcp_stream": 186, "udp_stream": null, "frame_number": 3959, "timestamp_epoch": "1583961831.846467000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-0abb4b39a4c1ea9584cf779c", "src_port": null, "tcp_stream": 182, "udp_stream": null, "frame_number": 3966, "timestamp_epoch": "1583961831.852463000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-b0dc10bfc29f9819ac12625b", "src_port": null, "tcp_stream": 182, "udp_stream": null, "frame_number": 3967, "timestamp_epoch": "1583961831.852767000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94", "kerberos.msg_type": "14" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-0312a7302a158d312be4d74c", "src_port": null, "tcp_stream": 194, "udp_stream": null, "frame_number": 4188, "timestamp_epoch": "1583961844.412981000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-a5870605cfb3fb9b9d1fca94", "src_port": null, "tcp_stream": 194, "udp_stream": null, "frame_number": 4190, "timestamp_epoch": "1583961844.413811000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94", "kerberos.msg_type": "15" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-c56f052bb6dc3e77642f43cc", "src_port": null, "tcp_stream": 194, "udp_stream": null, "frame_number": 4191, "timestamp_epoch": "1583961844.414590000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94", "kerberos.msg_type": "14" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-2b3b01a4560871d21f8c7d70", "src_port": null, "tcp_stream": 195, "udp_stream": null, "frame_number": 4215, "timestamp_epoch": "1583961844.425286000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-16670ff7363a899042da527c", "src_port": null, "tcp_stream": 195, "udp_stream": null, "frame_number": 4217, "timestamp_epoch": "1583961844.426089000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94", "kerberos.msg_type": "14" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-0876e988cbf373e723a9c37c", "src_port": null, "tcp_stream": 196, "udp_stream": null, "frame_number": 4228, "timestamp_epoch": "1583961844.433816000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-274c86ff549ea2a2d5df2151", "src_port": null, "tcp_stream": 196, "udp_stream": null, "frame_number": 4230, "timestamp_epoch": "1583961844.434551000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-d84cf74ee2cb1e2f4873da1d", "src_port": null, "tcp_stream": 180, "udp_stream": null, "frame_number": 4248, "timestamp_epoch": "1583961845.622115000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-3631c287f35d6de5768c76ee", "src_port": null, "tcp_stream": 182, "udp_stream": null, "frame_number": 4249, "timestamp_epoch": "1583961845.622248000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-292f69e57648cce655f397f2", "src_port": null, "tcp_stream": 180, "udp_stream": null, "frame_number": 4250, "timestamp_epoch": "1583961845.622422000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-4b330bf0aee44efdd7ab5f5c", "src_port": null, "tcp_stream": 182, "udp_stream": null, "frame_number": 4251, "timestamp_epoch": "1583961845.622480000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-71c3fdc5b1c21cb22fc9fa29", "src_port": null, "tcp_stream": 180, "udp_stream": null, "frame_number": 4252, "timestamp_epoch": "1583961845.622671000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-d2525b9e52a128a9e412bb5a", "src_port": null, "tcp_stream": 180, "udp_stream": null, "frame_number": 4253, "timestamp_epoch": "1583961845.622873000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "10:98:36:59:9d:cc", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-c2b485a3ad8997d9f74cd1eb", "src_port": null, "tcp_stream": null, "udp_stream": 86, "frame_number": 4317, "timestamp_epoch": "1583961853.499337000" }, { "kind": "identity", "dst_ip": "224.0.0.251", "fields": { "eth.dst": "01:00:5e:00:00:fb", "eth.src": "10:98:36:59:9d:cc", "dns.qry.name": "wpad.local" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-1d48c46315fdb05c79cbd4b3", "src_port": null, "tcp_stream": null, "udp_stream": 80, "frame_number": 4318, "timestamp_epoch": "1583961853.499778000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "10:98:36:59:9d:cc", "dns.qry.name": "wpad" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-614a8c47e7f2125d2efbf7f9", "src_port": null, "tcp_stream": null, "udp_stream": 134, "frame_number": 4319, "timestamp_epoch": "1583961853.500242000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "10:98:36:59:9d:cc", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-0f4eddccec5af53eef400be2", "src_port": null, "tcp_stream": null, "udp_stream": 86, "frame_number": 4320, "timestamp_epoch": "1583961853.500618000" }, { "kind": "identity", "dst_ip": "224.0.0.251", "fields": { "eth.dst": "01:00:5e:00:00:fb", "eth.src": "10:98:36:59:9d:cc", "dns.qry.name": "wpad.local" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-01036dec3e0a0583606209fc", "src_port": null, "tcp_stream": null, "udp_stream": 80, "frame_number": 4321, "timestamp_epoch": "1583961853.501044000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "10:98:36:59:9d:cc", "dns.qry.name": "wpad" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-daba5a0c8f18e8871f7ec2c8", "src_port": null, "tcp_stream": null, "udp_stream": 135, "frame_number": 4322, "timestamp_epoch": "1583961853.501519000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "10:98:36:59:9d:cc", "dns.qry.name": "wpad" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-4122d386d03925df120ec403", "src_port": null, "tcp_stream": null, "udp_stream": 134, "frame_number": 4332, "timestamp_epoch": "1583961853.910447000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "10:98:36:59:9d:cc", "dns.qry.name": "wpad" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-96589d27cbb1ba48ae9812b3", "src_port": null, "tcp_stream": null, "udp_stream": 135, "frame_number": 4333, "timestamp_epoch": "1583961853.911409000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "10:98:36:59:9d:cc", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-beefaa5bb6b63fdba87af2a5", "src_port": null, "tcp_stream": null, "udp_stream": 86, "frame_number": 4336, "timestamp_epoch": "1583961854.259491000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "10:98:36:59:9d:cc", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-bbdcb248ff66124f78eeffeb", "src_port": null, "tcp_stream": null, "udp_stream": 86, "frame_number": 4337, "timestamp_epoch": "1583961854.259680000" }, { "kind": "identity", "dst_ip": "224.0.0.251", "fields": { "eth.dst": "01:00:5e:00:00:fb", "eth.src": "10:98:36:59:9d:cc", "dns.qry.name": "wpad.local" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-79d9c3a8052e661c5cba2b4e", "src_port": null, "tcp_stream": null, "udp_stream": 80, "frame_number": 4340, "timestamp_epoch": "1583961854.500405000" }, { "kind": "identity", "dst_ip": "224.0.0.251", "fields": { "eth.dst": "01:00:5e:00:00:fb", "eth.src": "10:98:36:59:9d:cc", "dns.qry.name": "wpad.local" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-ea83363d2c48d0290f2b4229", "src_port": null, "tcp_stream": null, "udp_stream": 80, "frame_number": 4341, "timestamp_epoch": "1583961854.501557000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "10:98:36:59:9d:cc", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-27881345707523420e8ef5c3", "src_port": null, "tcp_stream": null, "udp_stream": 86, "frame_number": 4565, "timestamp_epoch": "1583961855.010505000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "10:98:36:59:9d:cc", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-caa553ebbfb112a7055136e0", "src_port": null, "tcp_stream": null, "udp_stream": 86, "frame_number": 4566, "timestamp_epoch": "1583961855.010694000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "10:98:36:59:9d:cc", "nbns.name": "MUEWHINERFHE<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-65d75da969767407e5d0471f", "src_port": null, "tcp_stream": null, "udp_stream": 86, "frame_number": 7321, "timestamp_epoch": "1583961858.378342000" }, { "kind": "identity", "dst_ip": "224.0.0.251", "fields": { "eth.dst": "01:00:5e:00:00:fb", "eth.src": "10:98:36:59:9d:cc", "dns.qry.name": "muewhinerfhe.local" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-a18b17a034972553a299322c", "src_port": null, "tcp_stream": null, "udp_stream": 80, "frame_number": 7323, "timestamp_epoch": "1583961858.378793000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "10:98:36:59:9d:cc", "nbns.name": "VBWXOAFLT<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-b9053853ab08e1b59dbdc734", "src_port": null, "tcp_stream": null, "udp_stream": 86, "frame_number": 7324, "timestamp_epoch": "1583961858.378890000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "10:98:36:59:9d:cc", "dns.qry.name": "muewhinerfhe" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-aa7e6b439eb60073d6b367b6", "src_port": null, "tcp_stream": null, "udp_stream": 165, "frame_number": 7325, "timestamp_epoch": "1583961858.379446000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "10:98:36:59:9d:cc", "nbns.name": "UKRTZHMKWHGJ<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-6c87ecc82d6c68cde4fcd3ef", "src_port": null, "tcp_stream": null, "udp_stream": 86, "frame_number": 7326, "timestamp_epoch": "1583961858.379577000" }, { "kind": "identity", "dst_ip": "224.0.0.251", "fields": { "eth.dst": "01:00:5e:00:00:fb", "eth.src": "10:98:36:59:9d:cc", "dns.qry.name": "vbwxoaflt.local" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-b896df0832a0d044ef0d24e4", "src_port": null, "tcp_stream": null, "udp_stream": 80, "frame_number": 7327, "timestamp_epoch": "1583961858.379767000" }, { "kind": "identity", "dst_ip": "224.0.0.251", "fields": { "eth.dst": "01:00:5e:00:00:fb", "eth.src": "10:98:36:59:9d:cc", "dns.qry.name": "ukrtzhmkwhgj.local" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-328223f6ef0985f5c4941743", "src_port": null, "tcp_stream": null, "udp_stream": 80, "frame_number": 7328, "timestamp_epoch": "1583961858.380198000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "10:98:36:59:9d:cc", "dns.qry.name": "vbwxoaflt" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-f9e8f70bcf65a4bf94202541", "src_port": null, "tcp_stream": null, "udp_stream": 166, "frame_number": 7329, "timestamp_epoch": "1583961858.380611000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "10:98:36:59:9d:cc", "dns.qry.name": "ukrtzhmkwhgj" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-900df77758ef8145f86b33cf", "src_port": null, "tcp_stream": null, "udp_stream": 167, "frame_number": 7330, "timestamp_epoch": "1583961858.380926000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "10:98:36:59:9d:cc", "dns.qry.name": "muewhinerfhe" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-3dd9395e4f5f21bafff1d5d1", "src_port": null, "tcp_stream": null, "udp_stream": 165, "frame_number": 7565, "timestamp_epoch": "1583961858.812069000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "10:98:36:59:9d:cc", "dns.qry.name": "ukrtzhmkwhgj" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-2a189ee4f984406633802a4e", "src_port": null, "tcp_stream": null, "udp_stream": 167, "frame_number": 7566, "timestamp_epoch": "1583961858.812225000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "10:98:36:59:9d:cc", "dns.qry.name": "vbwxoaflt" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-cb7f23687c3aecdfa821cbef", "src_port": null, "tcp_stream": null, "udp_stream": 166, "frame_number": 7567, "timestamp_epoch": "1583961858.812414000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "10:98:36:59:9d:cc", "nbns.name": "MUEWHINERFHE<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-97b17502472018d120a9f8c9", "src_port": null, "tcp_stream": null, "udp_stream": 86, "frame_number": 7596, "timestamp_epoch": "1583961859.128437000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "10:98:36:59:9d:cc", "nbns.name": "VBWXOAFLT<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-86b93eb8c7c08f126811f2e8", "src_port": null, "tcp_stream": null, "udp_stream": 86, "frame_number": 7597, "timestamp_epoch": "1583961859.128630000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "10:98:36:59:9d:cc", "nbns.name": "UKRTZHMKWHGJ<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-1c701f32b36b27f0c025240e", "src_port": null, "tcp_stream": null, "udp_stream": 86, "frame_number": 7598, "timestamp_epoch": "1583961859.130427000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "10:98:36:59:9d:cc", "nbns.name": "VBWXOAFLT<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-3610451d81a49ec10d40b5fb", "src_port": null, "tcp_stream": null, "udp_stream": 86, "frame_number": 7681, "timestamp_epoch": "1583961859.885233000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "10:98:36:59:9d:cc", "nbns.name": "MUEWHINERFHE<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-f99a5d17f23bb7d60edf4e8d", "src_port": null, "tcp_stream": null, "udp_stream": 86, "frame_number": 7682, "timestamp_epoch": "1583961859.885434000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "10:98:36:59:9d:cc", "nbns.name": "UKRTZHMKWHGJ<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-02c53f7feb652e05d6f08247", "src_port": null, "tcp_stream": null, "udp_stream": 86, "frame_number": 7683, "timestamp_epoch": "1583961859.885614000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "10:98:36:59:9d:cc", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-a0154b31e3a14f3271ce5496", "src_port": null, "tcp_stream": null, "udp_stream": 86, "frame_number": 7700, "timestamp_epoch": "1583961862.501441000" }, { "kind": "identity", "dst_ip": "224.0.0.251", "fields": { "eth.dst": "01:00:5e:00:00:fb", "eth.src": "10:98:36:59:9d:cc", "dns.qry.name": "wpad.local" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-4de7caa24b5ffa6d535b4e32", "src_port": null, "tcp_stream": null, "udp_stream": 80, "frame_number": 7701, "timestamp_epoch": "1583961862.501768000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "10:98:36:59:9d:cc", "dns.qry.name": "wpad" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-b431634bae92fc98bec5fe15", "src_port": null, "tcp_stream": null, "udp_stream": 170, "frame_number": 7702, "timestamp_epoch": "1583961862.502219000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "10:98:36:59:9d:cc", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-919f31dbb1806ab9d29930cc", "src_port": null, "tcp_stream": null, "udp_stream": 86, "frame_number": 7705, "timestamp_epoch": "1583961862.503849000" }, { "kind": "identity", "dst_ip": "224.0.0.251", "fields": { "eth.dst": "01:00:5e:00:00:fb", "eth.src": "10:98:36:59:9d:cc", "dns.qry.name": "wpad.local" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-41f92776459cde01d6108d08", "src_port": null, "tcp_stream": null, "udp_stream": 80, "frame_number": 7706, "timestamp_epoch": "1583961862.504379000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "10:98:36:59:9d:cc", "dns.qry.name": "wpad" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-101ace5ff7f637e27972b526", "src_port": null, "tcp_stream": null, "udp_stream": 172, "frame_number": 7707, "timestamp_epoch": "1583961862.505027000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "10:98:36:59:9d:cc", "dns.qry.name": "wpad" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-97947cdf02caab1d2c2478f9", "src_port": null, "tcp_stream": null, "udp_stream": 170, "frame_number": 7708, "timestamp_epoch": "1583961862.912162000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "10:98:36:59:9d:cc", "dns.qry.name": "wpad" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-8b3b4647d4506098e78eaa98", "src_port": null, "tcp_stream": null, "udp_stream": 172, "frame_number": 7709, "timestamp_epoch": "1583961862.915231000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "10:98:36:59:9d:cc", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-6ee2de51ae9ecf14c35e06de", "src_port": null, "tcp_stream": null, "udp_stream": 86, "frame_number": 7710, "timestamp_epoch": "1583961863.252337000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "10:98:36:59:9d:cc", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-420bc239ba31dd508fef2648", "src_port": null, "tcp_stream": null, "udp_stream": 86, "frame_number": 7711, "timestamp_epoch": "1583961863.254153000" }, { "kind": "identity", "dst_ip": "224.0.0.251", "fields": { "eth.dst": "01:00:5e:00:00:fb", "eth.src": "10:98:36:59:9d:cc", "dns.qry.name": "wpad.local" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-732c10b0c08de3ad7fecf92d", "src_port": null, "tcp_stream": null, "udp_stream": 80, "frame_number": 7712, "timestamp_epoch": "1583961863.507421000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "10:98:36:59:9d:cc", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-c4980855f3529601cdf17917", "src_port": null, "tcp_stream": null, "udp_stream": 86, "frame_number": 7713, "timestamp_epoch": "1583961864.013298000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "10:98:36:59:9d:cc", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-d9fea51549c9dd0366566314", "src_port": null, "tcp_stream": null, "udp_stream": 86, "frame_number": 7714, "timestamp_epoch": "1583961864.013516000" }, { "kind": "identity", "dst_ip": "224.0.0.251", "fields": { "eth.dst": "01:00:5e:00:00:fb", "eth.src": "10:98:36:59:9d:cc", "dns.qry.name": "_googlecast._tcp.local" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-07c25ec6e7b9ebf036e16477", "src_port": null, "tcp_stream": null, "udp_stream": 80, "frame_number": 7715, "timestamp_epoch": "1583961864.643584000" }, { "kind": "identity", "dst_ip": "224.0.0.251", "fields": { "eth.dst": "01:00:5e:00:00:fb", "eth.src": "10:98:36:59:9d:cc", "dns.qry.name": "_googlecast._tcp.local" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-3f44cca26fd1762f35a3715d", "src_port": null, "tcp_stream": null, "udp_stream": 80, "frame_number": 8027, "timestamp_epoch": "1583961865.644234000" }, { "kind": "identity", "dst_ip": "224.0.0.251", "fields": { "eth.dst": "01:00:5e:00:00:fb", "eth.src": "10:98:36:59:9d:cc", "dns.qry.name": "_googlecast._tcp.local" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-0163687fa2789119f6ef0748", "src_port": null, "tcp_stream": null, "udp_stream": 80, "frame_number": 8028, "timestamp_epoch": "1583961867.644732000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f", "kerberos.msg_type": "14" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-ea9784791439848757ba40d5", "src_port": null, "tcp_stream": 252, "udp_stream": null, "frame_number": 8077, "timestamp_epoch": "1583961870.367943000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-f14f9c5377b809e9730a3ac0", "src_port": null, "tcp_stream": 252, "udp_stream": null, "frame_number": 8079, "timestamp_epoch": "1583961870.369077000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f", "kerberos.msg_type": "15" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-96efd43ecf881337d3c59e3e", "src_port": null, "tcp_stream": 252, "udp_stream": null, "frame_number": 8080, "timestamp_epoch": "1583961870.369760000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f", "kerberos.msg_type": "14" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-98b229e55e6c44d3344789c3", "src_port": null, "tcp_stream": 253, "udp_stream": null, "frame_number": 8104, "timestamp_epoch": "1583961870.385349000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-df46cdd6594917eaa11c764d", "src_port": null, "tcp_stream": 253, "udp_stream": null, "frame_number": 8106, "timestamp_epoch": "1583961870.386372000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f", "kerberos.msg_type": "14" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-d48e86d593961f72f6e9df4c", "src_port": null, "tcp_stream": 254, "udp_stream": null, "frame_number": 8117, "timestamp_epoch": "1583961870.395969000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-beaf2f33d9b477a8b72b0233", "src_port": null, "tcp_stream": 254, "udp_stream": null, "frame_number": 8119, "timestamp_epoch": "1583961870.397293000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f", "kerberos.msg_type": "14" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-7075b43c58eb4509c8675b35", "src_port": null, "tcp_stream": 256, "udp_stream": null, "frame_number": 8290, "timestamp_epoch": "1583961872.527613000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-e319456e25448f382fd28395", "src_port": null, "tcp_stream": 256, "udp_stream": null, "frame_number": 8295, "timestamp_epoch": "1583961872.528719000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc", "kerberos.msg_type": "14" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-d4aeda02f585ac3050de60e5", "src_port": null, "tcp_stream": 264, "udp_stream": null, "frame_number": 9753, "timestamp_epoch": "1583961892.415993000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-57e53eda05dfd30647948c4b", "src_port": null, "tcp_stream": 264, "udp_stream": null, "frame_number": 9755, "timestamp_epoch": "1583961892.417165000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc", "kerberos.msg_type": "15" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-1dade31e04dc625e81b6aa27", "src_port": null, "tcp_stream": 264, "udp_stream": null, "frame_number": 9756, "timestamp_epoch": "1583961892.417881000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc", "kerberos.msg_type": "14" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-7bc7e1f022f8a768a8bac891", "src_port": null, "tcp_stream": 265, "udp_stream": null, "frame_number": 9780, "timestamp_epoch": "1583961892.434751000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-91cf947097132607d2909710", "src_port": null, "tcp_stream": 265, "udp_stream": null, "frame_number": 9782, "timestamp_epoch": "1583961892.435791000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc", "kerberos.msg_type": "14" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-f535b8ab0fb4708af976eb65", "src_port": null, "tcp_stream": 266, "udp_stream": null, "frame_number": 9793, "timestamp_epoch": "1583961892.443657000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-5e4bdd5230b0a299e6645547", "src_port": null, "tcp_stream": 266, "udp_stream": null, "frame_number": 9795, "timestamp_epoch": "1583961892.444997000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "10:98:36:59:9d:cc", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-31760080ec8898388a4dc394", "src_port": null, "tcp_stream": null, "udp_stream": 86, "frame_number": 9825, "timestamp_epoch": "1583961895.300913000" }, { "kind": "identity", "dst_ip": "224.0.0.251", "fields": { "eth.dst": "01:00:5e:00:00:fb", "eth.src": "10:98:36:59:9d:cc", "dns.qry.name": "wpad.local" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-5c570a144532bad2a3aa074b", "src_port": null, "tcp_stream": null, "udp_stream": 80, "frame_number": 9826, "timestamp_epoch": "1583961895.301317000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "10:98:36:59:9d:cc", "dns.qry.name": "wpad" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-61d90e573205ca9261d1ea2f", "src_port": null, "tcp_stream": null, "udp_stream": 185, "frame_number": 9827, "timestamp_epoch": "1583961895.301879000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "10:98:36:59:9d:cc", "dns.qry.name": "wpad" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-b65ffd4df143005e30a9b3c1", "src_port": null, "tcp_stream": null, "udp_stream": 185, "frame_number": 9828, "timestamp_epoch": "1583961895.711917000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "10:98:36:59:9d:cc", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-7181fcd61b38725ffdf8f1bc", "src_port": null, "tcp_stream": null, "udp_stream": 86, "frame_number": 10048, "timestamp_epoch": "1583961896.053765000" }, { "kind": "identity", "dst_ip": "224.0.0.251", "fields": { "eth.dst": "01:00:5e:00:00:fb", "eth.src": "10:98:36:59:9d:cc", "dns.qry.name": "wpad.local" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-eb2d0610faae50d0334df72f", "src_port": null, "tcp_stream": null, "udp_stream": 80, "frame_number": 10149, "timestamp_epoch": "1583961896.301573000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "10:98:36:59:9d:cc", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-86ddc07b45a3df2840d2c531", "src_port": null, "tcp_stream": null, "udp_stream": 86, "frame_number": 10162, "timestamp_epoch": "1583961896.812589000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "10:98:36:59:9d:cc", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-afffa756ee65ddf3a93d53f5", "src_port": null, "tcp_stream": null, "udp_stream": 86, "frame_number": 10209, "timestamp_epoch": "1583961911.714414000" }, { "kind": "identity", "dst_ip": "224.0.0.251", "fields": { "eth.dst": "01:00:5e:00:00:fb", "eth.src": "10:98:36:59:9d:cc", "dns.qry.name": "wpad.local" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-0f99afb33018156b049b742a", "src_port": null, "tcp_stream": null, "udp_stream": 80, "frame_number": 10210, "timestamp_epoch": "1583961911.714811000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "10:98:36:59:9d:cc", "dns.qry.name": "wpad" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-bf9a8a725d7276c91110a6ae", "src_port": null, "tcp_stream": null, "udp_stream": 188, "frame_number": 10211, "timestamp_epoch": "1583961911.715242000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "10:98:36:59:9d:cc", "dns.qry.name": "wpad" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-7830f05a2df53a248e5e4557", "src_port": null, "tcp_stream": null, "udp_stream": 188, "frame_number": 10235, "timestamp_epoch": "1583961912.125051000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "10:98:36:59:9d:cc", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-c4453863780a81664b2ec95e", "src_port": null, "tcp_stream": null, "udp_stream": 86, "frame_number": 10242, "timestamp_epoch": "1583961912.475297000" }, { "kind": "identity", "dst_ip": "224.0.0.251", "fields": { "eth.dst": "01:00:5e:00:00:fb", "eth.src": "10:98:36:59:9d:cc", "dns.qry.name": "wpad.local" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-9b2b27b22ab4e8b822ddc237", "src_port": null, "tcp_stream": null, "udp_stream": 80, "frame_number": 10243, "timestamp_epoch": "1583961912.715103000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "10:98:36:59:9d:cc", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-9f464ec6eb5d17de6ca7bd2b", "src_port": null, "tcp_stream": null, "udp_stream": 86, "frame_number": 10244, "timestamp_epoch": "1583961913.225613000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-c93c7e8ec3000d228611954c", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 10297, "timestamp_epoch": "1583961928.293752000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-adce6e99eb0feb2fadbfead2", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 10298, "timestamp_epoch": "1583961928.294185000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-6da2c0c94dcbc13f5a47ef16", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 10299, "timestamp_epoch": "1583961928.294460000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-2156edf213e5a5a1d22aefeb", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 10300, "timestamp_epoch": "1583961928.294698000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-b882a3277d34db9f3da2e33d", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 10301, "timestamp_epoch": "1583961928.294916000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-85e0935f9781de8204a732a5", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 10302, "timestamp_epoch": "1583961928.295110000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-6b33da96a6cd9063677f0c16", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 10303, "timestamp_epoch": "1583961928.295343000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-6d78d7503c8f92d1f61f3b04", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 10304, "timestamp_epoch": "1583961928.295692000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-387dfa250942896b6cb2fe91", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 10385, "timestamp_epoch": "1583961939.076578000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-a6b4accc1007c769d339760c", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 10386, "timestamp_epoch": "1583961939.076953000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-9ed594f8f6055c84a2076b0a", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 10387, "timestamp_epoch": "1583961939.077250000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-ea4f49b6456c49dde12dad8b", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 10388, "timestamp_epoch": "1583961939.077452000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-019f5d5e863e07656cbd7ba3", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 10447, "timestamp_epoch": "1583961953.673598000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-963791e2eefea65e59701585", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 10448, "timestamp_epoch": "1583961953.673895000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-270dc5d1aaa1cb326caa06f4", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 10449, "timestamp_epoch": "1583961953.674244000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-20e2199a170ba0de37de9ab0", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 10450, "timestamp_epoch": "1583961953.674440000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-afc2167f3a8471780644915c", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 10451, "timestamp_epoch": "1583961953.674705000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-c1cada56be13d385d1a72df9", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 10452, "timestamp_epoch": "1583961953.675003000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-da134ed6e89ba98ac0c2f54b", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 10453, "timestamp_epoch": "1583961953.675243000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-56e481c99574d570e82093e3", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 10454, "timestamp_epoch": "1583961953.675498000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-5c5332855ba60a2ab9887ea3", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 11184, "timestamp_epoch": "1583961964.408942000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-5f9cab8108b973f39726bf72", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 11185, "timestamp_epoch": "1583961964.409151000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-dde91e83b31a5835fe773aca", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 11186, "timestamp_epoch": "1583961964.409416000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-04fc572dfd817f742e939267", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 11187, "timestamp_epoch": "1583961964.409562000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-80b9e65841f4b9a2879b171a", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 12246, "timestamp_epoch": "1583961984.910462000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-d7df4372426246296ac33f00", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 12247, "timestamp_epoch": "1583961984.910778000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-4d999c41cc6bca7ad2cdd2c5", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 12248, "timestamp_epoch": "1583961984.911223000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-66a6945638ba28cbdcd6a0d6", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 12249, "timestamp_epoch": "1583961984.911454000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-af13923af12d8c5810fd090e", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 12250, "timestamp_epoch": "1583961984.911699000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-fc4dc5626b7f6ccc5cf8e9bd", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 12251, "timestamp_epoch": "1583961984.911943000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-5c87e842445faa95c4931508", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 12270, "timestamp_epoch": "1583961990.271490000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-ef8b3312c87bf47be8ca04ec", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 12272, "timestamp_epoch": "1583961990.271785000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:1d:60:b5:5e:94", "browser.server": "LAPTOP-I9ZPI04" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-895fcac554625b5f39a13b53", "src_port": null, "tcp_stream": null, "udp_stream": 23, "frame_number": 12443, "timestamp_epoch": "1583961996.538327000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-08c67afbe1f65adc8f8521c9", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 12444, "timestamp_epoch": "1583962001.016392000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-13893d35b5a5259e955059aa", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 12445, "timestamp_epoch": "1583962001.016671000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-66b2959acbd3cc9c8b8f4c60", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 12446, "timestamp_epoch": "1583962001.016987000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-942d70e40f6f53ca62bfbfe5", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 12447, "timestamp_epoch": "1583962001.017365000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "b8:ca:3a:ec:3b:8f", "browser.server": "LAPTOP-7XMV2SN" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-642a592a562f43ceb67c15f0", "src_port": null, "tcp_stream": null, "udp_stream": 58, "frame_number": 13207, "timestamp_epoch": "1583962022.652482000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "10:98:36:59:9d:cc", "browser.server": "LAPTOP-SQSA42O" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-85b6ad41fb37d16979b3d8cd", "src_port": null, "tcp_stream": null, "udp_stream": 109, "frame_number": 14079, "timestamp_epoch": "1583962054.155292000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94", "kerberos.msg_type": "14" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-6a539fc89c60bd9f7b525a37", "src_port": null, "tcp_stream": 362, "udp_stream": null, "frame_number": 14151, "timestamp_epoch": "1583962055.686965000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-ffb619c78a2462ff78fef373", "src_port": null, "tcp_stream": 362, "udp_stream": null, "frame_number": 14153, "timestamp_epoch": "1583962055.687673000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94", "kerberos.msg_type": "15" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-f6254c33ac8c27d2bb558f12", "src_port": null, "tcp_stream": 362, "udp_stream": null, "frame_number": 14154, "timestamp_epoch": "1583962055.688087000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94", "kerberos.msg_type": "14" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-876720d9d67e1e0673889920", "src_port": null, "tcp_stream": 363, "udp_stream": null, "frame_number": 14178, "timestamp_epoch": "1583962055.699463000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-21f556bfc9c60f6d31ac8c57", "src_port": null, "tcp_stream": 363, "udp_stream": null, "frame_number": 14180, "timestamp_epoch": "1583962055.700477000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94", "kerberos.msg_type": "14" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-eedca5ac87af1ddde8217261", "src_port": null, "tcp_stream": 364, "udp_stream": null, "frame_number": 14191, "timestamp_epoch": "1583962055.706933000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-b107fcc313088ea33b122f17", "src_port": null, "tcp_stream": 364, "udp_stream": null, "frame_number": 14193, "timestamp_epoch": "1583962055.707826000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc", "kerberos.msg_type": "14" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-a82ae958aa640229bdea326a", "src_port": null, "tcp_stream": 368, "udp_stream": null, "frame_number": 14357, "timestamp_epoch": "1583962113.811358000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-5dc7f9be879f31e3c52d5f88", "src_port": null, "tcp_stream": 368, "udp_stream": null, "frame_number": 14359, "timestamp_epoch": "1583962113.812111000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc", "kerberos.msg_type": "15" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-b2d1651e2ee885c6504705ce", "src_port": null, "tcp_stream": 368, "udp_stream": null, "frame_number": 14360, "timestamp_epoch": "1583962113.812537000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc", "kerberos.msg_type": "14" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-3ff037597c1153b36bf24bfa", "src_port": null, "tcp_stream": 369, "udp_stream": null, "frame_number": 14384, "timestamp_epoch": "1583962113.822029000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-4735cedbd8834e648bcd8e55", "src_port": null, "tcp_stream": 369, "udp_stream": null, "frame_number": 14386, "timestamp_epoch": "1583962113.822829000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc", "kerberos.msg_type": "14" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-c88805dafe3741ca17fb4a70", "src_port": null, "tcp_stream": 370, "udp_stream": null, "frame_number": 14397, "timestamp_epoch": "1583962113.827952000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-064519f50ea49c33c1d0ebe1", "src_port": null, "tcp_stream": 370, "udp_stream": null, "frame_number": 14399, "timestamp_epoch": "1583962113.828884000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-84f92624b0d230bf8bbfadc1", "src_port": null, "tcp_stream": 106, "udp_stream": null, "frame_number": 14537, "timestamp_epoch": "1583962160.755099000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-9f239cfc847df05909215195", "src_port": null, "tcp_stream": 106, "udp_stream": null, "frame_number": 14538, "timestamp_epoch": "1583962160.755675000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-e4889ba2b1098c09fb1b2d83", "src_port": null, "tcp_stream": 106, "udp_stream": null, "frame_number": 14539, "timestamp_epoch": "1583962160.758548000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-141993e2494870cd03e14117", "src_port": null, "tcp_stream": 106, "udp_stream": null, "frame_number": 14540, "timestamp_epoch": "1583962160.759008000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-748047966bfa0b4926c7fa3e", "src_port": null, "tcp_stream": 106, "udp_stream": null, "frame_number": 14542, "timestamp_epoch": "1583962161.258869000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-0c6918fc564c7903818efc7c", "src_port": null, "tcp_stream": 106, "udp_stream": null, "frame_number": 14543, "timestamp_epoch": "1583962161.259175000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-146f3125a6a6b197fa7b92e0", "src_port": null, "tcp_stream": 106, "udp_stream": null, "frame_number": 14544, "timestamp_epoch": "1583962161.259627000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-f7712db7a391b68c1d84c610", "src_port": null, "tcp_stream": 106, "udp_stream": null, "frame_number": 14545, "timestamp_epoch": "1583962161.259915000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "10:98:36:59:9d:cc", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-15c956065f8d473d2699e6f8", "src_port": null, "tcp_stream": null, "udp_stream": 86, "frame_number": 14639, "timestamp_epoch": "1583962217.841128000" }, { "kind": "identity", "dst_ip": "224.0.0.251", "fields": { "eth.dst": "01:00:5e:00:00:fb", "eth.src": "10:98:36:59:9d:cc", "dns.qry.name": "wpad.local" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-66692284c4c30521f5933b4c", "src_port": null, "tcp_stream": null, "udp_stream": 80, "frame_number": 14640, "timestamp_epoch": "1583962217.841700000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "10:98:36:59:9d:cc", "dns.qry.name": "wpad" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-2b841ab623bc0b5610fe223f", "src_port": null, "tcp_stream": null, "udp_stream": 222, "frame_number": 14641, "timestamp_epoch": "1583962217.842150000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "10:98:36:59:9d:cc", "dns.qry.name": "wpad" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-76cbe3017de6a559a25715f2", "src_port": null, "tcp_stream": null, "udp_stream": 222, "frame_number": 14646, "timestamp_epoch": "1583962218.251867000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "10:98:36:59:9d:cc", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-7536f55b5283aa1870ed2623", "src_port": null, "tcp_stream": null, "udp_stream": 86, "frame_number": 14649, "timestamp_epoch": "1583962218.613691000" }, { "kind": "identity", "dst_ip": "224.0.0.251", "fields": { "eth.dst": "01:00:5e:00:00:fb", "eth.src": "10:98:36:59:9d:cc", "dns.qry.name": "wpad.local" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-d83b3bf70cfaeed675e7f7a3", "src_port": null, "tcp_stream": null, "udp_stream": 80, "frame_number": 14650, "timestamp_epoch": "1583962218.840948000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "10:98:36:59:9d:cc", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-103a7835b8df6c301579f6ec", "src_port": null, "tcp_stream": null, "udp_stream": 86, "frame_number": 14653, "timestamp_epoch": "1583962219.382662000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-be68bea157ee848a586816cf", "src_port": null, "tcp_stream": 83, "udp_stream": null, "frame_number": 15185, "timestamp_epoch": "1583962355.052295000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-99a10177336b85f5d2625de6", "src_port": null, "tcp_stream": 83, "udp_stream": null, "frame_number": 15186, "timestamp_epoch": "1583962355.052531000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-7331a7578d0245c7d174372d", "src_port": null, "tcp_stream": 106, "udp_stream": null, "frame_number": 15436, "timestamp_epoch": "1583962380.901934000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-45fafc18ea772f81c27b3a23", "src_port": null, "tcp_stream": 106, "udp_stream": null, "frame_number": 15437, "timestamp_epoch": "1583962380.902261000" }, { "kind": "identity", "dst_ip": "224.0.0.251", "fields": { "eth.dst": "01:00:5e:00:00:fb", "eth.src": "00:1d:60:b5:5e:94", "dns.qry.name": "LAPTOP-I9ZPI04.local" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-0dd8b1b187f82389b5428133", "src_port": null, "tcp_stream": null, "udp_stream": 246, "frame_number": 15649, "timestamp_epoch": "1583962386.721736000" }, { "kind": "identity", "dst_ip": "224.0.0.251", "fields": { "eth.dst": "01:00:5e:00:00:fb", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-5967a3e7d94f6d8542d2e9fa", "src_port": null, "tcp_stream": null, "udp_stream": 246, "frame_number": 15650, "timestamp_epoch": "1583962386.721952000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "00:1d:60:b5:5e:94", "dns.qry.name": "LAPTOP-I9ZPI04" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-cd0c7c53635f20f1a46adf01", "src_port": null, "tcp_stream": null, "udp_stream": 247, "frame_number": 15651, "timestamp_epoch": "1583962386.722172000" }, { "kind": "identity", "dst_ip": "224.0.0.251", "fields": { "eth.dst": "01:00:5e:00:00:fb", "eth.src": "00:1d:60:b5:5e:94", "dns.qry.name": "LAPTOP-I9ZPI04.local" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-ff55fbf6cb6ec238f8c50b39", "src_port": null, "tcp_stream": null, "udp_stream": 246, "frame_number": 15655, "timestamp_epoch": "1583962386.735784000" }, { "kind": "identity", "dst_ip": "224.0.0.251", "fields": { "eth.dst": "01:00:5e:00:00:fb", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-8c1f25f9e937455041499878", "src_port": null, "tcp_stream": null, "udp_stream": 246, "frame_number": 15656, "timestamp_epoch": "1583962386.735984000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "00:1d:60:b5:5e:94", "dns.qry.name": "LAPTOP-I9ZPI04" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-6c6d31afbb7ad5fea31040e8", "src_port": null, "tcp_stream": null, "udp_stream": 248, "frame_number": 15657, "timestamp_epoch": "1583962386.736182000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94", "kerberos.msg_type": "14" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-a70fc19a85f979f53686b5e1", "src_port": null, "tcp_stream": 404, "udp_stream": null, "frame_number": 15673, "timestamp_epoch": "1583962386.801974000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-97624d6edb3df8575e6dd713", "src_port": null, "tcp_stream": 404, "udp_stream": null, "frame_number": 15675, "timestamp_epoch": "1583962386.803046000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-483d6e9b9ee43af6632be56e", "src_port": null, "tcp_stream": 83, "udp_stream": null, "frame_number": 15821, "timestamp_epoch": "1583962388.793157000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-295e51fea8dad3f3a0d19e34", "src_port": null, "tcp_stream": 83, "udp_stream": null, "frame_number": 15822, "timestamp_epoch": "1583962388.793640000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-988e1b3f71573f03e7ca54e5", "src_port": null, "tcp_stream": 83, "udp_stream": null, "frame_number": 15823, "timestamp_epoch": "1583962388.797610000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-e4afc69a611724fbe91b955c", "src_port": null, "tcp_stream": 83, "udp_stream": null, "frame_number": 15824, "timestamp_epoch": "1583962388.797973000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-2383a5000f84674297b28561", "src_port": null, "tcp_stream": 83, "udp_stream": null, "frame_number": 15842, "timestamp_epoch": "1583962389.302940000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-c80181c787c9a828f3d54b84", "src_port": null, "tcp_stream": 83, "udp_stream": null, "frame_number": 15843, "timestamp_epoch": "1583962389.303273000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-d62039c2f2dcac6b58e4b5af", "src_port": null, "tcp_stream": 83, "udp_stream": null, "frame_number": 15844, "timestamp_epoch": "1583962389.303619000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-15c006232dc0819eb1bce368", "src_port": null, "tcp_stream": 83, "udp_stream": null, "frame_number": 15845, "timestamp_epoch": "1583962389.303892000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-4e706c265bc5043e87dfa07f", "src_port": null, "tcp_stream": 182, "udp_stream": null, "frame_number": 15919, "timestamp_epoch": "1583962412.218790000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-1b0970ca8766963118ab5e55", "src_port": null, "tcp_stream": 182, "udp_stream": null, "frame_number": 15920, "timestamp_epoch": "1583962412.219066000" }, { "kind": "identity", "dst_ip": "224.0.0.251", "fields": { "eth.dst": "01:00:5e:00:00:fb", "eth.src": "10:98:36:59:9d:cc", "dns.qry.name": "LAPTOP-SQSA42O.local" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-626832a46871d8390587deb7", "src_port": null, "tcp_stream": null, "udp_stream": 80, "frame_number": 16087, "timestamp_epoch": "1583962433.372891000" }, { "kind": "identity", "dst_ip": "224.0.0.251", "fields": { "eth.dst": "01:00:5e:00:00:fb", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-9f7860353ff8675e2d0dec4b", "src_port": null, "tcp_stream": null, "udp_stream": 80, "frame_number": 16088, "timestamp_epoch": "1583962433.373430000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "10:98:36:59:9d:cc", "dns.qry.name": "LAPTOP-SQSA42O" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-b7afaec4482a1116739d9489", "src_port": null, "tcp_stream": null, "udp_stream": 259, "frame_number": 16089, "timestamp_epoch": "1583962433.373692000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc", "kerberos.msg_type": "14" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-32a69708aadd92ef12608da6", "src_port": null, "tcp_stream": 411, "udp_stream": null, "frame_number": 16098, "timestamp_epoch": "1583962433.467839000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-1c781bc5f03618ef3bc1e3bb", "src_port": null, "tcp_stream": 411, "udp_stream": null, "frame_number": 16100, "timestamp_epoch": "1583962433.468702000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-d7cc4228d63f7afec3f78e5f", "src_port": null, "tcp_stream": 182, "udp_stream": null, "frame_number": 16190, "timestamp_epoch": "1583962436.606454000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-4e8f4c84f4ccfc5351fd1ca0", "src_port": null, "tcp_stream": 182, "udp_stream": null, "frame_number": 16191, "timestamp_epoch": "1583962436.606786000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-d32efb8a1847d9050185b2e1", "src_port": null, "tcp_stream": 182, "udp_stream": null, "frame_number": 16192, "timestamp_epoch": "1583962436.608895000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-3e637a66297550b9f78d4165", "src_port": null, "tcp_stream": 182, "udp_stream": null, "frame_number": 16193, "timestamp_epoch": "1583962436.609115000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-b2b326b6b60e2db376ca285d", "src_port": null, "tcp_stream": 182, "udp_stream": null, "frame_number": 16195, "timestamp_epoch": "1583962437.118701000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-1072f6136c82cc3d11fe6961", "src_port": null, "tcp_stream": 182, "udp_stream": null, "frame_number": 16196, "timestamp_epoch": "1583962437.119017000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-50e13fae679aa9ad03e355d1", "src_port": null, "tcp_stream": 182, "udp_stream": null, "frame_number": 16197, "timestamp_epoch": "1583962437.119375000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-0952b283367fa1d45ecd27b7", "src_port": null, "tcp_stream": 182, "udp_stream": null, "frame_number": 16198, "timestamp_epoch": "1583962437.119577000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "10:98:36:59:9d:cc", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-ee0c3a126861f76e85f64d8b", "src_port": null, "tcp_stream": null, "udp_stream": 86, "frame_number": 16202, "timestamp_epoch": "1583962438.368103000" }, { "kind": "identity", "dst_ip": "224.0.0.251", "fields": { "eth.dst": "01:00:5e:00:00:fb", "eth.src": "10:98:36:59:9d:cc", "dns.qry.name": "wpad.local" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-93a2845f067157887c6a1433", "src_port": null, "tcp_stream": null, "udp_stream": 80, "frame_number": 16203, "timestamp_epoch": "1583962438.368436000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "10:98:36:59:9d:cc", "dns.qry.name": "wpad" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-e5b44356b8be4715d0daf229", "src_port": null, "tcp_stream": null, "udp_stream": 265, "frame_number": 16204, "timestamp_epoch": "1583962438.368942000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "10:98:36:59:9d:cc", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-e0a786215fefce280cec8f46", "src_port": null, "tcp_stream": null, "udp_stream": 86, "frame_number": 16207, "timestamp_epoch": "1583962438.371887000" }, { "kind": "identity", "dst_ip": "224.0.0.251", "fields": { "eth.dst": "01:00:5e:00:00:fb", "eth.src": "10:98:36:59:9d:cc", "dns.qry.name": "wpad.local" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-51c7bba217c178d10c68e56e", "src_port": null, "tcp_stream": null, "udp_stream": 80, "frame_number": 16208, "timestamp_epoch": "1583962438.372157000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "10:98:36:59:9d:cc", "dns.qry.name": "wpad" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-d8f73aaf39d3717a866815a5", "src_port": null, "tcp_stream": null, "udp_stream": 267, "frame_number": 16209, "timestamp_epoch": "1583962438.372548000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "10:98:36:59:9d:cc", "dns.qry.name": "wpad" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-d6b2d771a53550544b373cd6", "src_port": null, "tcp_stream": null, "udp_stream": 265, "frame_number": 16210, "timestamp_epoch": "1583962438.779431000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "10:98:36:59:9d:cc", "dns.qry.name": "wpad" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-2c53534c9644af9b9e5913b1", "src_port": null, "tcp_stream": null, "udp_stream": 267, "frame_number": 16211, "timestamp_epoch": "1583962438.783452000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "10:98:36:59:9d:cc", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-86e0ee1cd5b35fe4def2e430", "src_port": null, "tcp_stream": null, "udp_stream": 86, "frame_number": 16213, "timestamp_epoch": "1583962439.122852000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "10:98:36:59:9d:cc", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-8921daaf24bcdb5659dd90fb", "src_port": null, "tcp_stream": null, "udp_stream": 86, "frame_number": 16214, "timestamp_epoch": "1583962439.123008000" }, { "kind": "identity", "dst_ip": "224.0.0.251", "fields": { "eth.dst": "01:00:5e:00:00:fb", "eth.src": "10:98:36:59:9d:cc", "dns.qry.name": "wpad.local" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-069c957ff01b5857aa7e9395", "src_port": null, "tcp_stream": null, "udp_stream": 80, "frame_number": 16216, "timestamp_epoch": "1583962439.367831000" }, { "kind": "identity", "dst_ip": "224.0.0.251", "fields": { "eth.dst": "01:00:5e:00:00:fb", "eth.src": "10:98:36:59:9d:cc", "dns.qry.name": "wpad.local" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-a3fed77ff2288b211ddb2a00", "src_port": null, "tcp_stream": null, "udp_stream": 80, "frame_number": 16217, "timestamp_epoch": "1583962439.371745000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "10:98:36:59:9d:cc", "nbns.name": "ADHCINQLS<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-1549092d695692cef4c0a875", "src_port": null, "tcp_stream": null, "udp_stream": 86, "frame_number": 16223, "timestamp_epoch": "1583962439.874408000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "10:98:36:59:9d:cc", "nbns.name": "NVZKINVUUINKGS<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-90cd8aee0f837cb74f7cdcc7", "src_port": null, "tcp_stream": null, "udp_stream": 86, "frame_number": 16225, "timestamp_epoch": "1583962439.874681000" }, { "kind": "identity", "dst_ip": "224.0.0.251", "fields": { "eth.dst": "01:00:5e:00:00:fb", "eth.src": "10:98:36:59:9d:cc", "dns.qry.name": "adhcinqls.local" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-3187435cce14eeb41dc0767b", "src_port": null, "tcp_stream": null, "udp_stream": 80, "frame_number": 16226, "timestamp_epoch": "1583962439.874751000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "10:98:36:59:9d:cc", "dns.qry.name": "adhcinqls" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-d1fb1790256651e0a489e00c", "src_port": null, "tcp_stream": null, "udp_stream": 272, "frame_number": 16228, "timestamp_epoch": "1583962439.875185000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "10:98:36:59:9d:cc", "nbns.name": "ROIJVDFLSX<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-7ca16e7d053cb12375aeed70", "src_port": null, "tcp_stream": null, "udp_stream": 86, "frame_number": 16229, "timestamp_epoch": "1583962439.875294000" }, { "kind": "identity", "dst_ip": "224.0.0.251", "fields": { "eth.dst": "01:00:5e:00:00:fb", "eth.src": "10:98:36:59:9d:cc", "dns.qry.name": "nvzkinvuuinkgs.local" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-038545c378767a41f1337a66", "src_port": null, "tcp_stream": null, "udp_stream": 80, "frame_number": 16230, "timestamp_epoch": "1583962439.875416000" }, { "kind": "identity", "dst_ip": "224.0.0.251", "fields": { "eth.dst": "01:00:5e:00:00:fb", "eth.src": "10:98:36:59:9d:cc", "dns.qry.name": "roijvdflsx.local" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-790cd2f16717484166f400be", "src_port": null, "tcp_stream": null, "udp_stream": 80, "frame_number": 16231, "timestamp_epoch": "1583962439.875690000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "10:98:36:59:9d:cc", "dns.qry.name": "nvzkinvuuinkgs" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-4105a2a6db30e48a56cd48ef", "src_port": null, "tcp_stream": null, "udp_stream": 273, "frame_number": 16232, "timestamp_epoch": "1583962439.875948000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "10:98:36:59:9d:cc", "dns.qry.name": "roijvdflsx" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-2f1181106b1d3569566f0195", "src_port": null, "tcp_stream": null, "udp_stream": 274, "frame_number": 16233, "timestamp_epoch": "1583962439.876069000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "10:98:36:59:9d:cc", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-39b0f4ad61efdced14482dee", "src_port": null, "tcp_stream": null, "udp_stream": 86, "frame_number": 16234, "timestamp_epoch": "1583962439.886332000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "10:98:36:59:9d:cc", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-56f1db9808c0be344fbbf460", "src_port": null, "tcp_stream": null, "udp_stream": 86, "frame_number": 16235, "timestamp_epoch": "1583962439.886450000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "10:98:36:59:9d:cc", "dns.qry.name": "roijvdflsx" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-ca9c6d67547054261b66c34f", "src_port": null, "tcp_stream": null, "udp_stream": 274, "frame_number": 16236, "timestamp_epoch": "1583962440.286201000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "10:98:36:59:9d:cc", "dns.qry.name": "nvzkinvuuinkgs" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-e85b643c57901672f6ebad3e", "src_port": null, "tcp_stream": null, "udp_stream": 273, "frame_number": 16237, "timestamp_epoch": "1583962440.286332000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "10:98:36:59:9d:cc", "dns.qry.name": "adhcinqls" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-a54f2f91d9c03763eb92f4f0", "src_port": null, "tcp_stream": null, "udp_stream": 272, "frame_number": 16238, "timestamp_epoch": "1583962440.286488000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "10:98:36:59:9d:cc", "nbns.name": "ADHCINQLS<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-0d918959e38fa3087367b441", "src_port": null, "tcp_stream": null, "udp_stream": 86, "frame_number": 16239, "timestamp_epoch": "1583962440.625963000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "10:98:36:59:9d:cc", "nbns.name": "NVZKINVUUINKGS<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-664da9eeba815591e1fc396f", "src_port": null, "tcp_stream": null, "udp_stream": 86, "frame_number": 16240, "timestamp_epoch": "1583962440.626155000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "10:98:36:59:9d:cc", "nbns.name": "ROIJVDFLSX<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-a0b3eaf74e84be57f3d75507", "src_port": null, "tcp_stream": null, "udp_stream": 86, "frame_number": 16241, "timestamp_epoch": "1583962440.626349000" }, { "kind": "identity", "dst_ip": "224.0.0.251", "fields": { "eth.dst": "01:00:5e:00:00:fb", "eth.src": "10:98:36:59:9d:cc", "dns.qry.name": "adhcinqls.local" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-9325f12ef949066e1f53d86b", "src_port": null, "tcp_stream": null, "udp_stream": 80, "frame_number": 16242, "timestamp_epoch": "1583962440.874431000" }, { "kind": "identity", "dst_ip": "224.0.0.251", "fields": { "eth.dst": "01:00:5e:00:00:fb", "eth.src": "10:98:36:59:9d:cc", "dns.qry.name": "roijvdflsx.local" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-0acf618e707b27b35fd44f24", "src_port": null, "tcp_stream": null, "udp_stream": 80, "frame_number": 16244, "timestamp_epoch": "1583962440.876313000" }, { "kind": "identity", "dst_ip": "224.0.0.251", "fields": { "eth.dst": "01:00:5e:00:00:fb", "eth.src": "10:98:36:59:9d:cc", "dns.qry.name": "nvzkinvuuinkgs.local" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-c76e9020c381da9665527944", "src_port": null, "tcp_stream": null, "udp_stream": 80, "frame_number": 16245, "timestamp_epoch": "1583962440.876566000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "10:98:36:59:9d:cc", "nbns.name": "ROIJVDFLSX<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-434aaf7b67412ecd6a12902a", "src_port": null, "tcp_stream": null, "udp_stream": 86, "frame_number": 16248, "timestamp_epoch": "1583962441.377305000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "10:98:36:59:9d:cc", "nbns.name": "NVZKINVUUINKGS<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-04198e970c8fcfad5a02fd9d", "src_port": null, "tcp_stream": null, "udp_stream": 86, "frame_number": 16249, "timestamp_epoch": "1583962441.377522000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "10:98:36:59:9d:cc", "nbns.name": "ADHCINQLS<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-bd0b3f4a3f28883a0146ade8", "src_port": null, "tcp_stream": null, "udp_stream": 86, "frame_number": 16250, "timestamp_epoch": "1583962441.377735000" }, { "kind": "identity", "dst_ip": "224.0.0.251", "fields": { "eth.dst": "01:00:5e:00:00:fb", "eth.src": "10:98:36:59:9d:cc", "dns.qry.name": "_googlecast._tcp.local" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-071a05e08c5dcc4205cf26ac", "src_port": null, "tcp_stream": null, "udp_stream": 80, "frame_number": 16251, "timestamp_epoch": "1583962441.875215000" }, { "kind": "identity", "dst_ip": "224.0.0.251", "fields": { "eth.dst": "01:00:5e:00:00:fb", "eth.src": "10:98:36:59:9d:cc", "dns.qry.name": "_googlecast._tcp.local" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-fdbffc9eb70083cbb8beb725", "src_port": null, "tcp_stream": null, "udp_stream": 80, "frame_number": 16252, "timestamp_epoch": "1583962441.875499000" }, { "kind": "identity", "dst_ip": "224.0.0.251", "fields": { "eth.dst": "01:00:5e:00:00:fb", "eth.src": "10:98:36:59:9d:cc", "dns.qry.name": "_googlecast._tcp.local" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-88c0fdcb48f617b9a3df0b05", "src_port": null, "tcp_stream": null, "udp_stream": 80, "frame_number": 16255, "timestamp_epoch": "1583962442.876463000" }, { "kind": "identity", "dst_ip": "224.0.0.251", "fields": { "eth.dst": "01:00:5e:00:00:fb", "eth.src": "10:98:36:59:9d:cc", "dns.qry.name": "_googlecast._tcp.local" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-7360bca88cab875b64a12c9a", "src_port": null, "tcp_stream": null, "udp_stream": 80, "frame_number": 16256, "timestamp_epoch": "1583962442.876815000" }, { "kind": "identity", "dst_ip": "224.0.0.251", "fields": { "eth.dst": "01:00:5e:00:00:fb", "eth.src": "10:98:36:59:9d:cc", "dns.qry.name": "_googlecast._tcp.local" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-c41325fc526f541dd02bcd04", "src_port": null, "tcp_stream": null, "udp_stream": 80, "frame_number": 16257, "timestamp_epoch": "1583962444.878296000" }, { "kind": "identity", "dst_ip": "224.0.0.251", "fields": { "eth.dst": "01:00:5e:00:00:fb", "eth.src": "10:98:36:59:9d:cc", "dns.qry.name": "_googlecast._tcp.local" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-c0411a9330732cbde67c73fd", "src_port": null, "tcp_stream": null, "udp_stream": 80, "frame_number": 16258, "timestamp_epoch": "1583962444.878587000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "10:98:36:59:9d:cc", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-303cc20b58274a9d91a1a7e0", "src_port": null, "tcp_stream": null, "udp_stream": 86, "frame_number": 16262, "timestamp_epoch": "1583962447.371741000" }, { "kind": "identity", "dst_ip": "224.0.0.251", "fields": { "eth.dst": "01:00:5e:00:00:fb", "eth.src": "10:98:36:59:9d:cc", "dns.qry.name": "wpad.local" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-dbf686301a60e1bbe252f646", "src_port": null, "tcp_stream": null, "udp_stream": 80, "frame_number": 16263, "timestamp_epoch": "1583962447.372034000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "10:98:36:59:9d:cc", "dns.qry.name": "wpad" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-a2e43c2e53de95f5985583bd", "src_port": null, "tcp_stream": null, "udp_stream": 276, "frame_number": 16264, "timestamp_epoch": "1583962447.372461000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "10:98:36:59:9d:cc", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-b9be83a0c8479cc4e206ade8", "src_port": null, "tcp_stream": null, "udp_stream": 86, "frame_number": 16267, "timestamp_epoch": "1583962447.376183000" }, { "kind": "identity", "dst_ip": "224.0.0.251", "fields": { "eth.dst": "01:00:5e:00:00:fb", "eth.src": "10:98:36:59:9d:cc", "dns.qry.name": "wpad.local" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-f737ab4509d82bca81f6222b", "src_port": null, "tcp_stream": null, "udp_stream": 80, "frame_number": 16268, "timestamp_epoch": "1583962447.376442000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "10:98:36:59:9d:cc", "dns.qry.name": "wpad" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-ae7213d119d04539d24da559", "src_port": null, "tcp_stream": null, "udp_stream": 278, "frame_number": 16269, "timestamp_epoch": "1583962447.376850000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "10:98:36:59:9d:cc", "dns.qry.name": "wpad" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-c5bcb25b80ddcf9783435035", "src_port": null, "tcp_stream": null, "udp_stream": 276, "frame_number": 16270, "timestamp_epoch": "1583962447.782827000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "10:98:36:59:9d:cc", "dns.qry.name": "wpad" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-e94b2cf587c3239bc3642a7c", "src_port": null, "tcp_stream": null, "udp_stream": 278, "frame_number": 16271, "timestamp_epoch": "1583962447.787763000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "10:98:36:59:9d:cc", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-000367e9ba137d0d1a45c48f", "src_port": null, "tcp_stream": null, "udp_stream": 86, "frame_number": 16272, "timestamp_epoch": "1583962448.126573000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "10:98:36:59:9d:cc", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-15a2ade860eb2225dea6cf42", "src_port": null, "tcp_stream": null, "udp_stream": 86, "frame_number": 16273, "timestamp_epoch": "1583962448.126701000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "10:98:36:59:9d:cc", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-0e64c664229ccfe02fdbcc46", "src_port": null, "tcp_stream": null, "udp_stream": 86, "frame_number": 16275, "timestamp_epoch": "1583962448.887623000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "10:98:36:59:9d:cc", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-037f88780fc685cd1c8e1a5d", "src_port": null, "tcp_stream": null, "udp_stream": 86, "frame_number": 16276, "timestamp_epoch": "1583962448.887791000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:1d:60:b5:5e:94", "browser.server": "LAPTOP-I9ZPI04" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-6bc8f52da989cc638872fd72", "src_port": null, "tcp_stream": null, "udp_stream": 23, "frame_number": 16311, "timestamp_epoch": "1583962473.701867000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "b8:ca:3a:ec:3b:8f", "browser.server": "LAPTOP-7XMV2SN" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-7ffd14d719ab34584054b15d", "src_port": null, "tcp_stream": null, "udp_stream": 58, "frame_number": 16314, "timestamp_epoch": "1583962500.192174000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "10:98:36:59:9d:cc", "browser.server": "LAPTOP-SQSA42O" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-e4666713d23367f0c0dccb6e", "src_port": null, "tcp_stream": null, "udp_stream": 109, "frame_number": 16324, "timestamp_epoch": "1583962533.570997000" }, { "kind": "identity", "dst_ip": "224.0.0.251", "fields": { "eth.dst": "01:00:5e:00:00:fb", "eth.src": "b8:ca:3a:ec:3b:8f", "dns.qry.name": "LAPTOP-7XMV2SN.local" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-3ebe8beb3c83ee4f25f81b35", "src_port": null, "tcp_stream": null, "udp_stream": 30, "frame_number": 16344, "timestamp_epoch": "1583962544.957746000" }, { "kind": "identity", "dst_ip": "224.0.0.251", "fields": { "eth.dst": "01:00:5e:00:00:fb", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-24578b8db44e6ce350ffe6b5", "src_port": null, "tcp_stream": null, "udp_stream": 30, "frame_number": 16345, "timestamp_epoch": "1583962544.958033000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "b8:ca:3a:ec:3b:8f", "dns.qry.name": "LAPTOP-7XMV2SN" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-c7192b8808a7e0b5f196dca7", "src_port": null, "tcp_stream": null, "udp_stream": 285, "frame_number": 16346, "timestamp_epoch": "1583962544.958531000" }, { "kind": "identity", "dst_ip": "224.0.0.251", "fields": { "eth.dst": "01:00:5e:00:00:fb", "eth.src": "b8:ca:3a:ec:3b:8f", "dns.qry.name": "LAPTOP-7XMV2SN.local" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-f28fc72f152b38ac1ab92212", "src_port": null, "tcp_stream": null, "udp_stream": 30, "frame_number": 16349, "timestamp_epoch": "1583962544.990110000" }, { "kind": "identity", "dst_ip": "224.0.0.251", "fields": { "eth.dst": "01:00:5e:00:00:fb", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-2f6bc545f7a88214ba0ee6bf", "src_port": null, "tcp_stream": null, "udp_stream": 30, "frame_number": 16350, "timestamp_epoch": "1583962544.990373000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "b8:ca:3a:ec:3b:8f", "dns.qry.name": "LAPTOP-7XMV2SN" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-6ad6cc21025daa9f8b886173", "src_port": null, "tcp_stream": null, "udp_stream": 286, "frame_number": 16351, "timestamp_epoch": "1583962544.990762000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f", "kerberos.msg_type": "14" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-eae5fe072bcde0eb74cfb518", "src_port": null, "tcp_stream": 416, "udp_stream": null, "frame_number": 16363, "timestamp_epoch": "1583962545.040157000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-884edcb949df649eeefaa947", "src_port": null, "tcp_stream": 416, "udp_stream": null, "frame_number": 16365, "timestamp_epoch": "1583962545.040990000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-a0cd45d290194253fdc28fff", "src_port": null, "tcp_stream": null, "udp_stream": 58, "frame_number": 17612, "timestamp_epoch": "1583962579.212350000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "b8:ca:3a:ec:3b:8f", "nbns.name": "MONDOGREEK<1b>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-3a5683cf3c64f6c18bd48337", "src_port": null, "tcp_stream": null, "udp_stream": 38, "frame_number": 17613, "timestamp_epoch": "1583962579.212621000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a", "nbns.name": "MONDOGREEK<1b> (Domain Master Browser)", "nbns.flags.opcode": "0", "nbns.flags.response": "True", "nbns.nb_flags.group": "False" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-663a48e095a98b57b1fcc50a", "src_port": null, "tcp_stream": null, "udp_stream": 299, "frame_number": 17614, "timestamp_epoch": "1583962579.212807000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-8a35143f77e9a29d950e1e72", "src_port": null, "tcp_stream": null, "udp_stream": 300, "frame_number": 17615, "timestamp_epoch": "1583962579.212967000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-7ead3b1c5e4ccf51199eac3e", "src_port": null, "tcp_stream": null, "udp_stream": 58, "frame_number": 17618, "timestamp_epoch": "1583962580.203572000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-4cc0a2c8e886ecd5092b392a", "src_port": null, "tcp_stream": null, "udp_stream": 300, "frame_number": 17619, "timestamp_epoch": "1583962580.203724000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-d43a022d5e458384afa88245", "src_port": null, "tcp_stream": null, "udp_stream": 58, "frame_number": 18306, "timestamp_epoch": "1583962581.217506000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-7b2017b9f0c3d1db6227b17d", "src_port": null, "tcp_stream": null, "udp_stream": 300, "frame_number": 18307, "timestamp_epoch": "1583962581.217630000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "b8:ca:3a:ec:3b:8f", "nbns.name": "MONDOGREEK<1e>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-fce6871d693d9bb52b8531ce", "src_port": null, "tcp_stream": null, "udp_stream": 38, "frame_number": 18317, "timestamp_epoch": "1583962582.217639000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "b8:ca:3a:ec:3b:8f", "nbns.name": "MONDOGREEK<1e>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-c6f628a6181d809e0a45b2b8", "src_port": null, "tcp_stream": null, "udp_stream": 38, "frame_number": 18320, "timestamp_epoch": "1583962582.983096000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "b8:ca:3a:ec:3b:8f", "nbns.name": "MONDOGREEK<1e>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-33560c72e206c65aaa99755e", "src_port": null, "tcp_stream": null, "udp_stream": 38, "frame_number": 18321, "timestamp_epoch": "1583962583.733401000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-0749619089c06ab549189a5f", "src_port": null, "tcp_stream": null, "udp_stream": 58, "frame_number": 18339, "timestamp_epoch": "1583962589.231806000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-7ea706a20a179d9bbf553daa", "src_port": null, "tcp_stream": null, "udp_stream": 300, "frame_number": 18340, "timestamp_epoch": "1583962589.232003000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-d08fb5e84be6aeffbf6f7007", "src_port": null, "tcp_stream": null, "udp_stream": 58, "frame_number": 18343, "timestamp_epoch": "1583962590.218831000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-52271ce47c3ffcf88e7216de", "src_port": null, "tcp_stream": null, "udp_stream": 300, "frame_number": 18344, "timestamp_epoch": "1583962590.218975000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-13cce9810905bd682a988a9c", "src_port": null, "tcp_stream": null, "udp_stream": 58, "frame_number": 18349, "timestamp_epoch": "1583962591.218899000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-3938854fb4b1e5f4cb666866", "src_port": null, "tcp_stream": null, "udp_stream": 300, "frame_number": 18350, "timestamp_epoch": "1583962591.219077000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "b8:ca:3a:ec:3b:8f", "nbns.name": "MONDOGREEK<1e>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-8d54aba8c0d0d35dd0f95363", "src_port": null, "tcp_stream": null, "udp_stream": 38, "frame_number": 18352, "timestamp_epoch": "1583962592.219310000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "b8:ca:3a:ec:3b:8f", "nbns.name": "MONDOGREEK<1e>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-efb227b8d49dc6c59c88b6f9", "src_port": null, "tcp_stream": null, "udp_stream": 38, "frame_number": 18354, "timestamp_epoch": "1583962592.984689000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "b8:ca:3a:ec:3b:8f", "nbns.name": "MONDOGREEK<1e>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-fa8f004893e34b9b1969c355", "src_port": null, "tcp_stream": null, "udp_stream": 38, "frame_number": 18357, "timestamp_epoch": "1583962593.749101000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f", "kerberos.msg_type": "10", "kerberos.CNameString": "otis.witherspoon" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-dbb7da1761dab904f20f643c", "src_port": null, "tcp_stream": 431, "udp_stream": null, "frame_number": 18401, "timestamp_epoch": "1583962605.424018000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "30" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-ae4ac9a94e89210e988cb88f", "src_port": null, "tcp_stream": 431, "udp_stream": null, "frame_number": 18402, "timestamp_epoch": "1583962605.424615000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f", "kerberos.msg_type": "10", "kerberos.CNameString": "otis.witherspoon" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-7b3d608cffb8d51f76d3a602", "src_port": null, "tcp_stream": 432, "udp_stream": null, "frame_number": 18409, "timestamp_epoch": "1583962605.432439000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "11", "kerberos.CNameString": "otis.witherspoon" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-ec592fa65d6c40ca72b1eacb", "src_port": null, "tcp_stream": 432, "udp_stream": null, "frame_number": 18411, "timestamp_epoch": "1583962605.433071000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f", "kerberos.msg_type": "12,14" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-dc9dac40ab056faf35430af9", "src_port": null, "tcp_stream": 433, "udp_stream": null, "frame_number": 18420, "timestamp_epoch": "1583962605.436599000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "otis.witherspoon" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-947c20ac297249e77987f6a1", "src_port": null, "tcp_stream": 433, "udp_stream": null, "frame_number": 18423, "timestamp_epoch": "1583962605.437333000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-aed9cf7dd53ec69221f0b6f1", "src_port": null, "tcp_stream": null, "udp_stream": 58, "frame_number": 19535, "timestamp_epoch": "1583962614.912078000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-026f4ad11e43a7a079ba53a1", "src_port": null, "tcp_stream": null, "udp_stream": 300, "frame_number": 19536, "timestamp_epoch": "1583962614.912289000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-a5230c8b796162f6185ae5ca", "src_port": null, "tcp_stream": null, "udp_stream": 58, "frame_number": 19549, "timestamp_epoch": "1583962615.906384000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-9373da8b3b9e64fcbb3a72af", "src_port": null, "tcp_stream": null, "udp_stream": 300, "frame_number": 19550, "timestamp_epoch": "1583962615.906644000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-dfefa387d12bd9826e434aea", "src_port": null, "tcp_stream": null, "udp_stream": 58, "frame_number": 19557, "timestamp_epoch": "1583962616.922786000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-c36e8cbbb14c08320ee9ce10", "src_port": null, "tcp_stream": null, "udp_stream": 300, "frame_number": 19558, "timestamp_epoch": "1583962616.922948000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "b8:ca:3a:ec:3b:8f", "nbns.name": "MONDOGREEK<1e>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-d2ce0e37010e2bf9804ac4f5", "src_port": null, "tcp_stream": null, "udp_stream": 38, "frame_number": 19655, "timestamp_epoch": "1583962617.953407000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "b8:ca:3a:ec:3b:8f", "nbns.name": "MONDOGREEK<1e>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-aedc4bd46015ca0aff7efc21", "src_port": null, "tcp_stream": null, "udp_stream": 38, "frame_number": 19893, "timestamp_epoch": "1583962618.703849000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f", "kerberos.msg_type": "10", "kerberos.CNameString": "otis.witherspoon" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-ea0fe6b2c576e3c8d8ca7cd9", "src_port": null, "tcp_stream": 453, "udp_stream": null, "frame_number": 20118, "timestamp_epoch": "1583962619.258654000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "30" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-083a33f08bbad829b2635fd1", "src_port": null, "tcp_stream": 453, "udp_stream": null, "frame_number": 20119, "timestamp_epoch": "1583962619.259114000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f", "kerberos.msg_type": "10", "kerberos.CNameString": "otis.witherspoon" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-ed684af5bfc08bd6d7675cbb", "src_port": null, "tcp_stream": 454, "udp_stream": null, "frame_number": 20126, "timestamp_epoch": "1583962619.260186000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "11", "kerberos.CNameString": "otis.witherspoon" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-119241735c0d94de8c878ffa", "src_port": null, "tcp_stream": 454, "udp_stream": null, "frame_number": 20128, "timestamp_epoch": "1583962619.260954000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f", "kerberos.msg_type": "12,14" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-d46da1eed9cccc27de517a76", "src_port": null, "tcp_stream": 455, "udp_stream": null, "frame_number": 20137, "timestamp_epoch": "1583962619.262186000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "otis.witherspoon" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-487106038477089c05611713", "src_port": null, "tcp_stream": 455, "udp_stream": null, "frame_number": 20140, "timestamp_epoch": "1583962619.263103000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f", "kerberos.msg_type": "14" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-b2fbe7faae173a4a411debdd", "src_port": null, "tcp_stream": 452, "udp_stream": null, "frame_number": 20146, "timestamp_epoch": "1583962619.264001000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-1f6d35ee260fb0cd5eb05eac", "src_port": null, "tcp_stream": 452, "udp_stream": null, "frame_number": 20148, "timestamp_epoch": "1583962619.264924000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f", "kerberos.msg_type": "15" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-45e59604077b256459f9df0b", "src_port": null, "tcp_stream": 452, "udp_stream": null, "frame_number": 20149, "timestamp_epoch": "1583962619.265624000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f", "kerberos.msg_type": "12,14" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-1963850d70e30cec042a431d", "src_port": null, "tcp_stream": 457, "udp_stream": null, "frame_number": 20176, "timestamp_epoch": "1583962619.289190000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "otis.witherspoon" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-e632b4d055024b346f162e9a", "src_port": null, "tcp_stream": 457, "udp_stream": null, "frame_number": 20179, "timestamp_epoch": "1583962619.289984000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f", "kerberos.msg_type": "14" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-8da0a92fb532b18a1115fd4b", "src_port": null, "tcp_stream": 456, "udp_stream": null, "frame_number": 20185, "timestamp_epoch": "1583962619.290624000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-4c94b409e194e283b62a9495", "src_port": null, "tcp_stream": 456, "udp_stream": null, "frame_number": 20187, "timestamp_epoch": "1583962619.291429000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "b8:ca:3a:ec:3b:8f", "nbns.name": "MONDOGREEK<1e>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-719e2d19b0df44adf3450526", "src_port": null, "tcp_stream": null, "udp_stream": 38, "frame_number": 20435, "timestamp_epoch": "1583962619.469817000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f", "kerberos.msg_type": "14" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-86d34b7c4020203dabc2492e", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20444, "timestamp_epoch": "1583962619.473010000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-cbe6523781942cb6f3e59368", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20446, "timestamp_epoch": "1583962619.473746000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-758d2affae9fe838e44000ee", "src_port": null, "tcp_stream": null, "udp_stream": 58, "frame_number": 20665, "timestamp_epoch": "1583962620.235824000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-a0dc3467480e7e12004e707c", "src_port": null, "tcp_stream": null, "udp_stream": 300, "frame_number": 20666, "timestamp_epoch": "1583962620.236078000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-479338671640894bb8de1a6b", "src_port": null, "tcp_stream": null, "udp_stream": 58, "frame_number": 20671, "timestamp_epoch": "1583962621.251962000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-18d5b56300f516f17dece9b0", "src_port": null, "tcp_stream": null, "udp_stream": 300, "frame_number": 20672, "timestamp_epoch": "1583962621.252157000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-e349f486a3c8403b7207675e", "src_port": null, "tcp_stream": null, "udp_stream": 58, "frame_number": 20697, "timestamp_epoch": "1583962622.266342000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-8c36e9151919b2b6e0fbed30", "src_port": null, "tcp_stream": null, "udp_stream": 300, "frame_number": 20698, "timestamp_epoch": "1583962622.266595000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "b8:ca:3a:ec:3b:8f", "nbns.name": "MONDOGREEK<1e>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-6b3f1a2baf24fd1acd34e9e6", "src_port": null, "tcp_stream": null, "udp_stream": 38, "frame_number": 20701, "timestamp_epoch": "1583962623.281677000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "b8:ca:3a:ec:3b:8f", "nbns.name": "MONDOGREEK<1e>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-b2fecdf42535c682c0aba186", "src_port": null, "tcp_stream": null, "udp_stream": 38, "frame_number": 20704, "timestamp_epoch": "1583962624.046777000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "b8:ca:3a:ec:3b:8f", "nbns.name": "MONDOGREEK<1e>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-5212d7ae413ea237fb90322b", "src_port": null, "tcp_stream": null, "udp_stream": 38, "frame_number": 20713, "timestamp_epoch": "1583962624.797805000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-773194fb9cf6cc15d45a6b61", "src_port": null, "tcp_stream": null, "udp_stream": 58, "frame_number": 20720, "timestamp_epoch": "1583962626.563915000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-a653021c3c4076cf6a79eae4", "src_port": null, "tcp_stream": null, "udp_stream": 300, "frame_number": 20721, "timestamp_epoch": "1583962626.564123000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-38c7c7eae417c4a71c9f66bd", "src_port": null, "tcp_stream": null, "udp_stream": 58, "frame_number": 20726, "timestamp_epoch": "1583962627.563986000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-79da5580572620e472d2e0df", "src_port": null, "tcp_stream": null, "udp_stream": 300, "frame_number": 20727, "timestamp_epoch": "1583962627.564165000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-98f5afa364224730a0a4ddab", "src_port": null, "tcp_stream": null, "udp_stream": 58, "frame_number": 20730, "timestamp_epoch": "1583962628.579166000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-cd4b9a9ab2e77c662a21c780", "src_port": null, "tcp_stream": null, "udp_stream": 300, "frame_number": 20731, "timestamp_epoch": "1583962628.579314000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "b8:ca:3a:ec:3b:8f", "nbns.name": "MONDOGREEK<1e>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-a19065f4c071e2b776b4837c", "src_port": null, "tcp_stream": null, "udp_stream": 38, "frame_number": 20752, "timestamp_epoch": "1583962629.593865000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "b8:ca:3a:ec:3b:8f", "nbns.name": "MONDOGREEK<1e>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-80d3daeb5867cd941de707cc", "src_port": null, "tcp_stream": null, "udp_stream": 38, "frame_number": 20777, "timestamp_epoch": "1583962630.345150000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "b8:ca:3a:ec:3b:8f", "nbns.name": "MONDOGREEK<1e>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-0e681c3fca601e85ba2172c8", "src_port": null, "tcp_stream": null, "udp_stream": 38, "frame_number": 20780, "timestamp_epoch": "1583962631.109942000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-c4ea682abc27362eb7becc1c", "src_port": null, "tcp_stream": null, "udp_stream": 58, "frame_number": 20783, "timestamp_epoch": "1583962631.876094000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-6db4dadf57177ccf56b9c076", "src_port": null, "tcp_stream": null, "udp_stream": 300, "frame_number": 20784, "timestamp_epoch": "1583962631.876302000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-dcde6c41d09272f0e502dbd3", "src_port": null, "tcp_stream": null, "udp_stream": 58, "frame_number": 20785, "timestamp_epoch": "1583962632.876012000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-bad41555dd5af2af7911293f", "src_port": null, "tcp_stream": null, "udp_stream": 300, "frame_number": 20786, "timestamp_epoch": "1583962632.876206000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-ff3accf92020e535fffcdf9e", "src_port": null, "tcp_stream": null, "udp_stream": 58, "frame_number": 20791, "timestamp_epoch": "1583962633.876718000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-920660b7fbcd6038971a207f", "src_port": null, "tcp_stream": null, "udp_stream": 300, "frame_number": 20792, "timestamp_epoch": "1583962633.876876000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "b8:ca:3a:ec:3b:8f", "nbns.name": "MONDOGREEK<1e>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-0370bddb96671dc4abf10991", "src_port": null, "tcp_stream": null, "udp_stream": 38, "frame_number": 20795, "timestamp_epoch": "1583962634.876897000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "b8:ca:3a:ec:3b:8f", "nbns.name": "MONDOGREEK<1e>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-e01df7a39d5144dc5255a1f9", "src_port": null, "tcp_stream": null, "udp_stream": 38, "frame_number": 20796, "timestamp_epoch": "1583962635.641535000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "b8:ca:3a:ec:3b:8f", "nbns.name": "MONDOGREEK<1e>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-8eddadbed431d62920f3b6a6", "src_port": null, "tcp_stream": null, "udp_stream": 38, "frame_number": 20801, "timestamp_epoch": "1583962636.392120000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-da047e948ed8ee54c7545458", "src_port": null, "tcp_stream": null, "udp_stream": 58, "frame_number": 20804, "timestamp_epoch": "1583962637.157836000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-570e49cb25d55a960924ec75", "src_port": null, "tcp_stream": null, "udp_stream": 300, "frame_number": 20805, "timestamp_epoch": "1583962637.158087000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f", "kerberos.msg_type": "14" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-ae9bf1d05e0d0c9fee005201", "src_port": null, "tcp_stream": 461, "udp_stream": null, "frame_number": 20814, "timestamp_epoch": "1583962637.172564000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-06bb5a017a5655f33e957f94", "src_port": null, "tcp_stream": 461, "udp_stream": null, "frame_number": 20816, "timestamp_epoch": "1583962637.173284000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-7b047f2b3d8e6d52ddbb7128", "src_port": null, "tcp_stream": null, "udp_stream": 58, "frame_number": 21081, "timestamp_epoch": "1583962638.173268000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-f9c9d0ce1bb37f636234bb96", "src_port": null, "tcp_stream": null, "udp_stream": 300, "frame_number": 21082, "timestamp_epoch": "1583962638.173533000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-7ec4d7b121fbda5e981011a8", "src_port": null, "tcp_stream": null, "udp_stream": 58, "frame_number": 21085, "timestamp_epoch": "1583962639.188653000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-75abe0e9a0297c901cc6b7c3", "src_port": null, "tcp_stream": null, "udp_stream": 300, "frame_number": 21086, "timestamp_epoch": "1583962639.188823000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "b8:ca:3a:ec:3b:8f", "nbns.name": "MONDOGREEK<1e>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-a05cbf4ed0e1a0913f491358", "src_port": null, "tcp_stream": null, "udp_stream": 38, "frame_number": 21100, "timestamp_epoch": "1583962640.189051000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "b8:ca:3a:ec:3b:8f", "nbns.name": "MONDOGREEK<1e>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-813c4f6f220113e621c006c9", "src_port": null, "tcp_stream": null, "udp_stream": 38, "frame_number": 21105, "timestamp_epoch": "1583962640.954286000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "b8:ca:3a:ec:3b:8f", "nbns.name": "MONDOGREEK<1e>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-0523cc7d26644a39a7a55b50", "src_port": null, "tcp_stream": null, "udp_stream": 38, "frame_number": 21106, "timestamp_epoch": "1583962641.704786000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "10:98:36:59:9d:cc", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-65c6b525b3a3350fb7a44ffb", "src_port": null, "tcp_stream": null, "udp_stream": 86, "frame_number": 21120, "timestamp_epoch": "1583962650.286080000" }, { "kind": "identity", "dst_ip": "224.0.0.251", "fields": { "eth.dst": "01:00:5e:00:00:fb", "eth.src": "10:98:36:59:9d:cc", "dns.qry.name": "wpad.local" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-56ab5e43a918b792e1589a33", "src_port": null, "tcp_stream": null, "udp_stream": 80, "frame_number": 21121, "timestamp_epoch": "1583962650.286478000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "10:98:36:59:9d:cc", "dns.qry.name": "wpad" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-597d0c9645c768c6485d93ee", "src_port": null, "tcp_stream": null, "udp_stream": 313, "frame_number": 21122, "timestamp_epoch": "1583962650.286974000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "10:98:36:59:9d:cc", "dns.qry.name": "wpad" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-b91f0940bc037d17638fe3af", "src_port": null, "tcp_stream": null, "udp_stream": 313, "frame_number": 21223, "timestamp_epoch": "1583962650.696699000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "10:98:36:59:9d:cc", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-c4cb630eec004d921f5e117c", "src_port": null, "tcp_stream": null, "udp_stream": 86, "frame_number": 21375, "timestamp_epoch": "1583962651.040525000" }, { "kind": "identity", "dst_ip": "224.0.0.251", "fields": { "eth.dst": "01:00:5e:00:00:fb", "eth.src": "10:98:36:59:9d:cc", "dns.qry.name": "wpad.local" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-1dcd9b17eaed073a69fdd3db", "src_port": null, "tcp_stream": null, "udp_stream": 80, "frame_number": 21800, "timestamp_epoch": "1583962651.293140000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "10:98:36:59:9d:cc", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-5fc24cfeb65c065d10d89596", "src_port": null, "tcp_stream": null, "udp_stream": 86, "frame_number": 23175, "timestamp_epoch": "1583962651.790541000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-49055859dad64f1a4ef683b5", "src_port": null, "tcp_stream": 526, "udp_stream": null, "frame_number": 25572, "timestamp_epoch": "1583962655.986375000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-3a7ccf7e5c398e6539ff1f60", "src_port": null, "tcp_stream": 526, "udp_stream": null, "frame_number": 25573, "timestamp_epoch": "1583962655.986559000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-4d3c0ed6c3ff6801934be0a0", "src_port": null, "tcp_stream": 526, "udp_stream": null, "frame_number": 25574, "timestamp_epoch": "1583962655.986862000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94", "kerberos.msg_type": "14" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-eadf424174564edb28e59fa8", "src_port": null, "tcp_stream": 526, "udp_stream": null, "frame_number": 25577, "timestamp_epoch": "1583962655.988041000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-8ade201a22b05f26dde813d7", "src_port": null, "tcp_stream": 526, "udp_stream": null, "frame_number": 25579, "timestamp_epoch": "1583962655.989830000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-489fc44baa099c374dd01952", "src_port": null, "tcp_stream": 526, "udp_stream": null, "frame_number": 25580, "timestamp_epoch": "1583962655.990433000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-752a7654812b3c3d39e11e87", "src_port": null, "tcp_stream": 526, "udp_stream": null, "frame_number": 25581, "timestamp_epoch": "1583962655.990654000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-f0f0735ce2e989cb5c2c7f7c", "src_port": null, "tcp_stream": 526, "udp_stream": null, "frame_number": 25582, "timestamp_epoch": "1583962655.990885000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-56d329bf26e4fd504c4dc42c", "src_port": null, "tcp_stream": 526, "udp_stream": null, "frame_number": 25583, "timestamp_epoch": "1583962655.990985000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-3a00191f921fe4d348e07620", "src_port": null, "tcp_stream": 526, "udp_stream": null, "frame_number": 25584, "timestamp_epoch": "1583962655.991050000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-7addf76d335b521e63d467c3", "src_port": null, "tcp_stream": 526, "udp_stream": null, "frame_number": 25585, "timestamp_epoch": "1583962655.991340000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-50399ce40a6d1d3087cee9f1", "src_port": null, "tcp_stream": 526, "udp_stream": null, "frame_number": 26637, "timestamp_epoch": "1583962666.793255000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-62f99a740ddeb3cf40768633", "src_port": null, "tcp_stream": 526, "udp_stream": null, "frame_number": 26638, "timestamp_epoch": "1583962666.793522000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-612478cec9d58ce62b007a0e", "src_port": null, "tcp_stream": 526, "udp_stream": null, "frame_number": 26639, "timestamp_epoch": "1583962666.793741000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-7a7fd51044b02622395b37ba", "src_port": null, "tcp_stream": 526, "udp_stream": null, "frame_number": 26640, "timestamp_epoch": "1583962666.793943000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-2f7671759a96048f0e3e1ff1", "src_port": null, "tcp_stream": 556, "udp_stream": null, "frame_number": 26706, "timestamp_epoch": "1583962681.595148000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-43cc046a6a0d68a113943a1f", "src_port": null, "tcp_stream": 556, "udp_stream": null, "frame_number": 26707, "timestamp_epoch": "1583962681.595355000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-21b059bac9ac855bbbeee55d", "src_port": null, "tcp_stream": 556, "udp_stream": null, "frame_number": 26708, "timestamp_epoch": "1583962681.595679000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f", "kerberos.msg_type": "14" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-5f3a2f279d4c056f3a15b6fa", "src_port": null, "tcp_stream": 556, "udp_stream": null, "frame_number": 26711, "timestamp_epoch": "1583962681.597021000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-09a8fdff36d6ccf6f54dbdb1", "src_port": null, "tcp_stream": 556, "udp_stream": null, "frame_number": 26713, "timestamp_epoch": "1583962681.598911000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-157d98ae2b3aeef7f4fefbff", "src_port": null, "tcp_stream": 556, "udp_stream": null, "frame_number": 26714, "timestamp_epoch": "1583962681.599510000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-30afefe74d8c5d652467a88f", "src_port": null, "tcp_stream": 556, "udp_stream": null, "frame_number": 26715, "timestamp_epoch": "1583962681.599761000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-5dd8ad32b25391494985feb7", "src_port": null, "tcp_stream": 556, "udp_stream": null, "frame_number": 26716, "timestamp_epoch": "1583962681.600081000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-eb8ccc67018a07ab59cc8644", "src_port": null, "tcp_stream": 556, "udp_stream": null, "frame_number": 26717, "timestamp_epoch": "1583962681.600197000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-0ca17109c252f88827b8503d", "src_port": null, "tcp_stream": 556, "udp_stream": null, "frame_number": 26718, "timestamp_epoch": "1583962681.600255000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-9211cfcc8f753e95394af7f1", "src_port": null, "tcp_stream": 556, "udp_stream": null, "frame_number": 26719, "timestamp_epoch": "1583962681.600568000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-71d07fa6c0e5ca8ebd413c31", "src_port": null, "tcp_stream": 556, "udp_stream": null, "frame_number": 27019, "timestamp_epoch": "1583962692.335684000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-8405e20eef894611711f11fd", "src_port": null, "tcp_stream": 556, "udp_stream": null, "frame_number": 27020, "timestamp_epoch": "1583962692.335828000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-e935bb54468a4208401ca315", "src_port": null, "tcp_stream": 556, "udp_stream": null, "frame_number": 27021, "timestamp_epoch": "1583962692.335996000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-a4dbd8c120658cb45bd417f5", "src_port": null, "tcp_stream": 556, "udp_stream": null, "frame_number": 27022, "timestamp_epoch": "1583962692.336136000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-6381635394e5f411a755c78e", "src_port": null, "tcp_stream": 564, "udp_stream": null, "frame_number": 27287, "timestamp_epoch": "1583962713.585154000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-e0fc3649f75c195166b34d8c", "src_port": null, "tcp_stream": 564, "udp_stream": null, "frame_number": 27288, "timestamp_epoch": "1583962713.585398000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-29dc6ccf692a629821236896", "src_port": null, "tcp_stream": 564, "udp_stream": null, "frame_number": 27289, "timestamp_epoch": "1583962713.585713000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc", "kerberos.msg_type": "14" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-522df1fc134a6f23ee903665", "src_port": null, "tcp_stream": 564, "udp_stream": null, "frame_number": 27292, "timestamp_epoch": "1583962713.587097000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-e98bf415fbd951f942dfbe44", "src_port": null, "tcp_stream": 564, "udp_stream": null, "frame_number": 27294, "timestamp_epoch": "1583962713.589084000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-fec08a7882dfc407eae20f09", "src_port": null, "tcp_stream": 564, "udp_stream": null, "frame_number": 27295, "timestamp_epoch": "1583962713.589721000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-4c046837d39da083c54f94b4", "src_port": null, "tcp_stream": 564, "udp_stream": null, "frame_number": 27296, "timestamp_epoch": "1583962713.589937000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-d5a190816d9d4454f598c179", "src_port": null, "tcp_stream": 564, "udp_stream": null, "frame_number": 27297, "timestamp_epoch": "1583962713.590189000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-36f37ebd180ba93046c3bb3f", "src_port": null, "tcp_stream": 564, "udp_stream": null, "frame_number": 27298, "timestamp_epoch": "1583962713.590343000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-698d2a0a372b7e5790c36770", "src_port": null, "tcp_stream": 564, "udp_stream": null, "frame_number": 27299, "timestamp_epoch": "1583962713.590348000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-4dbf9675800a782f72697d82", "src_port": null, "tcp_stream": 564, "udp_stream": null, "frame_number": 27300, "timestamp_epoch": "1583962713.590563000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-a1f91f10cf1f71981a347a54", "src_port": null, "tcp_stream": 564, "udp_stream": null, "frame_number": 27302, "timestamp_epoch": "1583962724.375853000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-36fce810043619ddc7cc5c4d", "src_port": null, "tcp_stream": 564, "udp_stream": null, "frame_number": 27303, "timestamp_epoch": "1583962724.376039000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-c3dd41056c45afe6a6f0a35c", "src_port": null, "tcp_stream": 564, "udp_stream": null, "frame_number": 27304, "timestamp_epoch": "1583962724.376239000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-c8761db36aca776803ab1469", "src_port": null, "tcp_stream": 564, "udp_stream": null, "frame_number": 27305, "timestamp_epoch": "1583962724.376415000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-e5212d70a7a17f3306e8101c", "src_port": null, "tcp_stream": 83, "udp_stream": null, "frame_number": 27652, "timestamp_epoch": "1583962955.442252000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-984946a21f7db776332668b0", "src_port": null, "tcp_stream": 83, "udp_stream": null, "frame_number": 27653, "timestamp_epoch": "1583962955.442461000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-6cd1edd543ba1acc1aaa1147", "src_port": null, "tcp_stream": 106, "udp_stream": null, "frame_number": 27697, "timestamp_epoch": "1583962981.275734000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-66dab92083672a2d36e66c35", "src_port": null, "tcp_stream": 106, "udp_stream": null, "frame_number": 27698, "timestamp_epoch": "1583962981.275944000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-7b2ce70c6f68cb4b2c77a531", "src_port": null, "tcp_stream": 182, "udp_stream": null, "frame_number": 27753, "timestamp_epoch": "1583963012.616354000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-449f253fc186af935ccc8326", "src_port": null, "tcp_stream": 182, "udp_stream": null, "frame_number": 27754, "timestamp_epoch": "1583963012.616578000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-1dedd43c5e3b876b1b42dee9", "src_port": null, "tcp_stream": 639, "udp_stream": null, "frame_number": 29525, "timestamp_epoch": "1583963172.278659000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-104f87811cc72f4a0cc09320", "src_port": null, "tcp_stream": 639, "udp_stream": null, "frame_number": 29526, "timestamp_epoch": "1583963172.278945000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-de11bc26e60eb949ca3c0fad", "src_port": null, "tcp_stream": 639, "udp_stream": null, "frame_number": 29527, "timestamp_epoch": "1583963172.279406000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f", "kerberos.msg_type": "12,14" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-743d18c298f3feb05a3b6249", "src_port": null, "tcp_stream": 640, "udp_stream": null, "frame_number": 29532, "timestamp_epoch": "1583963172.282177000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "otis.witherspoon" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-3424b20ee5e7fce026a845b1", "src_port": null, "tcp_stream": 640, "udp_stream": null, "frame_number": 29535, "timestamp_epoch": "1583963172.283250000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f", "kerberos.msg_type": "12,14" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-c317f5d581513ecd94ccd6c5", "src_port": null, "tcp_stream": 641, "udp_stream": null, "frame_number": 29544, "timestamp_epoch": "1583963172.284302000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "otis.witherspoon" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-afec5fdd0f74cbe7598c96f9", "src_port": null, "tcp_stream": 641, "udp_stream": null, "frame_number": 29547, "timestamp_epoch": "1583963172.284701000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f", "kerberos.msg_type": "14" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-545cddeadf96258cabc37ea8", "src_port": null, "tcp_stream": 639, "udp_stream": null, "frame_number": 29554, "timestamp_epoch": "1583963172.285279000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-33fb914cd17df231dd8f419d", "src_port": null, "tcp_stream": 639, "udp_stream": null, "frame_number": 29556, "timestamp_epoch": "1583963172.287280000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-eaf3f20f745e721e44afd456", "src_port": null, "tcp_stream": 639, "udp_stream": null, "frame_number": 29557, "timestamp_epoch": "1583963172.287757000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-0fb152391aa9cb7e9efc4bed", "src_port": null, "tcp_stream": 639, "udp_stream": null, "frame_number": 29558, "timestamp_epoch": "1583963172.288026000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-15c8df77f5c202e43d399566", "src_port": null, "tcp_stream": 639, "udp_stream": null, "frame_number": 29559, "timestamp_epoch": "1583963172.288344000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-38d5b237cfb4fffac9537558", "src_port": null, "tcp_stream": 639, "udp_stream": null, "frame_number": 29560, "timestamp_epoch": "1583963172.288539000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-e3dc3b41f2ca00f2fb2d019b", "src_port": null, "tcp_stream": 639, "udp_stream": null, "frame_number": 29561, "timestamp_epoch": "1583963172.288612000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-327de69b61e85537a16373f7", "src_port": null, "tcp_stream": 639, "udp_stream": null, "frame_number": 29562, "timestamp_epoch": "1583963172.288880000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-d335d57743cdc033cce3b790", "src_port": null, "tcp_stream": 639, "udp_stream": null, "frame_number": 29564, "timestamp_epoch": "1583963172.289336000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-2ee35a6b031c6f1a12c71bfd", "src_port": null, "tcp_stream": 639, "udp_stream": null, "frame_number": 29565, "timestamp_epoch": "1583963172.289547000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-956ca17aaa7d3d8567026502", "src_port": null, "tcp_stream": 639, "udp_stream": null, "frame_number": 29566, "timestamp_epoch": "1583963172.290131000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-dad3998003e4134998353189", "src_port": null, "tcp_stream": 639, "udp_stream": null, "frame_number": 29567, "timestamp_epoch": "1583963172.290361000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-129e468f06fb719e135d0d92", "src_port": null, "tcp_stream": 639, "udp_stream": null, "frame_number": 29568, "timestamp_epoch": "1583963172.290694000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-ed06ee43c6bf67fbd7bc1ac7", "src_port": null, "tcp_stream": 639, "udp_stream": null, "frame_number": 29569, "timestamp_epoch": "1583963172.290888000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-5c9aa59db1e456b4b6b27bdb", "src_port": null, "tcp_stream": 639, "udp_stream": null, "frame_number": 29570, "timestamp_epoch": "1583963172.291390000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-0a9c84f95d3e44b12a61cf34", "src_port": null, "tcp_stream": 639, "udp_stream": null, "frame_number": 29571, "timestamp_epoch": "1583963172.291804000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-6314732cb3293d0e361adcb5", "src_port": null, "tcp_stream": 639, "udp_stream": null, "frame_number": 29572, "timestamp_epoch": "1583963172.292020000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-c2d087b6357966130fd58ac2", "src_port": null, "tcp_stream": 639, "udp_stream": null, "frame_number": 29573, "timestamp_epoch": "1583963172.292307000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-ac5785357e0cf382a92f4f25", "src_port": null, "tcp_stream": 639, "udp_stream": null, "frame_number": 29574, "timestamp_epoch": "1583963172.292723000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-1396d5dc12495e1ef1cc7b1f", "src_port": null, "tcp_stream": 639, "udp_stream": null, "frame_number": 29575, "timestamp_epoch": "1583963172.293040000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-1bbe3f2b5fb3d5825024d3f0", "src_port": null, "tcp_stream": 639, "udp_stream": null, "frame_number": 29576, "timestamp_epoch": "1583963172.293223000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-575b59c4ebb8127461331243", "src_port": null, "tcp_stream": 639, "udp_stream": null, "frame_number": 29577, "timestamp_epoch": "1583963172.293690000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-9a96e6f38aae3e50f4885be8", "src_port": null, "tcp_stream": 639, "udp_stream": null, "frame_number": 29578, "timestamp_epoch": "1583963172.294657000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-c2809e60ecbeb26b857de308", "src_port": null, "tcp_stream": 639, "udp_stream": null, "frame_number": 29579, "timestamp_epoch": "1583963172.295001000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-953d5f43a2c6057672fa3841", "src_port": null, "tcp_stream": 639, "udp_stream": null, "frame_number": 29580, "timestamp_epoch": "1583963172.295704000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-23901bdb6c0b3f52f25d7882", "src_port": null, "tcp_stream": 639, "udp_stream": null, "frame_number": 29581, "timestamp_epoch": "1583963172.296253000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-906d73cedb06b69c902302bf", "src_port": null, "tcp_stream": 639, "udp_stream": null, "frame_number": 29582, "timestamp_epoch": "1583963172.296777000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-2744f9ea9e22100bf67531c1", "src_port": null, "tcp_stream": 639, "udp_stream": null, "frame_number": 29583, "timestamp_epoch": "1583963172.297398000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-51deb0a01967ff235617cefe", "src_port": null, "tcp_stream": 639, "udp_stream": null, "frame_number": 29584, "timestamp_epoch": "1583963172.298079000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a", "samr.samr_UserInfo21.full_name": "Otis Witherspoon", "samr.samr_UserInfo21.account_name": "otis.witherspoon" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-9f11f19d4042fdb71822cadb", "src_port": null, "tcp_stream": 639, "udp_stream": null, "frame_number": 29585, "timestamp_epoch": "1583963172.298498000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-876632844e900c783f72ee0d", "src_port": null, "tcp_stream": 639, "udp_stream": null, "frame_number": 29586, "timestamp_epoch": "1583963172.298786000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-b38730832dcb46fa196d337f", "src_port": null, "tcp_stream": 639, "udp_stream": null, "frame_number": 29587, "timestamp_epoch": "1583963172.299304000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-fffbacd71ba2f359064aa0fa", "src_port": null, "tcp_stream": 639, "udp_stream": null, "frame_number": 29588, "timestamp_epoch": "1583963172.299516000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-6223bbb398599790b4b3956c", "src_port": null, "tcp_stream": 639, "udp_stream": null, "frame_number": 29589, "timestamp_epoch": "1583963172.299919000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-997a82874aaf1afc19c52b65", "src_port": null, "tcp_stream": 639, "udp_stream": null, "frame_number": 29590, "timestamp_epoch": "1583963172.300145000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-017fb37a35ee2aadcb1c2aa0", "src_port": null, "tcp_stream": 639, "udp_stream": null, "frame_number": 29591, "timestamp_epoch": "1583963172.300497000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-404d643e9a43b3e366169901", "src_port": null, "tcp_stream": 639, "udp_stream": null, "frame_number": 29592, "timestamp_epoch": "1583963172.300808000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-d9b49f794ca3baef00a62daa", "src_port": null, "tcp_stream": 639, "udp_stream": null, "frame_number": 29593, "timestamp_epoch": "1583963172.301077000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-6029dba6c6ca9eb9e6d7b993", "src_port": null, "tcp_stream": 639, "udp_stream": null, "frame_number": 29594, "timestamp_epoch": "1583963172.301288000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-96361c74d9377a81e45f2afc", "src_port": null, "tcp_stream": 639, "udp_stream": null, "frame_number": 29595, "timestamp_epoch": "1583963172.301592000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-fc20392316f7001f44afaa0c", "src_port": null, "tcp_stream": 639, "udp_stream": null, "frame_number": 29596, "timestamp_epoch": "1583963172.301775000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-baa8436a16d915addd068357", "src_port": null, "tcp_stream": 639, "udp_stream": null, "frame_number": 29597, "timestamp_epoch": "1583963172.302042000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-bd7728e7b0b448f65785d499", "src_port": null, "tcp_stream": 639, "udp_stream": null, "frame_number": 29598, "timestamp_epoch": "1583963172.302214000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-97d431d7f0553a938ec32dc5", "src_port": null, "tcp_stream": 639, "udp_stream": null, "frame_number": 29599, "timestamp_epoch": "1583963172.302507000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-c60236a13b7b38e83b31c6c2", "src_port": null, "tcp_stream": 639, "udp_stream": null, "frame_number": 29600, "timestamp_epoch": "1583963172.302715000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-bd826d43da45821a3316edb7", "src_port": null, "tcp_stream": 639, "udp_stream": null, "frame_number": 29601, "timestamp_epoch": "1583963172.302889000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-c5444944a3039830acabab79", "src_port": null, "tcp_stream": 106, "udp_stream": null, "frame_number": 29603, "timestamp_epoch": "1583963183.014736000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-ceaea5e33e843358d40bcf23", "src_port": null, "tcp_stream": 639, "udp_stream": null, "frame_number": 29604, "timestamp_epoch": "1583963183.014890000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-72dfac76d302db34d729da1c", "src_port": null, "tcp_stream": 639, "udp_stream": null, "frame_number": 29605, "timestamp_epoch": "1583963183.015019000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-9c928cd4dd3d34c5b11eb887", "src_port": null, "tcp_stream": 106, "udp_stream": null, "frame_number": 29606, "timestamp_epoch": "1583963183.015134000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-683a35f5ab4518f9ad2fcdb8", "src_port": null, "tcp_stream": 639, "udp_stream": null, "frame_number": 29607, "timestamp_epoch": "1583963183.015248000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-4f7021207745c2fb2cb3fb24", "src_port": null, "tcp_stream": 106, "udp_stream": null, "frame_number": 29608, "timestamp_epoch": "1583963183.015344000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-ab511451576dfa98399c2636", "src_port": null, "tcp_stream": 639, "udp_stream": null, "frame_number": 29609, "timestamp_epoch": "1583963183.015405000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-3d580312b9fe00db0d5ff51f", "src_port": null, "tcp_stream": 106, "udp_stream": null, "frame_number": 29610, "timestamp_epoch": "1583963183.015527000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-d370d9b1578bfd97c310fde2", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29647, "timestamp_epoch": "1583963188.835951000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-75a604cce30ffdea87f22db6", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29648, "timestamp_epoch": "1583963188.837205000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-27ba068bd013b442ab7fdd11", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29649, "timestamp_epoch": "1583963188.837633000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94", "kerberos.msg_type": "12,14" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-598bf4bdbd9190c71062c56b", "src_port": null, "tcp_stream": 644, "udp_stream": null, "frame_number": 29654, "timestamp_epoch": "1583963188.843067000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "dominga.mcdowell" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-0261bfeaafb99aed3eadad02", "src_port": null, "tcp_stream": 644, "udp_stream": null, "frame_number": 29657, "timestamp_epoch": "1583963188.844857000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94", "kerberos.msg_type": "14" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-c28043173d61241c36cd21ba", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29664, "timestamp_epoch": "1583963188.845428000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-a4eb7f44dbced2b65c837490", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29666, "timestamp_epoch": "1583963188.848037000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-e7789d730704c84035268772", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29667, "timestamp_epoch": "1583963188.848646000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-05e797c0bbc46bc5068b8406", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29668, "timestamp_epoch": "1583963188.848974000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-d61cd5bb02200315bea7cdf9", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29669, "timestamp_epoch": "1583963188.849748000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-3ae61a24aad144b7506886b5", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29670, "timestamp_epoch": "1583963188.850153000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-8258e073c272eca16b8924c9", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29671, "timestamp_epoch": "1583963188.850786000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-50d1c1b7c38826b20b23241f", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29672, "timestamp_epoch": "1583963188.851147000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-b0cb7766147d846502033df5", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29673, "timestamp_epoch": "1583963188.851676000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-5c035ffa81407e545ffdcbd7", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29674, "timestamp_epoch": "1583963188.851874000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-848808bc18e1b3770516c4cf", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29675, "timestamp_epoch": "1583963188.853040000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-eefb116b5b34f4fa779c56c6", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29676, "timestamp_epoch": "1583963188.853251000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-f3a8bd0e72aea7139e44c2e2", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29677, "timestamp_epoch": "1583963188.854333000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-39795a6cda0c8fd665f3e30f", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29678, "timestamp_epoch": "1583963188.854495000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-6472273b3966715bd257e214", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29679, "timestamp_epoch": "1583963188.854903000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-1176bac4a73adf4f40c52163", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29680, "timestamp_epoch": "1583963188.855145000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-67d9aa51929599c4fc54f962", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29681, "timestamp_epoch": "1583963188.855350000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-286c8678a496a5d3e93e9628", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29682, "timestamp_epoch": "1583963188.855606000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-3a878519f76abcf5d0432864", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29683, "timestamp_epoch": "1583963188.856052000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-eb6a0824ff8954f9352242ad", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29684, "timestamp_epoch": "1583963188.856260000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-1c83ffebba91683fffe27819", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29685, "timestamp_epoch": "1583963188.856842000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-295b77b09b641bdb49ac3223", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29686, "timestamp_epoch": "1583963188.857036000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-a45f30a2d8a47b7ac9d89719", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29687, "timestamp_epoch": "1583963188.858447000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-be9198b388d97803c82605c1", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29688, "timestamp_epoch": "1583963188.858686000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-0d1cb93bbf5f644437b2cd8e", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29689, "timestamp_epoch": "1583963188.859208000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-2c4c95c38f84867b40a7b16d", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29690, "timestamp_epoch": "1583963188.859457000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-a8c52bbb35470fa61dbe1e6d", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29691, "timestamp_epoch": "1583963188.861107000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-7ff5688fb480047e90b06b38", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29692, "timestamp_epoch": "1583963188.861322000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-b0b74f44dc6edea04be9102d", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29693, "timestamp_epoch": "1583963188.863981000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-ed09c5be64240d164ff2de03", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29694, "timestamp_epoch": "1583963188.864153000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-f33fdefec6e01d9259ab5c41", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29695, "timestamp_epoch": "1583963188.864609000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-ddc73f5f9a8f3110d5146d40", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29696, "timestamp_epoch": "1583963188.864877000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-649f4a2ea294feee932a49c3", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29697, "timestamp_epoch": "1583963188.865901000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-1e0de1444ae7f22ee4d3b212", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29698, "timestamp_epoch": "1583963188.866079000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-c132b7bb7b70f23b32f2d9b1", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29699, "timestamp_epoch": "1583963188.866810000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-62eca40c5998d644fb446aec", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29700, "timestamp_epoch": "1583963188.867043000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-4a380bf9da9b15540b3a1475", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29701, "timestamp_epoch": "1583963188.867350000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-ace61f73fa8817ae40253c62", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29702, "timestamp_epoch": "1583963188.867536000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-a7471c0bba16a789e983b666", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29703, "timestamp_epoch": "1583963188.867805000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-bac539f929e6387b5488738b", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29704, "timestamp_epoch": "1583963188.867989000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-c800ca7d8a13b3fb836e9ada", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29705, "timestamp_epoch": "1583963188.869367000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-2ee5ac5ed38b75366e401269", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29706, "timestamp_epoch": "1583963188.869578000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-f2bdbf6687f5844da626608d", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29707, "timestamp_epoch": "1583963188.869779000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-525b915210c59ee2eb02aa6f", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29708, "timestamp_epoch": "1583963188.870021000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-aa457258637c920198b37c12", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29709, "timestamp_epoch": "1583963188.870495000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a", "samr.samr_UserInfo21.full_name": "Dominga McDowell", "samr.samr_UserInfo21.account_name": "dominga.mcdowell" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-90495d23cb0e9694782cb4b7", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29710, "timestamp_epoch": "1583963188.870712000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-7b0dd68f67170da33d053170", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29711, "timestamp_epoch": "1583963188.871225000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-0e985ee674a022d9110a487e", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29712, "timestamp_epoch": "1583963188.871488000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-be1cfb3eaabdcdc67d59e6d8", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29713, "timestamp_epoch": "1583963188.871852000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-03d3ade3bfd2e0999939f804", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29714, "timestamp_epoch": "1583963188.872026000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-6278bbb50907e2c1bf0df69d", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29715, "timestamp_epoch": "1583963188.872693000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-cc655f1efd8ad8b42a578d14", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29716, "timestamp_epoch": "1583963188.872888000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-b7458ab0f70766aa5cdf5f67", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29717, "timestamp_epoch": "1583963188.873878000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-e686bf7a8fd7c88c51c730e9", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29718, "timestamp_epoch": "1583963188.874046000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-a6859badee434843352c973c", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29719, "timestamp_epoch": "1583963188.874966000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-06a416c7d94f136af3ab3ab0", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29720, "timestamp_epoch": "1583963188.875159000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-a905a74f49f9e79417dc4cd4", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29721, "timestamp_epoch": "1583963188.875424000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-1380ce9991c7a51bf6487d4c", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29722, "timestamp_epoch": "1583963188.875620000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-3a74c9f3a94945a408bd4699", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29723, "timestamp_epoch": "1583963188.876053000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-983eb7c10cb1fd68f80484fb", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29724, "timestamp_epoch": "1583963188.876260000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-ab550f1f2b9922973f1436dd", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29725, "timestamp_epoch": "1583963188.876603000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-1aa96695f8ec5ace6e4467d7", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29726, "timestamp_epoch": "1583963188.876823000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-bf77a60246cd28f4b9c5165a", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29727, "timestamp_epoch": "1583963188.877155000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-fc191c38cfae37c65ec6f7ce", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29728, "timestamp_epoch": "1583963188.877367000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-479bf40bbdfe0da04ec9b6f3", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29729, "timestamp_epoch": "1583963188.877658000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-db4ae0d340b56ecb0905a8fa", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29730, "timestamp_epoch": "1583963188.877833000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-20ec4b298dc79055f7842ab9", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29731, "timestamp_epoch": "1583963188.878116000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-93224f3a863becbaaab3569d", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29732, "timestamp_epoch": "1583963188.878316000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-84c4d56d10284ea5b40cfbf4", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29733, "timestamp_epoch": "1583963188.878697000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-0115d68b581bfd59d5bbe6ef", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29734, "timestamp_epoch": "1583963188.878860000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-506793e95e2dec4cd5f808ac", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29735, "timestamp_epoch": "1583963188.879148000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-c47c2a1230b4d885dd08b654", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29736, "timestamp_epoch": "1583963188.879361000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-e38a53828330ecc9ea7d65f1", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29737, "timestamp_epoch": "1583963188.879654000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-262de577b86e3828d6d65641", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29738, "timestamp_epoch": "1583963188.879846000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-111d34a4065696c8f71216de", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29739, "timestamp_epoch": "1583963188.880181000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-eab6b72f4bc5d7d5879f21da", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29740, "timestamp_epoch": "1583963188.880449000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:1d:60:b5:5e:94", "browser.server": "LAPTOP-I9ZPI04" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-76daec9535b2e982a11c9a0c", "src_port": null, "tcp_stream": null, "udp_stream": 23, "frame_number": 29742, "timestamp_epoch": "1583963193.251123000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-83ebe2fdf48b6315d1289588", "src_port": null, "tcp_stream": 83, "udp_stream": null, "frame_number": 29745, "timestamp_epoch": "1583963199.542137000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-589509c66cbb47b269dc5b6b", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29746, "timestamp_epoch": "1583963199.542262000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-a1f71a04104b78b4518191e0", "src_port": null, "tcp_stream": 83, "udp_stream": null, "frame_number": 29747, "timestamp_epoch": "1583963199.542395000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-8e256690d3c6c19871bd1a3c", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29748, "timestamp_epoch": "1583963199.542437000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-b31f02fc411107eda802938a", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29749, "timestamp_epoch": "1583963199.542592000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-7b4799c202572f21ad1c415b", "src_port": null, "tcp_stream": 83, "udp_stream": null, "frame_number": 29750, "timestamp_epoch": "1583963199.542633000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-49edc4070b871846c3fe0d47", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29751, "timestamp_epoch": "1583963199.542796000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-3bcb3632c5e43ac6f5a413c4", "src_port": null, "tcp_stream": 83, "udp_stream": null, "frame_number": 29752, "timestamp_epoch": "1583963199.542841000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-be50c34170c4e420195a1cca", "src_port": null, "tcp_stream": 645, "udp_stream": null, "frame_number": 29761, "timestamp_epoch": "1583963206.445458000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-4d1d09e92aeb4871fb384be2", "src_port": null, "tcp_stream": 645, "udp_stream": null, "frame_number": 29762, "timestamp_epoch": "1583963206.445617000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-d3ae3529f319f94304e3b5ca", "src_port": null, "tcp_stream": 645, "udp_stream": null, "frame_number": 29763, "timestamp_epoch": "1583963206.446008000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc", "kerberos.msg_type": "12,14" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-ed8e63e44d8196686b32b059", "src_port": null, "tcp_stream": 646, "udp_stream": null, "frame_number": 29768, "timestamp_epoch": "1583963206.447580000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "dorian.neff" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-daafc08a11ed471f5377863f", "src_port": null, "tcp_stream": 646, "udp_stream": null, "frame_number": 29771, "timestamp_epoch": "1583963206.448708000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc", "kerberos.msg_type": "14" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-1fc17fd576e5af22f98dedd9", "src_port": null, "tcp_stream": 645, "udp_stream": null, "frame_number": 29778, "timestamp_epoch": "1583963206.449846000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-a71d98bacca861d0ea072c8d", "src_port": null, "tcp_stream": 645, "udp_stream": null, "frame_number": 29780, "timestamp_epoch": "1583963206.452093000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-873d1d407f339599a797cc1b", "src_port": null, "tcp_stream": 645, "udp_stream": null, "frame_number": 29781, "timestamp_epoch": "1583963206.452791000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-f60c7ec2e910fed1c0a564ce", "src_port": null, "tcp_stream": 645, "udp_stream": null, "frame_number": 29782, "timestamp_epoch": "1583963206.453031000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-621d717c8478440c121c52f7", "src_port": null, "tcp_stream": 645, "udp_stream": null, "frame_number": 29783, "timestamp_epoch": "1583963206.453410000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-4ae08f5d9be52cb0a3aaf311", "src_port": null, "tcp_stream": 645, "udp_stream": null, "frame_number": 29784, "timestamp_epoch": "1583963206.453559000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-82690715909cee085cdd0d92", "src_port": null, "tcp_stream": 645, "udp_stream": null, "frame_number": 29785, "timestamp_epoch": "1583963206.454170000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-9b13e08fb4e6522c01bee168", "src_port": null, "tcp_stream": 645, "udp_stream": null, "frame_number": 29786, "timestamp_epoch": "1583963206.454524000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-2e369775c1b1ff16e96b995d", "src_port": null, "tcp_stream": 645, "udp_stream": null, "frame_number": 29787, "timestamp_epoch": "1583963206.454800000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-6d8a2656a70ce9cb3aa63029", "src_port": null, "tcp_stream": 645, "udp_stream": null, "frame_number": 29788, "timestamp_epoch": "1583963206.454997000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-5c059631b1e0cf8a218ba234", "src_port": null, "tcp_stream": 645, "udp_stream": null, "frame_number": 29789, "timestamp_epoch": "1583963206.455297000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-f59242b280031c29823256e9", "src_port": null, "tcp_stream": 645, "udp_stream": null, "frame_number": 29790, "timestamp_epoch": "1583963206.455503000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-8ad44b1cac8aae416b152442", "src_port": null, "tcp_stream": 645, "udp_stream": null, "frame_number": 29791, "timestamp_epoch": "1583963206.455709000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-f494ea102f89f4f0db7b903c", "src_port": null, "tcp_stream": 645, "udp_stream": null, "frame_number": 29792, "timestamp_epoch": "1583963206.455868000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-636e45b51b4ea5459c3e41b3", "src_port": null, "tcp_stream": 645, "udp_stream": null, "frame_number": 29793, "timestamp_epoch": "1583963206.456131000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-dd4ca26b19c464fb6b493044", "src_port": null, "tcp_stream": 645, "udp_stream": null, "frame_number": 29794, "timestamp_epoch": "1583963206.456536000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-e64810789f6aabf52a13347d", "src_port": null, "tcp_stream": 645, "udp_stream": null, "frame_number": 29795, "timestamp_epoch": "1583963206.456802000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-0251d05856013a823f3ce964", "src_port": null, "tcp_stream": 645, "udp_stream": null, "frame_number": 29796, "timestamp_epoch": "1583963206.457097000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-df6d4204a1cd01abb70d9c95", "src_port": null, "tcp_stream": 645, "udp_stream": null, "frame_number": 29797, "timestamp_epoch": "1583963206.457324000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-99677b82e47199767acc717b", "src_port": null, "tcp_stream": 645, "udp_stream": null, "frame_number": 29798, "timestamp_epoch": "1583963206.457652000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-0971cede93ffd083fa38bbea", "src_port": null, "tcp_stream": 645, "udp_stream": null, "frame_number": 29799, "timestamp_epoch": "1583963206.457906000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-9532c14bc8012062a7ce6472", "src_port": null, "tcp_stream": 645, "udp_stream": null, "frame_number": 29800, "timestamp_epoch": "1583963206.458267000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-bec86ce06752bf860f5b0edb", "src_port": null, "tcp_stream": 645, "udp_stream": null, "frame_number": 29801, "timestamp_epoch": "1583963206.459042000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-8bb65498500c864157576e8c", "src_port": null, "tcp_stream": 645, "udp_stream": null, "frame_number": 29802, "timestamp_epoch": "1583963206.459659000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-a2464dad70ab1fbce79abe27", "src_port": null, "tcp_stream": 645, "udp_stream": null, "frame_number": 29803, "timestamp_epoch": "1583963206.459967000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-6c961ad0012184401b5078ed", "src_port": null, "tcp_stream": 645, "udp_stream": null, "frame_number": 29804, "timestamp_epoch": "1583963206.460409000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-3a438a295edba0d0e0da12aa", "src_port": null, "tcp_stream": 645, "udp_stream": null, "frame_number": 29805, "timestamp_epoch": "1583963206.460639000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-faf79f22f71e16d6ab4211b7", "src_port": null, "tcp_stream": 645, "udp_stream": null, "frame_number": 29806, "timestamp_epoch": "1583963206.461323000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-9f5b8a8b5b843ad88071a5a2", "src_port": null, "tcp_stream": 645, "udp_stream": null, "frame_number": 29807, "timestamp_epoch": "1583963206.461629000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a", "samr.samr_UserInfo21.full_name": "Dorian Neff", "samr.samr_UserInfo21.account_name": "dorian.neff" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-623fd994ed469169350ad5bd", "src_port": null, "tcp_stream": 645, "udp_stream": null, "frame_number": 29808, "timestamp_epoch": "1583963206.462085000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-788e935e513cd9eea7430bed", "src_port": null, "tcp_stream": 645, "udp_stream": null, "frame_number": 29809, "timestamp_epoch": "1583963206.462320000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-6370488d0ebe7a9ed7d42dd0", "src_port": null, "tcp_stream": 645, "udp_stream": null, "frame_number": 29810, "timestamp_epoch": "1583963206.462709000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-1931d818677ce048ae919a81", "src_port": null, "tcp_stream": 645, "udp_stream": null, "frame_number": 29811, "timestamp_epoch": "1583963206.463010000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-45f5050cec011b04ab3ee912", "src_port": null, "tcp_stream": 645, "udp_stream": null, "frame_number": 29812, "timestamp_epoch": "1583963206.463362000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-e83b17a3b89897ec89a4b20a", "src_port": null, "tcp_stream": 645, "udp_stream": null, "frame_number": 29813, "timestamp_epoch": "1583963206.463679000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-63d1c0e4a9b8636a67f93211", "src_port": null, "tcp_stream": 645, "udp_stream": null, "frame_number": 29814, "timestamp_epoch": "1583963206.464161000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-378a1a7b602d7a849b79bd22", "src_port": null, "tcp_stream": 645, "udp_stream": null, "frame_number": 29815, "timestamp_epoch": "1583963206.464388000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-765c9361b98c1bcbdcb16937", "src_port": null, "tcp_stream": 645, "udp_stream": null, "frame_number": 29816, "timestamp_epoch": "1583963206.464665000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-2df894ed3056c57fa8b1366d", "src_port": null, "tcp_stream": 645, "udp_stream": null, "frame_number": 29817, "timestamp_epoch": "1583963206.464948000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-d2dbb5f14c51248fbaa6326b", "src_port": null, "tcp_stream": 645, "udp_stream": null, "frame_number": 29818, "timestamp_epoch": "1583963206.465225000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-aed11a8dd1202898bd4615d7", "src_port": null, "tcp_stream": 645, "udp_stream": null, "frame_number": 29819, "timestamp_epoch": "1583963206.465420000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-acfc5ae9b88731f418f71422", "src_port": null, "tcp_stream": 645, "udp_stream": null, "frame_number": 29820, "timestamp_epoch": "1583963206.465683000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-60354e1797fff268e336208e", "src_port": null, "tcp_stream": 645, "udp_stream": null, "frame_number": 29821, "timestamp_epoch": "1583963206.466088000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-eb78c5f3d16967f0ad9f0771", "src_port": null, "tcp_stream": 645, "udp_stream": null, "frame_number": 29822, "timestamp_epoch": "1583963206.466415000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-d16c2b5fe3cd9d6d013cd11c", "src_port": null, "tcp_stream": 645, "udp_stream": null, "frame_number": 29823, "timestamp_epoch": "1583963206.467136000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-1d094331f1018dff61e69dcf", "src_port": null, "tcp_stream": 645, "udp_stream": null, "frame_number": 29824, "timestamp_epoch": "1583963206.467307000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-9acc8aa47de191e597a208cf", "src_port": null, "tcp_stream": 182, "udp_stream": null, "frame_number": 29826, "timestamp_epoch": "1583963217.168554000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-76087c13f79dc95273f413f3", "src_port": null, "tcp_stream": 645, "udp_stream": null, "frame_number": 29827, "timestamp_epoch": "1583963217.168694000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-c59eaa3cf9e3a3494b0391b5", "src_port": null, "tcp_stream": 182, "udp_stream": null, "frame_number": 29828, "timestamp_epoch": "1583963217.168743000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-774b3bfe5b4e2bc8dfdb90fc", "src_port": null, "tcp_stream": 645, "udp_stream": null, "frame_number": 29829, "timestamp_epoch": "1583963217.168833000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-94d3d71bdc14fb3d6eec9aee", "src_port": null, "tcp_stream": 645, "udp_stream": null, "frame_number": 29830, "timestamp_epoch": "1583963217.168938000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-6a31286d4458bf704e249477", "src_port": null, "tcp_stream": 182, "udp_stream": null, "frame_number": 29831, "timestamp_epoch": "1583963217.168981000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-ce2e41e66137b8b62e1a0d49", "src_port": null, "tcp_stream": 645, "udp_stream": null, "frame_number": 29832, "timestamp_epoch": "1583963217.169113000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-af09b438eb3d3336e0715efa", "src_port": null, "tcp_stream": 182, "udp_stream": null, "frame_number": 29833, "timestamp_epoch": "1583963217.169148000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "b8:ca:3a:ec:3b:8f", "browser.server": "LAPTOP-7XMV2SN" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-df54cecaf4bbbfc1ae90ea0f", "src_port": null, "tcp_stream": null, "udp_stream": 58, "frame_number": 29836, "timestamp_epoch": "1583963222.494585000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "10:98:36:59:9d:cc", "browser.server": "LAPTOP-SQSA42O" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-b771ed6ba328c9587c7cf39a", "src_port": null, "tcp_stream": null, "udp_stream": 109, "frame_number": 29839, "timestamp_epoch": "1583963250.959122000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-dab3be3ea054cc25ad063ec7", "src_port": null, "tcp_stream": 648, "udp_stream": null, "frame_number": 29877, "timestamp_epoch": "1583963555.998417000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-1f9bb147cd436b274f6e06eb", "src_port": null, "tcp_stream": 648, "udp_stream": null, "frame_number": 29878, "timestamp_epoch": "1583963555.998668000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-47fc48198041c4609cbac9a7", "src_port": null, "tcp_stream": 648, "udp_stream": null, "frame_number": 29879, "timestamp_epoch": "1583963555.998977000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94", "kerberos.msg_type": "14" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-35536f02a6e1303eaf039f72", "src_port": null, "tcp_stream": 648, "udp_stream": null, "frame_number": 29882, "timestamp_epoch": "1583963556.000109000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-143ba4e70a851abc0cda9d2c", "src_port": null, "tcp_stream": 648, "udp_stream": null, "frame_number": 29884, "timestamp_epoch": "1583963556.001987000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-0897ebba9c8920e6b4d5884f", "src_port": null, "tcp_stream": 648, "udp_stream": null, "frame_number": 29885, "timestamp_epoch": "1583963556.002644000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-2fa2b8812b514a6e1c39a8af", "src_port": null, "tcp_stream": 648, "udp_stream": null, "frame_number": 29886, "timestamp_epoch": "1583963556.002870000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-6a8d19ee4dce950a08f4bba9", "src_port": null, "tcp_stream": 648, "udp_stream": null, "frame_number": 29887, "timestamp_epoch": "1583963556.003105000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-d767a640bdc9f3067f2985ff", "src_port": null, "tcp_stream": 648, "udp_stream": null, "frame_number": 29888, "timestamp_epoch": "1583963556.003270000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-faca40422431192c7efcd840", "src_port": null, "tcp_stream": 648, "udp_stream": null, "frame_number": 29889, "timestamp_epoch": "1583963556.003293000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-f7b8a11abd4582beedaa66d2", "src_port": null, "tcp_stream": 648, "udp_stream": null, "frame_number": 29890, "timestamp_epoch": "1583963556.003589000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-b6b14f99e69d86065adb397e", "src_port": null, "tcp_stream": 648, "udp_stream": null, "frame_number": 29892, "timestamp_epoch": "1583963566.941353000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-79710df736460d65b8816484", "src_port": null, "tcp_stream": 648, "udp_stream": null, "frame_number": 29893, "timestamp_epoch": "1583963566.941549000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:1d:60:b5:5e:94" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-f940e696f9540047bdbbf886", "src_port": null, "tcp_stream": 648, "udp_stream": null, "frame_number": 29894, "timestamp_epoch": "1583963566.941770000" }, { "kind": "identity", "dst_ip": "10.3.11.218", "fields": { "eth.dst": "00:1d:60:b5:5e:94", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-2a5ada7778b194ef062912e7", "src_port": null, "tcp_stream": 648, "udp_stream": null, "frame_number": 29895, "timestamp_epoch": "1583963566.941942000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-4ffe51c9fa708ebec6caf9d4", "src_port": null, "tcp_stream": 650, "udp_stream": null, "frame_number": 29925, "timestamp_epoch": "1583963581.623811000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-9a5fd8e8e6c97b362e734a1a", "src_port": null, "tcp_stream": 650, "udp_stream": null, "frame_number": 29926, "timestamp_epoch": "1583963581.624129000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-7d16d9217ecf99ec123c8536", "src_port": null, "tcp_stream": 650, "udp_stream": null, "frame_number": 29927, "timestamp_epoch": "1583963581.624476000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f", "kerberos.msg_type": "14" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-feefcdb71915352b2fa8530d", "src_port": null, "tcp_stream": 650, "udp_stream": null, "frame_number": 29930, "timestamp_epoch": "1583963581.625626000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-b43156f78fd193a842bfad38", "src_port": null, "tcp_stream": 650, "udp_stream": null, "frame_number": 29932, "timestamp_epoch": "1583963581.627291000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-3b7e26304cea06b60dd18951", "src_port": null, "tcp_stream": 650, "udp_stream": null, "frame_number": 29933, "timestamp_epoch": "1583963581.627902000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-c7b4b0ac40529e31da39de6b", "src_port": null, "tcp_stream": 650, "udp_stream": null, "frame_number": 29934, "timestamp_epoch": "1583963581.628152000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-d09bd2fe012d25c868e69f5e", "src_port": null, "tcp_stream": 650, "udp_stream": null, "frame_number": 29935, "timestamp_epoch": "1583963581.628429000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-271507c9353ab86818969551", "src_port": null, "tcp_stream": 650, "udp_stream": null, "frame_number": 29936, "timestamp_epoch": "1583963581.628645000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-d980f80ba0e8cf12d60ef144", "src_port": null, "tcp_stream": 650, "udp_stream": null, "frame_number": 29937, "timestamp_epoch": "1583963581.628778000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-304733d0f76fb5da7d55dadd", "src_port": null, "tcp_stream": 650, "udp_stream": null, "frame_number": 29938, "timestamp_epoch": "1583963581.629168000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-7260ea9b8df32c301c4105d1", "src_port": null, "tcp_stream": 650, "udp_stream": null, "frame_number": 29940, "timestamp_epoch": "1583963581.651080000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-a842394afe49ffd4181b120d", "src_port": null, "tcp_stream": 650, "udp_stream": null, "frame_number": 29941, "timestamp_epoch": "1583963581.651307000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-2ba4455b6774dc659c590916", "src_port": null, "tcp_stream": 650, "udp_stream": null, "frame_number": 29943, "timestamp_epoch": "1583963592.431494000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-8049e03be207f73ccb70429d", "src_port": null, "tcp_stream": 650, "udp_stream": null, "frame_number": 29944, "timestamp_epoch": "1583963592.431669000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "b8:ca:3a:ec:3b:8f" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-97a83c0d7f4d7da136271cf7", "src_port": null, "tcp_stream": 650, "udp_stream": null, "frame_number": 29945, "timestamp_epoch": "1583963592.431928000" }, { "kind": "identity", "dst_ip": "10.3.11.194", "fields": { "eth.dst": "b8:ca:3a:ec:3b:8f", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-67d0b6fe205f351e888121c0", "src_port": null, "tcp_stream": 650, "udp_stream": null, "frame_number": 29946, "timestamp_epoch": "1583963592.432135000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-4ca1a5155e8ff418cabc6414", "src_port": null, "tcp_stream": 651, "udp_stream": null, "frame_number": 29960, "timestamp_epoch": "1583963613.609939000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-5478ce3c5c1d4bd9c245d5bb", "src_port": null, "tcp_stream": 651, "udp_stream": null, "frame_number": 29961, "timestamp_epoch": "1583963613.610219000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-46e21a9c7847bb761ad2f6a4", "src_port": null, "tcp_stream": 651, "udp_stream": null, "frame_number": 29962, "timestamp_epoch": "1583963613.610547000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc", "kerberos.msg_type": "14" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-af6a25bc603fc9616397ffde", "src_port": null, "tcp_stream": 651, "udp_stream": null, "frame_number": 29965, "timestamp_epoch": "1583963613.611715000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-9d2ef289f60d288a2180ca7f", "src_port": null, "tcp_stream": 651, "udp_stream": null, "frame_number": 29967, "timestamp_epoch": "1583963613.613478000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-d93936c775aadbd78685c8ea", "src_port": null, "tcp_stream": 651, "udp_stream": null, "frame_number": 29968, "timestamp_epoch": "1583963613.613986000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-b55032b9882fa2419c586fc8", "src_port": null, "tcp_stream": 651, "udp_stream": null, "frame_number": 29969, "timestamp_epoch": "1583963613.614188000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-147b6f628fa262b62449ba0a", "src_port": null, "tcp_stream": 651, "udp_stream": null, "frame_number": 29970, "timestamp_epoch": "1583963613.614469000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-50b1aa8612662792881f74a6", "src_port": null, "tcp_stream": 651, "udp_stream": null, "frame_number": 29971, "timestamp_epoch": "1583963613.614593000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-50316bf20a9dd9a962461c4a", "src_port": null, "tcp_stream": 651, "udp_stream": null, "frame_number": 29973, "timestamp_epoch": "1583963613.614790000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-28678fa0b2b726dfd2d10d89", "src_port": null, "tcp_stream": 651, "udp_stream": null, "frame_number": 29974, "timestamp_epoch": "1583963613.614986000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-30cf1367b25d4ce5db2cb8ae", "src_port": null, "tcp_stream": 651, "udp_stream": null, "frame_number": 29976, "timestamp_epoch": "1583963624.476419000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-8060028c34f48010cbceb760", "src_port": null, "tcp_stream": 651, "udp_stream": null, "frame_number": 29977, "timestamp_epoch": "1583963624.476595000" }, { "kind": "identity", "dst_ip": "10.3.11.3", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "10:98:36:59:9d:cc" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-19300ef41358da20598da6f1", "src_port": null, "tcp_stream": 651, "udp_stream": null, "frame_number": 29978, "timestamp_epoch": "1583963624.476780000" }, { "kind": "identity", "dst_ip": "10.3.11.119", "fields": { "eth.dst": "10:98:36:59:9d:cc", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-da62571ba770c6ace9f4855e", "src_port": null, "tcp_stream": 651, "udp_stream": null, "frame_number": 29979, "timestamp_epoch": "1583963624.476960000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:1d:60:b5:5e:94", "browser.server": "LAPTOP-I9ZPI04" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-e8ff631881c863a98514ae07", "src_port": null, "tcp_stream": null, "udp_stream": 23, "frame_number": 30098, "timestamp_epoch": "1583963914.379710000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "b8:ca:3a:ec:3b:8f", "browser.server": "LAPTOP-7XMV2SN" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-8ad69691823bdb10847c559e", "src_port": null, "tcp_stream": null, "udp_stream": 58, "frame_number": 30099, "timestamp_epoch": "1583963944.745383000" }, { "kind": "identity", "dst_ip": "10.3.11.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "10:98:36:59:9d:cc", "browser.server": "LAPTOP-SQSA42O" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-4570a9eff53e2cbdf2c6595f", "src_port": null, "tcp_stream": null, "udp_stream": 109, "frame_number": 30104, "timestamp_epoch": "1583963972.840860000" } ], "http_request": [ { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-b7ab529c781af79b78587488", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 516, "timestamp_epoch": "1583961757.053472000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-eaefc3e15ee44f0a596f7b9d", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 518, "timestamp_epoch": "1583961757.141829000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-d9913d5f595de73526adec40", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 521, "timestamp_epoch": "1583961757.317110000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-bea2d598ae4da9406838e951", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 522, "timestamp_epoch": "1583961757.339046000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-ddffd9c329df5ad5bac9af8b", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 523, "timestamp_epoch": "1583961757.467307000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-b1a48a75cf0816a347298025", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 806, "timestamp_epoch": "1583961760.039998000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-f33d30c729b22099ae4a6fe3", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 827, "timestamp_epoch": "1583961760.150356000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-bbae79bc68c7fa52c3d9ffbb", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 832, "timestamp_epoch": "1583961760.353574000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-ae8aafbafeba20bad3dd3cb6", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 851, "timestamp_epoch": "1583961760.385437000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-51b8c138b8a24a41d193429f", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 865, "timestamp_epoch": "1583961760.462907000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-ad489ac8d253832fbe3fbcf4", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 936, "timestamp_epoch": "1583961763.041172000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-c247fd62efdb61cbefa93145", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 937, "timestamp_epoch": "1583961763.150914000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-2dda2e774474099edb4182ac", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 938, "timestamp_epoch": "1583961763.478458000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-b36c0336ff419c01fba2d832", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 1018, "timestamp_epoch": "1583961766.496768000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-3630d801c507fb7dee2d6257", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 1047, "timestamp_epoch": "1583961769.510883000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-f882e33b1efbaf9265d8e2b9", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 1048, "timestamp_epoch": "1583961772.526214000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.user_agent": "Microsoft Edge/80.0.361.66 Windows", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-ab8aaabe008899448776d424", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 4311, "timestamp_epoch": "1583961851.807484000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.user_agent": "Microsoft Edge/80.0.361.66 Windows", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-e9b9046dc041da50ee50192b", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 4314, "timestamp_epoch": "1583961852.809426000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.user_agent": "Microsoft Edge/80.0.361.66 Windows", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-e2333ccb9c1f0b2352a37c3d", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 4331, "timestamp_epoch": "1583961853.810540000" }, { "kind": "http_request", "dst_ip": "72.167.191.69", "fields": { "http.host": "www.tuscaloosabarnyard.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.132 Safari/537.36 Edg/80.0.361.66", "http.request.uri": "/", "http.response_in": "4381", "http.request.method": "GET", "http.request.full_uri": "http://www.tuscaloosabarnyard.com/" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-80acec86ce4d590cf7a3cc16", "src_port": 49743, "tcp_stream": 200, "udp_stream": null, "frame_number": 4366, "timestamp_epoch": "1583961854.645117000" }, { "kind": "http_request", "dst_ip": "72.167.191.69", "fields": { "http.host": "www.tuscaloosabarnyard.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.132 Safari/537.36 Edg/80.0.361.66", "http.request.uri": "/site.css?v=", "http.response_in": "4453", "http.request.method": "GET", "http.request.full_uri": "http://www.tuscaloosabarnyard.com/site.css?v=" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-aa30e57e6297a6d3f46b8ae9", "src_port": 49743, "tcp_stream": 200, "udp_stream": null, "frame_number": 4398, "timestamp_epoch": "1583961854.770626000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.user_agent": "Microsoft Edge/80.0.361.66 Windows", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-0c833ee1f5bfc661682af8a7", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 4427, "timestamp_epoch": "1583961854.810945000" }, { "kind": "http_request", "dst_ip": "216.58.194.42", "fields": { "http.host": "fonts.googleapis.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.132 Safari/537.36 Edg/80.0.361.66", "http.request.uri": "/css?family=Fredericka+the+Great|Allura|Amatic+SC|Arizonia|Averia+Sans+Libre|Cabin+Sketch|Francois+One|Jacques+Francois+Shadow|Josefin+Slab|Kaushan+Script|Love+Ya+Like+A+Sister|Merriweather|Offside|Open+Sans|Open+Sans+Condensed|Oswald|Over+the+Rainbow|Pacifico|Romanesco|Sacramento|Seaweed+Script|Special+Elite", "http.response_in": "4490", "http.request.method": "GET", "http.request.full_uri": "http://fonts.googleapis.com/css?family=Fredericka+the+Great|Allura|Amatic+SC|Arizonia|Averia+Sans+Libre|Cabin+Sketch|Francois+One|Jacques+Francois+Shadow|Josefin+Slab|Kaushan+Script|Love+Ya+Like+A+Sister|Merriweather|Offside|Open+Sans|Open+Sans+Condensed|Oswald|Over+the+Rainbow|Pacifico|Romanesco|Sacramento|Seaweed+Script|Special+Elite" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-1479fceadb70320d040bd5ab", "src_port": 49748, "tcp_stream": 205, "udp_stream": null, "frame_number": 4433, "timestamp_epoch": "1583961854.835217000" }, { "kind": "http_request", "dst_ip": "216.58.194.42", "fields": { "http.host": "fonts.googleapis.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.132 Safari/537.36 Edg/80.0.361.66", "http.request.uri": "/css?family=News+Cycle|Bangers|Raleway:200", "http.response_in": "4496", "http.request.method": "GET", "http.request.full_uri": "http://fonts.googleapis.com/css?family=News+Cycle|Bangers|Raleway:200" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-a0f68228b6befd942a52f505", "src_port": 49749, "tcp_stream": 206, "udp_stream": null, "frame_number": 4439, "timestamp_epoch": "1583961854.840436000" }, { "kind": "http_request", "dst_ip": "23.211.18.27", "fields": { "http.host": "img1.wsimg.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.132 Safari/537.36 Edg/80.0.361.66", "http.request.uri": "/starfield/duel/v2.5.8/duel.js?appid=O3BkA5J1", "http.response_in": "4616", "http.request.method": "GET", "http.request.full_uri": "http://img1.wsimg.com/starfield/duel/v2.5.8/duel.js?appid=O3BkA5J1" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-a7fb6cd34aebc0050e65d8c9", "src_port": 49750, "tcp_stream": 207, "udp_stream": null, "frame_number": 4475, "timestamp_epoch": "1583961854.850635000" }, { "kind": "http_request", "dst_ip": "23.209.74.120", "fields": { "http.host": "nebula.wsimg.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.132 Safari/537.36 Edg/80.0.361.66", "http.request.uri": "/25a1c16c05755eb2ec17846b91efa5fe?AccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1", "http.response_in": "4522", "http.request.method": "GET", "http.request.full_uri": "http://nebula.wsimg.com/25a1c16c05755eb2ec17846b91efa5fe?AccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-5e92748e5428e9cc06663de1", "src_port": 49754, "tcp_stream": 211, "udp_stream": null, "frame_number": 4477, "timestamp_epoch": "1583961854.851083000" }, { "kind": "http_request", "dst_ip": "23.209.74.120", "fields": { "http.host": "nebula.wsimg.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.132 Safari/537.36 Edg/80.0.361.66", "http.request.uri": "/90d173a36db4dc5268be43fbed9cde77?AccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1", "http.response_in": "4512", "http.request.method": "GET", "http.request.full_uri": "http://nebula.wsimg.com/90d173a36db4dc5268be43fbed9cde77?AccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-96759f4ca63adef4ca414cb9", "src_port": 49753, "tcp_stream": 210, "udp_stream": null, "frame_number": 4481, "timestamp_epoch": "1583961854.851687000" }, { "kind": "http_request", "dst_ip": "72.246.84.150", "fields": { "http.host": "s7.addthis.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.132 Safari/537.36 Edg/80.0.361.66", "http.request.uri": "/js/300/addthis_widget.js", "http.response_in": "4568", "http.request.method": "GET", "http.request.full_uri": "http://s7.addthis.com/js/300/addthis_widget.js" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-1e73ded6c00596e06ad3c83c", "src_port": 49759, "tcp_stream": 216, "udp_stream": null, "frame_number": 4559, "timestamp_epoch": "1583961854.985134000" }, { "kind": "http_request", "dst_ip": "23.211.18.27", "fields": { "http.host": "img1.wsimg.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.132 Safari/537.36 Edg/80.0.361.66", "http.request.uri": "/tcc/tcc_l.combined.1.0.5.min.js", "http.response_in": "4679", "http.request.method": "GET", "http.request.full_uri": "http://img1.wsimg.com/tcc/tcc_l.combined.1.0.5.min.js" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-931d1b7c7f8f4d82cfeef56b", "src_port": 49750, "tcp_stream": 207, "udp_stream": null, "frame_number": 4638, "timestamp_epoch": "1583961855.179664000" }, { "kind": "http_request", "dst_ip": "23.209.74.120", "fields": { "http.host": "nebula.wsimg.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.132 Safari/537.36 Edg/80.0.361.66", "http.request.uri": "/1a4f5564116de9920433f700c2a9c20c?AccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1", "http.response_in": "4694", "http.request.method": "GET", "http.request.full_uri": "http://nebula.wsimg.com/1a4f5564116de9920433f700c2a9c20c?AccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-9977c67a2bd37b9b179610d5", "src_port": 49754, "tcp_stream": 211, "udp_stream": null, "frame_number": 4640, "timestamp_epoch": "1583961855.181740000" }, { "kind": "http_request", "dst_ip": "23.209.74.120", "fields": { "http.host": "nebula.wsimg.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.132 Safari/537.36 Edg/80.0.361.66", "http.request.uri": "/eea2577ebdcc219fe1962915e163ee72?AccessKeyId=531592D248B589D87A56&disposition=0&alloworigin=1", "http.response_in": "4693", "http.request.method": "GET", "http.request.full_uri": "http://nebula.wsimg.com/eea2577ebdcc219fe1962915e163ee72?AccessKeyId=531592D248B589D87A56&disposition=0&alloworigin=1" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-7eca349c939fe2ba8f189d97", "src_port": 49753, "tcp_stream": 210, "udp_stream": null, "frame_number": 4642, "timestamp_epoch": "1583961855.182260000" }, { "kind": "http_request", "dst_ip": "23.209.74.120", "fields": { "http.host": "nebula.wsimg.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.132 Safari/537.36 Edg/80.0.361.66", "http.request.uri": "/5e2ea9aae9a1ca943046a6868cb3002b?AccessKeyId=531592D248B589D87A56&alloworigin=1", "http.response_in": "4819", "http.request.method": "GET", "http.request.full_uri": "http://nebula.wsimg.com/5e2ea9aae9a1ca943046a6868cb3002b?AccessKeyId=531592D248B589D87A56&alloworigin=1" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-b06581038b9a4ea7492caac4", "src_port": 49753, "tcp_stream": 210, "udp_stream": null, "frame_number": 4815, "timestamp_epoch": "1583961855.664609000" }, { "kind": "http_request", "dst_ip": "216.58.194.131", "fields": { "http.host": "fonts.gstatic.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.132 Safari/537.36 Edg/80.0.361.66", "http.request.uri": "/s/opensans/v17/mem8YaGs126MiZpBA-UFVZ0b.woff2", "http.response_in": "4962", "http.request.method": "GET", "http.request.full_uri": "http://fonts.gstatic.com/s/opensans/v17/mem8YaGs126MiZpBA-UFVZ0b.woff2" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-f21f0d714f5ec1745481f458", "src_port": 49758, "tcp_stream": 215, "udp_stream": null, "frame_number": 4917, "timestamp_epoch": "1583961856.047515000" }, { "kind": "http_request", "dst_ip": "216.58.194.131", "fields": { "http.host": "fonts.gstatic.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.132 Safari/537.36 Edg/80.0.361.66", "http.request.uri": "/s/loveyalikeasister/v10/R70EjzUBlOqPeouhFDfR80-0FhOqJubN-BeL9Xxd.woff2", "http.response_in": "5056", "http.request.method": "GET", "http.request.full_uri": "http://fonts.gstatic.com/s/loveyalikeasister/v10/R70EjzUBlOqPeouhFDfR80-0FhOqJubN-BeL9Xxd.woff2" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-948d2d883640d4bb189af038", "src_port": 49763, "tcp_stream": 220, "udp_stream": null, "frame_number": 4956, "timestamp_epoch": "1583961856.075659000" }, { "kind": "http_request", "dst_ip": "216.58.194.131", "fields": { "http.host": "fonts.gstatic.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.132 Safari/537.36 Edg/80.0.361.66", "http.request.uri": "/s/averiasanslibre/v8/ga6XaxZG_G5OvCf_rt7FH3B6BHLMEdVOEoI.woff2", "http.response_in": "5029", "http.request.method": "GET", "http.request.full_uri": "http://fonts.gstatic.com/s/averiasanslibre/v8/ga6XaxZG_G5OvCf_rt7FH3B6BHLMEdVOEoI.woff2" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-b8aab31342597bb0e62d58a2", "src_port": 49765, "tcp_stream": 222, "udp_stream": null, "frame_number": 4958, "timestamp_epoch": "1583961856.075895000" }, { "kind": "http_request", "dst_ip": "216.58.194.131", "fields": { "http.host": "fonts.gstatic.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.132 Safari/537.36 Edg/80.0.361.66", "http.request.uri": "/s/bangers/v12/FeVQS0BTqb0h60ACH55Q2A.woff2", "http.response_in": "5088", "http.request.method": "GET", "http.request.full_uri": "http://fonts.gstatic.com/s/bangers/v12/FeVQS0BTqb0h60ACH55Q2A.woff2" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-bae33cc00cc891ebc86f0bbe", "src_port": 49758, "tcp_stream": 215, "udp_stream": null, "frame_number": 5062, "timestamp_epoch": "1583961856.177877000" }, { "kind": "http_request", "dst_ip": "216.58.194.131", "fields": { "http.host": "fonts.gstatic.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.132 Safari/537.36 Edg/80.0.361.66", "http.request.uri": "/s/newscycle/v16/CSR64z1Qlv-GDxkbKVQ_fOAKTQ.woff2", "http.response_in": "5123", "http.request.method": "GET", "http.request.full_uri": "http://fonts.gstatic.com/s/newscycle/v16/CSR64z1Qlv-GDxkbKVQ_fOAKTQ.woff2" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-c787589f71e091bcae980ea8", "src_port": 49765, "tcp_stream": 222, "udp_stream": null, "frame_number": 5065, "timestamp_epoch": "1583961856.201369000" }, { "kind": "http_request", "dst_ip": "216.58.194.131", "fields": { "http.host": "fonts.gstatic.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.132 Safari/537.36 Edg/80.0.361.66", "http.request.uri": "/s/amaticsc/v13/TUZyzwprpvBS1izr_vOECuSf.woff2", "http.response_in": "5141", "http.request.method": "GET", "http.request.full_uri": "http://fonts.gstatic.com/s/amaticsc/v13/TUZyzwprpvBS1izr_vOECuSf.woff2" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-8dbcb6ff7fe054c4c8162fc7", "src_port": 49763, "tcp_stream": 220, "udp_stream": null, "frame_number": 5066, "timestamp_epoch": "1583961856.201519000" }, { "kind": "http_request", "dst_ip": "216.58.194.131", "fields": { "http.host": "fonts.gstatic.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.132 Safari/537.36 Edg/80.0.361.66", "http.request.uri": "/s/kaushanscript/v8/vm8vdRfvXFLG3OLnsO15WYS5DG74wNI.woff2", "http.response_in": "5161", "http.request.method": "GET", "http.request.full_uri": "http://fonts.gstatic.com/s/kaushanscript/v8/vm8vdRfvXFLG3OLnsO15WYS5DG74wNI.woff2" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-7cd77ca3e3243e5d41967a44", "src_port": 49767, "tcp_stream": 224, "udp_stream": null, "frame_number": 5071, "timestamp_epoch": "1583961856.209888000" }, { "kind": "http_request", "dst_ip": "23.211.18.27", "fields": { "http.host": "img1.wsimg.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.132 Safari/537.36 Edg/80.0.361.66", "http.request.uri": "/wst/v7/WSB7_J_20200225_2323_DEP-18389_2679/v1/images/wsb-slideshow-arrows.png", "http.response_in": "5506", "http.request.method": "GET", "http.request.full_uri": "http://img1.wsimg.com/wst/v7/WSB7_J_20200225_2323_DEP-18389_2679/v1/images/wsb-slideshow-arrows.png" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-2983859b7326c5c2919068ae", "src_port": 49750, "tcp_stream": 207, "udp_stream": null, "frame_number": 5450, "timestamp_epoch": "1583961856.581467000" }, { "kind": "http_request", "dst_ip": "23.209.74.120", "fields": { "http.host": "nebula.wsimg.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.132 Safari/537.36 Edg/80.0.361.66", "http.request.uri": "/d0c5998dd42685ef31a2dbd195b7220e?AccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1", "http.response_in": "6059", "http.request.method": "GET", "http.request.full_uri": "http://nebula.wsimg.com/d0c5998dd42685ef31a2dbd195b7220e?AccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-3786a5285f35029a70200150", "src_port": 49753, "tcp_stream": 210, "udp_stream": null, "frame_number": 5452, "timestamp_epoch": "1583961856.581965000" }, { "kind": "http_request", "dst_ip": "23.211.18.27", "fields": { "http.host": "img4.wsimg.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.132 Safari/537.36 Edg/80.0.361.66", "http.request.uri": "/starfield/duel/v2.5.8/sf.core/sf.core.pkg.js", "http.response_in": "5791", "http.request.method": "GET", "http.request.full_uri": "http://img4.wsimg.com/starfield/duel/v2.5.8/sf.core/sf.core.pkg.js" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-7aa39322887c3eef2ecc5ba5", "src_port": 49774, "tcp_stream": 231, "udp_stream": null, "frame_number": 5551, "timestamp_epoch": "1583961856.605293000" }, { "kind": "http_request", "dst_ip": "23.211.18.27", "fields": { "http.host": "img2.wsimg.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.132 Safari/537.36 Edg/80.0.361.66", "http.request.uri": "/starfield/duel/v2.5.8/sf.core/app.css", "http.response_in": "5911", "http.request.method": "GET", "http.request.full_uri": "http://img2.wsimg.com/starfield/duel/v2.5.8/sf.core/app.css" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-902d95ce51cecbd684d56b87", "src_port": 49775, "tcp_stream": 232, "udp_stream": null, "frame_number": 5856, "timestamp_epoch": "1583961856.754926000" }, { "kind": "http_request", "dst_ip": "23.209.74.120", "fields": { "http.host": "nebula.wsimg.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.132 Safari/537.36 Edg/80.0.361.66", "http.request.uri": "/6e2b4120ae0b4dbcac9541ce80c5dd24?AccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1", "http.response_in": "7107", "http.request.method": "GET", "http.request.full_uri": "http://nebula.wsimg.com/6e2b4120ae0b4dbcac9541ce80c5dd24?AccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-39a929f000467e9fa5520419", "src_port": 49753, "tcp_stream": 210, "udp_stream": null, "frame_number": 6075, "timestamp_epoch": "1583961857.236308000" }, { "kind": "http_request", "dst_ip": "23.209.74.120", "fields": { "http.host": "nebula.wsimg.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.132 Safari/537.36 Edg/80.0.361.66", "http.request.uri": "/6843f2b90530e6ec9ea7f397b0375735?AccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1", "http.response_in": "6900", "http.request.method": "GET", "http.request.full_uri": "http://nebula.wsimg.com/6843f2b90530e6ec9ea7f397b0375735?AccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-10b220aad4f8ba7ce626735a", "src_port": 49754, "tcp_stream": 211, "udp_stream": null, "frame_number": 6077, "timestamp_epoch": "1583961857.236854000" }, { "kind": "http_request", "dst_ip": "72.21.91.66", "fields": { "http.host": "platform.twitter.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.132 Safari/537.36 Edg/80.0.361.66", "http.request.uri": "/widgets.js", "http.response_in": "6254", "http.request.method": "GET", "http.request.full_uri": "http://platform.twitter.com/widgets.js" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-ed16069689c4a5f98d950008", "src_port": 49780, "tcp_stream": 237, "udp_stream": null, "frame_number": 6154, "timestamp_epoch": "1583961857.286196000" }, { "kind": "http_request", "dst_ip": "23.209.74.120", "fields": { "http.host": "nebula.wsimg.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.132 Safari/537.36 Edg/80.0.361.66", "http.request.uri": "/98b20fd6aed4cfc29e428d4dd8e00930?AccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1", "http.response_in": "6580", "http.request.method": "GET", "http.request.full_uri": "http://nebula.wsimg.com/98b20fd6aed4cfc29e428d4dd8e00930?AccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-4be0b2fe31db9d2f007f43fe", "src_port": 49781, "tcp_stream": 238, "udp_stream": null, "frame_number": 6156, "timestamp_epoch": "1583961857.286384000" }, { "kind": "http_request", "dst_ip": "23.209.74.120", "fields": { "http.host": "nebula.wsimg.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.132 Safari/537.36 Edg/80.0.361.66", "http.request.uri": "/18385e97e118628cd32e2d0c189f6eee?AccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1", "http.response_in": "6945", "http.request.method": "GET", "http.request.full_uri": "http://nebula.wsimg.com/18385e97e118628cd32e2d0c189f6eee?AccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-128c1a81bcdc79f2d2de2602", "src_port": 49782, "tcp_stream": 239, "udp_stream": null, "frame_number": 6158, "timestamp_epoch": "1583961857.286584000" }, { "kind": "http_request", "dst_ip": "23.206.208.173", "fields": { "http.host": "img.secureserver.net", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.132 Safari/537.36 Edg/80.0.361.66", "http.request.uri": "/t/1/tl/event?cts=1583961855884&ap=WSBv7&ds=1000&tce=1583961854653&tcs=1583961854581&tdc=1583961859120&tdclee=1583961855914&tdcles=1583961855886&tdi=1583961855886&tdl=1583961854740&tdle=1583961854581&tdls=1583961854506&tfs=1583961851561&tns=1583961851537&trqs=1583961854653&tre=1583961854727&trps=1583961854719&tles=1583961859120&tlee=1583961859184&dh=www.tuscaloosabarnyard.com&dp=%2F&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F80.0.3987.132%20Safari%2F537.36%20Edg%2F80.0.361.66&feedtype=perf&z=649269160", "http.response_in": "7650", "http.request.method": "GET", "http.request.full_uri": "http://img.secureserver.net/t/1/tl/event?cts=1583961855884&ap=WSBv7&ds=1000&tce=1583961854653&tcs=1583961854581&tdc=1583961859120&tdclee=1583961855914&tdcles=1583961855886&tdi=1583961855886&tdl=1583961854740&tdle=1583961854581&tdls=1583961854506&tfs=1583961851561&tns=1583961851537&trqs=1583961854653&tre=1583961854727&trps=1583961854719&tles=1583961859120&tlee=1583961859184&dh=www.tuscaloosabarnyard.com&dp=%2F&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F80.0.3987.132%20Safari%2F537.36%20Edg%2F80.0.361.66&feedtype=perf&z=649269160" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-000122a6445242568ab125f5", "src_port": 49790, "tcp_stream": 247, "udp_stream": null, "frame_number": 7633, "timestamp_epoch": "1583961859.275730000" }, { "kind": "http_request", "dst_ip": "72.167.191.69", "fields": { "http.host": "www.tuscaloosabarnyard.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.132 Safari/537.36 Edg/80.0.361.66", "http.request.uri": "/favicon.ico", "http.response_in": "7679", "http.request.method": "GET", "http.request.full_uri": "http://www.tuscaloosabarnyard.com/favicon.ico" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-21639a5947fa76507f0f004b", "src_port": 49743, "tcp_stream": 200, "udp_stream": null, "frame_number": 7675, "timestamp_epoch": "1583961859.573307000" }, { "kind": "http_request", "dst_ip": "23.209.74.120", "fields": { "http.host": "nebula.wsimg.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.132 Safari/537.36 Edg/80.0.361.66", "http.request.uri": "/c92f917c785f8c03f78b627d46aa8dc2?AccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1", "http.response_in": "8022", "http.request.method": "GET", "http.request.full_uri": "http://nebula.wsimg.com/c92f917c785f8c03f78b627d46aa8dc2?AccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-3a5a138bef598d447d34cb71", "src_port": 49753, "tcp_stream": 210, "udp_stream": null, "frame_number": 7726, "timestamp_epoch": "1583961864.845032000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-bdb7b62330e90d0181620001", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 8024, "timestamp_epoch": "1583961865.380057000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-fd375ee237dfc95407837d8b", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 8025, "timestamp_epoch": "1583961865.385055000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-6d32bc8415d91dcd1f9891ab", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 8026, "timestamp_epoch": "1583961865.590651000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-871607f38202187ddd79e6c1", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 8029, "timestamp_epoch": "1583961868.389812000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-0b6f2f5d9579d10217c3c785", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 8030, "timestamp_epoch": "1583961868.390271000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-14352f5521fcd73d3a2bce1e", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 8031, "timestamp_epoch": "1583961868.590856000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-0f3d6b8c08a767e6f41b078d", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 8165, "timestamp_epoch": "1583961871.391236000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-100f6b77e9dcae96cb3f95ff", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 8166, "timestamp_epoch": "1583961871.391708000" }, { "kind": "http_request", "dst_ip": "23.209.74.120", "fields": { "http.host": "nebula.wsimg.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.132 Safari/537.36 Edg/80.0.361.66", "http.request.uri": "/893e2501ed5504c59ddf5b5352855b87?AccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1", "http.response_in": "8538", "http.request.method": "GET", "http.request.full_uri": "http://nebula.wsimg.com/893e2501ed5504c59ddf5b5352855b87?AccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-01375f0ed6f725f002a2b658", "src_port": 49753, "tcp_stream": 210, "udp_stream": null, "frame_number": 8195, "timestamp_epoch": "1583961872.460195000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-32e7cc19a8057586c438b1a7", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 8610, "timestamp_epoch": "1583961876.239335000" }, { "kind": "http_request", "dst_ip": "50.87.248.17", "fields": { "http.host": "bolton-tech.com", "http.user_agent": "Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)", "http.request.uri": "/YAS20.exe", "http.response_in": "8998", "http.request.method": "GET", "http.request.full_uri": "http://bolton-tech.com/YAS20.exe" }, "src_ip": "10.3.11.194", "dst_port": 80, "event_id": "evt-59fde02db0707e83331742b6", "src_port": 49727, "tcp_stream": 259, "udp_stream": null, "frame_number": 8616, "timestamp_epoch": "1583961876.516400000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-9c8dd4c567b315d5f2e18d11", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 9002, "timestamp_epoch": "1583961879.231321000" }, { "kind": "http_request", "dst_ip": "23.209.74.120", "fields": { "http.host": "nebula.wsimg.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.132 Safari/537.36 Edg/80.0.361.66", "http.request.uri": "/3f2de843c79e006d37fb2ff42ab0d18c?AccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1", "http.response_in": "9409", "http.request.method": "GET", "http.request.full_uri": "http://nebula.wsimg.com/3f2de843c79e006d37fb2ff42ab0d18c?AccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-9b882481f7d0517f03d986b4", "src_port": 49753, "tcp_stream": 210, "udp_stream": null, "frame_number": 9006, "timestamp_epoch": "1583961880.076800000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-29964452ac9b6b3a3e7b58e7", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 9356, "timestamp_epoch": "1583961882.246396000" }, { "kind": "http_request", "dst_ip": "23.209.74.120", "fields": { "http.host": "nebula.wsimg.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.132 Safari/537.36 Edg/80.0.361.66", "http.request.uri": "/21eea24a60f7c8fb7ed4dcca63aca4f5?AccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1", "http.response_in": "9736", "http.request.method": "GET", "http.request.full_uri": "http://nebula.wsimg.com/21eea24a60f7c8fb7ed4dcca63aca4f5?AccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-581666c54c7359d2be04092e", "src_port": 49753, "tcp_stream": 210, "udp_stream": null, "frame_number": 9419, "timestamp_epoch": "1583961887.693830000" }, { "kind": "http_request", "dst_ip": "23.209.74.120", "fields": { "http.host": "nebula.wsimg.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.132 Safari/537.36 Edg/80.0.361.66", "http.request.uri": "/2b8f0431afda995f993087c8ec231ddf?AccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1", "http.response_in": "10146", "http.request.method": "GET", "http.request.full_uri": "http://nebula.wsimg.com/2b8f0431afda995f993087c8ec231ddf?AccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-c83fe85ed5c00d4f0ac837c0", "src_port": 49753, "tcp_stream": 210, "udp_stream": null, "frame_number": 9821, "timestamp_epoch": "1583961895.296505000" }, { "kind": "http_request", "dst_ip": "8.253.164.248", "fields": { "http.host": "ctldl.windowsupdate.com", "http.user_agent": "Microsoft-CryptoAPI/10.0", "http.request.uri": "/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?5674bbec2b11449f", "http.response_in": "10331", "http.request.method": "GET", "http.request.full_uri": "http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?5674bbec2b11449f" }, "src_ip": "10.3.11.218", "dst_port": 80, "event_id": "evt-7c6d5c2b85dc600af1b96139", "src_port": 49756, "tcp_stream": 268, "udp_stream": null, "frame_number": 10329, "timestamp_epoch": "1583961934.226577000" }, { "kind": "http_request", "dst_ip": "8.253.164.248", "fields": { "http.host": "ctldl.windowsupdate.com", "http.user_agent": "Microsoft-CryptoAPI/10.0", "http.request.uri": "/msdownload/update/v3/static/trustedr/en/pinrulesstl.cab?f0500d790de01784", "http.response_in": "10334", "http.request.method": "GET", "http.request.full_uri": "http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/pinrulesstl.cab?f0500d790de01784" }, "src_ip": "10.3.11.218", "dst_port": 80, "event_id": "evt-20c6096b5accb95cc4a978f3", "src_port": 49756, "tcp_stream": 268, "udp_stream": null, "frame_number": 10332, "timestamp_epoch": "1583961934.251616000" }, { "kind": "http_request", "dst_ip": "72.21.91.29", "fields": { "http.host": "ocsp.digicert.com", "http.user_agent": "Microsoft-CryptoAPI/10.0", "http.request.uri": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D", "http.response_in": "10503", "http.request.method": "GET", "http.request.full_uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D" }, "src_ip": "10.3.11.194", "dst_port": 80, "event_id": "evt-ac2d108c0a3d6afc219f171c", "src_port": 49732, "tcp_stream": 273, "udp_stream": null, "frame_number": 10500, "timestamp_epoch": "1583961955.838319000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.user_agent": "Microsoft Edge/80.0.361.66 Windows", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-6f07e3009d198471e3b346ab", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 11771, "timestamp_epoch": "1583961971.717394000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.user_agent": "Microsoft Edge/80.0.361.66 Windows", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-c4e5192ad43157276b96ff65", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 11809, "timestamp_epoch": "1583961972.718068000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.user_agent": "Microsoft Edge/80.0.361.66 Windows", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-4baa88489297046ea0352f72", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 11886, "timestamp_epoch": "1583961973.718859000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.user_agent": "Microsoft Edge/80.0.361.66 Windows", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-8b1c3bfaac8cffbbbaaa3bf5", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 11924, "timestamp_epoch": "1583961974.719978000" }, { "kind": "http_request", "dst_ip": "65.254.227.240", "fields": { "http.host": "notable-quotes.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/", "http.response_in": "13350", "http.request.method": "GET", "http.request.full_uri": "http://notable-quotes.com/" }, "src_ip": "10.3.11.218", "dst_port": 80, "event_id": "evt-8bddee20131ccbbd929b355c", "src_port": 49783, "tcp_stream": 344, "udp_stream": null, "frame_number": 13309, "timestamp_epoch": "1583962027.316706000" }, { "kind": "http_request", "dst_ip": "65.254.227.240", "fields": { "http.host": "notable-quotes.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/css/bootstrap.css", "http.response_in": "13643", "http.request.method": "GET", "http.request.full_uri": "http://notable-quotes.com/css/bootstrap.css" }, "src_ip": "10.3.11.218", "dst_port": 80, "event_id": "evt-e8513ba0dbfcd0eefeedeb31", "src_port": 49784, "tcp_stream": 345, "udp_stream": null, "frame_number": 13326, "timestamp_epoch": "1583962027.431505000" }, { "kind": "http_request", "dst_ip": "65.254.227.240", "fields": { "http.host": "notable-quotes.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/css/style.css", "http.response_in": "13433", "http.request.method": "GET", "http.request.full_uri": "http://notable-quotes.com/css/style.css" }, "src_ip": "10.3.11.218", "dst_port": 80, "event_id": "evt-afbe34db1d75418969f471cf", "src_port": 49783, "tcp_stream": 344, "udp_stream": null, "frame_number": 13363, "timestamp_epoch": "1583962027.488515000" }, { "kind": "http_request", "dst_ip": "65.254.227.240", "fields": { "http.host": "notable-quotes.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/images/facebook.png", "http.response_in": "13436", "http.request.method": "GET", "http.request.full_uri": "http://notable-quotes.com/images/facebook.png" }, "src_ip": "10.3.11.218", "dst_port": 80, "event_id": "evt-147e5435edd779a9cd1cd760", "src_port": 49785, "tcp_stream": 346, "udp_stream": null, "frame_number": 13369, "timestamp_epoch": "1583962027.489267000" }, { "kind": "http_request", "dst_ip": "65.254.227.240", "fields": { "http.host": "notable-quotes.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/images/nqlogo2.png", "http.response_in": "13528", "http.request.method": "GET", "http.request.full_uri": "http://notable-quotes.com/images/nqlogo2.png" }, "src_ip": "10.3.11.218", "dst_port": 80, "event_id": "evt-0986d115e7ba13a39eeaedb4", "src_port": 49786, "tcp_stream": 347, "udp_stream": null, "frame_number": 13371, "timestamp_epoch": "1583962027.489469000" }, { "kind": "http_request", "dst_ip": "172.217.6.144", "fields": { "http.host": "files.markerly.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/markerly-cdn.js", "http.response_in": "13389", "http.request.method": "GET", "http.request.full_uri": "http://files.markerly.com/markerly-cdn.js" }, "src_ip": "10.3.11.218", "dst_port": 80, "event_id": "evt-c83fcad8bf4403ff918cbf08", "src_port": 49790, "tcp_stream": 351, "udp_stream": null, "frame_number": 13377, "timestamp_epoch": "1583962027.490893000" }, { "kind": "http_request", "dst_ip": "65.254.227.240", "fields": { "http.host": "notable-quotes.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/images/twitter.png", "http.response_in": "13457", "http.request.method": "GET", "http.request.full_uri": "http://notable-quotes.com/images/twitter.png" }, "src_ip": "10.3.11.218", "dst_port": 80, "event_id": "evt-5ad301087a559188a63f34d0", "src_port": 49787, "tcp_stream": 348, "udp_stream": null, "frame_number": 13383, "timestamp_epoch": "1583962027.493360000" }, { "kind": "http_request", "dst_ip": "65.254.227.240", "fields": { "http.host": "notable-quotes.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/images/googleplus.png", "http.response_in": "13460", "http.request.method": "GET", "http.request.full_uri": "http://notable-quotes.com/images/googleplus.png" }, "src_ip": "10.3.11.218", "dst_port": 80, "event_id": "evt-cb8755d6daecb00b7a1eefd0", "src_port": 49788, "tcp_stream": 349, "udp_stream": null, "frame_number": 13384, "timestamp_epoch": "1583962027.493415000" }, { "kind": "http_request", "dst_ip": "65.254.227.240", "fields": { "http.host": "notable-quotes.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/js/bootstrap.min.js", "http.response_in": "13559", "http.request.method": "GET", "http.request.full_uri": "http://notable-quotes.com/js/bootstrap.min.js" }, "src_ip": "10.3.11.218", "dst_port": 80, "event_id": "evt-476b7ff8c6df1e5aefc8268a", "src_port": 49783, "tcp_stream": 344, "udp_stream": null, "frame_number": 13453, "timestamp_epoch": "1583962027.547622000" }, { "kind": "http_request", "dst_ip": "65.254.227.240", "fields": { "http.host": "www.notable-quotes.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/a/america_quote_8.jpg", "http.response_in": "13819", "http.request.method": "GET", "http.request.full_uri": "http://www.notable-quotes.com/a/america_quote_8.jpg" }, "src_ip": "10.3.11.218", "dst_port": 80, "event_id": "evt-4f4da41bc57dcc1ebdd153f9", "src_port": 49791, "tcp_stream": 352, "udp_stream": null, "frame_number": 13467, "timestamp_epoch": "1583962027.570033000" }, { "kind": "http_request", "dst_ip": "65.254.227.240", "fields": { "http.host": "www.notable-quotes.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/w/wisdom_quote.jpg", "http.response_in": "13774", "http.request.method": "GET", "http.request.full_uri": "http://www.notable-quotes.com/w/wisdom_quote.jpg" }, "src_ip": "10.3.11.218", "dst_port": 80, "event_id": "evt-b8687d5aae36a327a5ab7962", "src_port": 49792, "tcp_stream": 353, "udp_stream": null, "frame_number": 13468, "timestamp_epoch": "1583962027.570077000" }, { "kind": "http_request", "dst_ip": "65.254.227.240", "fields": { "http.host": "www.notable-quotes.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/a/apocalypse_quote_3.jpg", "http.response_in": "13749", "http.request.method": "GET", "http.request.full_uri": "http://www.notable-quotes.com/a/apocalypse_quote_3.jpg" }, "src_ip": "10.3.11.218", "dst_port": 80, "event_id": "evt-db610b51b89cbf20396a745b", "src_port": 49794, "tcp_stream": 355, "udp_stream": null, "frame_number": 13473, "timestamp_epoch": "1583962027.570585000" }, { "kind": "http_request", "dst_ip": "65.254.227.240", "fields": { "http.host": "www.notable-quotes.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/w/wedding_quote.jpg", "http.response_in": "13821", "http.request.method": "GET", "http.request.full_uri": "http://www.notable-quotes.com/w/wedding_quote.jpg" }, "src_ip": "10.3.11.218", "dst_port": 80, "event_id": "evt-7c013463d14a7cf30b1b9eb1", "src_port": 49793, "tcp_stream": 354, "udp_stream": null, "frame_number": 13477, "timestamp_epoch": "1583962027.572340000" }, { "kind": "http_request", "dst_ip": "172.217.12.74", "fields": { "http.host": "ajax.googleapis.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/ajax/libs/jquery/1.6.4/jquery.min.js", "http.response_in": "13891", "http.request.method": "GET", "http.request.full_uri": "http://ajax.googleapis.com/ajax/libs/jquery/1.6.4/jquery.min.js" }, "src_ip": "10.3.11.218", "dst_port": 80, "event_id": "evt-4623b87f3a9a6b35dd622e87", "src_port": 49797, "tcp_stream": 358, "udp_stream": null, "frame_number": 13836, "timestamp_epoch": "1583962031.485239000" }, { "kind": "http_request", "dst_ip": "172.217.6.144", "fields": { "http.host": "files.markerly.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/toolbar.cdn.min.js", "http.response_in": "13981", "http.request.method": "GET", "http.request.full_uri": "http://files.markerly.com/toolbar.cdn.min.js" }, "src_ip": "10.3.11.218", "dst_port": 80, "event_id": "evt-d716e272660c0914ebf62ffd", "src_port": 49790, "tcp_stream": 351, "udp_stream": null, "frame_number": 13902, "timestamp_epoch": "1583962031.571744000" }, { "kind": "http_request", "dst_ip": "172.217.6.144", "fields": { "http.host": "files.markerly.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/main_toolbar_cdn.min.css", "http.response_in": "13996", "http.request.method": "GET", "http.request.full_uri": "http://files.markerly.com/main_toolbar_cdn.min.css" }, "src_ip": "10.3.11.218", "dst_port": 80, "event_id": "evt-9cb56ee686d3ff28ead88fbb", "src_port": 49790, "tcp_stream": 351, "udp_stream": null, "frame_number": 13984, "timestamp_epoch": "1583962031.744315000" }, { "kind": "http_request", "dst_ip": "65.254.227.240", "fields": { "http.host": "notable-quotes.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/favicon.ico", "http.response_in": "14010", "http.request.method": "GET", "http.request.full_uri": "http://notable-quotes.com/favicon.ico" }, "src_ip": "10.3.11.218", "dst_port": 80, "event_id": "evt-3046bc05bcfc80fe8f003597", "src_port": 49784, "tcp_stream": 345, "udp_stream": null, "frame_number": 14008, "timestamp_epoch": "1583962031.859675000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.user_agent": "Microsoft Edge/80.0.361.66 Windows", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-09e4b5930edd36d1a9380107", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 14288, "timestamp_epoch": "1583962091.721089000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.user_agent": "Microsoft Edge/80.0.361.66 Windows", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-d4849937eb29adb54e80b8fc", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 14289, "timestamp_epoch": "1583962092.722480000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.user_agent": "Microsoft Edge/80.0.361.66 Windows", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-8be146c3c876b197eea6b23d", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 14290, "timestamp_epoch": "1583962093.724344000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.user_agent": "Microsoft Edge/80.0.361.66 Windows", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-6d948401f90d62ba5c600d82", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 14295, "timestamp_epoch": "1583962094.725001000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.user_agent": "Microsoft Edge/80.0.361.66 Windows", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-a2c77d7ffb4f05448dc4259b", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 14606, "timestamp_epoch": "1583962211.723631000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.user_agent": "Microsoft Edge/80.0.361.66 Windows", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-0605bb3a14c8d07c615f47ab", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 14607, "timestamp_epoch": "1583962212.725179000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.user_agent": "Microsoft Edge/80.0.361.66 Windows", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-3ffa54de5e0a0e07161cc14f", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 14608, "timestamp_epoch": "1583962213.726629000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.user_agent": "Microsoft Edge/80.0.361.66 Windows", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-69273440f1d4d7bf9d491cd1", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 14609, "timestamp_epoch": "1583962214.727240000" }, { "kind": "http_request", "dst_ip": "18.235.112.207", "fields": { "http.host": "checkip.amazonaws.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.79 Safari/537.36", "http.request.uri": "/", "http.response_in": "14988", "http.request.method": "GET", "http.request.full_uri": "http://checkip.amazonaws.com/" }, "src_ip": "10.3.11.194", "dst_port": 80, "event_id": "evt-b45b779a43e6fb1311dae051", "src_port": 49787, "tcp_stream": 389, "udp_stream": null, "frame_number": 14981, "timestamp_epoch": "1583962320.240229000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.user_agent": "Microsoft Edge/80.0.361.66 Windows", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-44049d7c332355f5e4ba4c01", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 15124, "timestamp_epoch": "1583962331.726183000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.user_agent": "Microsoft Edge/80.0.361.66 Windows", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-3336d58fef4c7ac44f86a05a", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 15125, "timestamp_epoch": "1583962332.727285000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.user_agent": "Microsoft Edge/80.0.361.66 Windows", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-ee0ca84da5a16ec2f573b9dd", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 15126, "timestamp_epoch": "1583962333.728776000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.user_agent": "Microsoft Edge/80.0.361.66 Windows", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-39b941073beb01ed62439a0a", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 15127, "timestamp_epoch": "1583962334.730492000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-5fc70c725603f1a2da684752", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 15435, "timestamp_epoch": "1583962380.713849000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-3589131cad16bbf2a6887ac2", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 15526, "timestamp_epoch": "1583962383.730931000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-9a977340d5033cd445d9f4d7", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 15646, "timestamp_epoch": "1583962386.708730000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-434a1e83ad3d6dad7755874f", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 15652, "timestamp_epoch": "1583962386.723736000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-4e71b85f540683803b7f7c4c", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 15847, "timestamp_epoch": "1583962389.708216000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-02a955d9bd5e5dcb32bcdf5c", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 15864, "timestamp_epoch": "1583962392.708591000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-63b22363763d4711af133e62", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 15865, "timestamp_epoch": "1583962395.711154000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-2b7667001c637b5f30684b96", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 15884, "timestamp_epoch": "1583962398.724078000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-c5ea086eea9616b8d11dacd1", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 15895, "timestamp_epoch": "1583962401.724097000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-8f56773c671ac4fef001a625", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 16081, "timestamp_epoch": "1583962433.356330000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-9592018b797c40e370def242", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 16141, "timestamp_epoch": "1583962436.360831000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.user_agent": "Microsoft Edge/80.0.361.66 Windows", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-394274707fa209779644853a", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 16212, "timestamp_epoch": "1583962438.874020000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-171fb12eb1b4c9f8600e8f22", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 16215, "timestamp_epoch": "1583962439.361828000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.user_agent": "Microsoft Edge/80.0.361.66 Windows", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-016880fda33d0c0fdda60796", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 16227, "timestamp_epoch": "1583962439.874949000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.user_agent": "Microsoft Edge/80.0.361.66 Windows", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-b403cc29d3d39e9d70589c9a", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 16243, "timestamp_epoch": "1583962440.876192000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.user_agent": "Microsoft Edge/80.0.361.66 Windows", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-7b465e509116c22d623dc6ed", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 16253, "timestamp_epoch": "1583962441.876571000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-0961d6cffd648fbbe0323064", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 16254, "timestamp_epoch": "1583962442.364116000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-0e944f60e4c9240cf0d0078d", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 16259, "timestamp_epoch": "1583962445.365196000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-6a3f1cc8871b9bccdacb7c36", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 16274, "timestamp_epoch": "1583962448.365971000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-e971b3c22c28b7d3a267be96", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 16442, "timestamp_epoch": "1583962545.710392000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-73e2114d15bb70037b86bdd1", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 16444, "timestamp_epoch": "1583962545.749843000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-ba2ba2d60cb97f0ad72dcbf4", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 16474, "timestamp_epoch": "1583962545.924423000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-63feecbde0e92375a21ff416", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 16478, "timestamp_epoch": "1583962545.972032000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-6140c6b0d32f36966a7161bd", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 16518, "timestamp_epoch": "1583962548.701322000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-5e8ef2ee18bfa4d6cfef5d47", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 16519, "timestamp_epoch": "1583962548.763625000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-63dfd22cff8c26cb876f065c", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 16520, "timestamp_epoch": "1583962548.919956000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-6cbb22f9fe5513423c35b7e9", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 16521, "timestamp_epoch": "1583962548.967577000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-f56a33fb5abcb045ecebf3e2", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 16617, "timestamp_epoch": "1583962551.702580000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-a59dee648f3b55d258a6aade", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 16618, "timestamp_epoch": "1583962551.763886000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-6a55d8cb784b293c1ef41774", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 16619, "timestamp_epoch": "1583962551.967608000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.user_agent": "Microsoft Edge/80.0.361.66 Windows", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-385b831afd39cb9cd9b5c545", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 17586, "timestamp_epoch": "1583962558.877982000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.user_agent": "Microsoft Edge/80.0.361.66 Windows", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-1d3def76e494699825a78215", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 17599, "timestamp_epoch": "1583962559.878882000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.user_agent": "Microsoft Edge/80.0.361.66 Windows", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-8a30f3f6ae319cddcb773558", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 17601, "timestamp_epoch": "1583962560.880489000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.user_agent": "Microsoft Edge/80.0.361.66 Windows", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-922ec3776359e9aefbb9c9cc", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 17602, "timestamp_epoch": "1583962561.881352000" }, { "kind": "http_request", "dst_ip": "64.44.133.131", "fields": { "http.host": "64.44.133.131", "http.user_agent": "WinHTTP loader/1.0", "http.request.uri": "/images/imgpaper.png", "http.response_in": "18931", "http.request.method": "GET", "http.request.full_uri": "http://64.44.133.131/images/imgpaper.png" }, "src_ip": "10.3.11.194", "dst_port": 80, "event_id": "evt-d7aa68b6073c1ad0d84501a6", "src_port": 49816, "tcp_stream": 434, "udp_stream": null, "frame_number": 18431, "timestamp_epoch": "1583962605.820456000" }, { "kind": "http_request", "dst_ip": "64.44.133.131", "fields": { "http.host": "64.44.133.131", "http.user_agent": "WinHTTP loader/1.0", "http.request.uri": "/images/cursor.png", "http.response_in": "19533", "http.request.method": "GET", "http.request.full_uri": "http://64.44.133.131/images/cursor.png" }, "src_ip": "10.3.11.194", "dst_port": 80, "event_id": "evt-d9a88cddc08e0d4d61c797d5", "src_port": 49816, "tcp_stream": 434, "udp_stream": null, "frame_number": 19014, "timestamp_epoch": "1583962612.268574000" }, { "kind": "http_request", "dst_ip": "203.176.135.102", "fields": { "http.host": "203.176.135.102:8082", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E)", "http.request.uri": "/yas20/LAPTOP-7XMV2SN_W10018363.CF3A0EAB425F1927835EF064A69CAED6/81/", "http.response_in": "19486", "http.content_length": "274", "http.request.method": "POST", "http.request.full_uri": "http://203.176.135.102:8082/yas20/LAPTOP-7XMV2SN_W10018363.CF3A0EAB425F1927835EF064A69CAED6/81/" }, "src_ip": "10.3.11.194", "dst_port": 8082, "event_id": "evt-cacb05687f5004622bba567b", "src_port": 50080, "tcp_stream": 448, "udp_stream": null, "body_sha256": "01428897745e7b37849d922e35e28ad8585aca2a254d55f3b5adaecb0b3cb526", "frame_number": 19116, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 274, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 274, "timestamp_epoch": "1583962613.434697000" }, { "kind": "http_request", "dst_ip": "203.176.135.102", "fields": { "http.host": "203.176.135.102:8082", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E)", "http.request.uri": "/yas20/LAPTOP-7XMV2SN_W10018363.CF3A0EAB425F1927835EF064A69CAED6/81/", "http.response_in": "19553", "http.content_length": "551", "http.request.method": "POST", "http.request.full_uri": "http://203.176.135.102:8082/yas20/LAPTOP-7XMV2SN_W10018363.CF3A0EAB425F1927835EF064A69CAED6/81/" }, "src_ip": "10.3.11.194", "dst_port": 8082, "event_id": "evt-63f3c684bb79492175a5418b", "src_port": 50081, "tcp_stream": 449, "udp_stream": null, "body_sha256": "34fc3b82e17c69e3cefd908d8e85848f2cdfcb180ba5c05a84ccd2c65e943e09", "frame_number": 19547, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 551, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 551, "timestamp_epoch": "1583962615.812536000" }, { "kind": "http_request", "dst_ip": "64.44.133.131", "fields": { "http.host": "64.44.133.131", "http.request.uri": "/images/cursor.png", "http.response_in": "20107", "http.request.method": "GET", "http.request.full_uri": "http://64.44.133.131/images/cursor.png" }, "src_ip": "10.3.11.194", "dst_port": 80, "event_id": "evt-e40cfd799b57171e707d0e03", "src_port": 50082, "tcp_stream": 450, "udp_stream": null, "frame_number": 19562, "timestamp_epoch": "1583962617.337739000" }, { "kind": "http_request", "dst_ip": "203.176.135.102", "fields": { "http.host": "203.176.135.102:8082", "http.user_agent": "KSKJJGJ", "http.request.uri": "/yas20/LAPTOP-7XMV2SN_W10018363.CF3A0EAB425F1927835EF064A69CAED6/90", "http.response_in": "20667", "http.content_length": "5366", "http.request.method": "POST", "http.request.full_uri": "http://203.176.135.102:8082/yas20/LAPTOP-7XMV2SN_W10018363.CF3A0EAB425F1927835EF064A69CAED6/90" }, "src_ip": "10.3.11.194", "dst_port": 8082, "event_id": "evt-5239b150e31a7b2dbb91ad83", "src_port": 50091, "tcp_stream": 459, "udp_stream": null, "body_sha256": "f1d535264c136ef79dcbc92b30a25b313ed312dc611c92cd70d6470a1609ee88", "frame_number": 20660, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [ { "type": "hostname", "value": "LAPTOP-7XMV2SN", "source": "explicit-body-label" }, { "type": "account", "value": "otis.witherspoon", "source": "explicit-body-label" } ], "inspected_bytes": 5366, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 5366, "timestamp_epoch": "1583962620.007347000" }, { "kind": "http_request", "dst_ip": "203.176.135.102", "fields": { "http.host": "203.176.135.102:8082", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E)", "http.request.uri": "/yas20/LAPTOP-7XMV2SN_W10018363.CF3A0EAB425F1927835EF064A69CAED6/81/", "http.response_in": "21101", "http.content_length": "219", "http.request.method": "POST", "http.request.full_uri": "http://203.176.135.102:8082/yas20/LAPTOP-7XMV2SN_W10018363.CF3A0EAB425F1927835EF064A69CAED6/81/" }, "src_ip": "10.3.11.194", "dst_port": 8082, "event_id": "evt-ce8d67738f8ba9aa8862d845", "src_port": 50098, "tcp_stream": 465, "udp_stream": null, "body_sha256": "3291b96690178e55e4114c78a6241d3a6bd18aa7361626ff803b54064d178122", "frame_number": 21096, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 219, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 219, "timestamp_epoch": "1583962639.795666000" }, { "kind": "http_request", "dst_ip": "23.199.252.214", "fields": { "http.host": "newegg.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.132 Safari/537.36 Edg/80.0.361.66", "http.request.uri": "/", "http.response_in": "21169", "http.request.method": "GET", "http.request.full_uri": "http://newegg.com/" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-ad4ef0b2f69790662492df57", "src_port": 49817, "tcp_stream": 467, "udp_stream": null, "frame_number": 21154, "timestamp_epoch": "1583962650.405381000" }, { "kind": "http_request", "dst_ip": "72.246.84.229", "fields": { "http.host": "www.newegg.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.132 Safari/537.36 Edg/80.0.361.66", "http.request.uri": "/", "http.response_in": "21208", "http.request.method": "GET", "http.request.full_uri": "http://www.newegg.com/" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-91dd57303a1b55d90f45186f", "src_port": 49819, "tcp_stream": 469, "udp_stream": null, "frame_number": 21202, "timestamp_epoch": "1583962650.547673000" }, { "kind": "http_request", "dst_ip": "23.63.253.208", "fields": { "http.host": "crl.securetrust.com", "http.user_agent": "Microsoft-CryptoAPI/10.0", "http.request.uri": "/STCA.crl", "http.response_in": "21914", "http.request.method": "GET", "http.request.full_uri": "http://crl.securetrust.com/STCA.crl" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-0064de9ae30893ea675e0993", "src_port": 49841, "tcp_stream": 491, "udp_stream": null, "frame_number": 21909, "timestamp_epoch": "1583962651.430770000" }, { "kind": "http_request", "dst_ip": "203.176.135.102", "fields": { "http.host": "203.176.135.102:8082", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E)", "http.request.uri": "/yas20/LAPTOP-7XMV2SN_W10018363.CF3A0EAB425F1927835EF064A69CAED6/81/", "http.response_in": "26675", "http.content_length": "210", "http.request.method": "POST", "http.request.full_uri": "http://203.176.135.102:8082/yas20/LAPTOP-7XMV2SN_W10018363.CF3A0EAB425F1927835EF064A69CAED6/81/" }, "src_ip": "10.3.11.194", "dst_port": 8082, "event_id": "evt-31821e2ca4406b6f393810c4", "src_port": 50099, "tcp_stream": 555, "udp_stream": null, "body_sha256": "cf0d2bf5ac3284cc068e414be2a74d56bc5c1543413d3965aa96075114817a7a", "frame_number": 26673, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 210, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 210, "timestamp_epoch": "1583962672.861852000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.user_agent": "Microsoft Edge/80.0.361.66 Windows", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-cd33e56027db81a6b839874f", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 26691, "timestamp_epoch": "1583962678.876540000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.user_agent": "Microsoft Edge/80.0.361.66 Windows", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-5e054b7a176d4d347bfc1df9", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 26700, "timestamp_epoch": "1583962679.883780000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.user_agent": "Microsoft Edge/80.0.361.66 Windows", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-f0fd8f7fbca2decaaf489c99", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 26701, "timestamp_epoch": "1583962680.884499000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.user_agent": "Microsoft Edge/80.0.361.66 Windows", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-fc819600efb2c39188f7e14b", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 26721, "timestamp_epoch": "1583962681.898250000" }, { "kind": "http_request", "dst_ip": "205.185.216.42", "fields": { "http.host": "ctldl.windowsupdate.com", "http.user_agent": "Microsoft-CryptoAPI/10.0", "http.request.uri": "/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?51a531bedcde571d", "http.response_in": "27393", "http.request.method": "GET", "http.request.full_uri": "http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?51a531bedcde571d" }, "src_ip": "10.3.11.194", "dst_port": 80, "event_id": "evt-16b2c3662707dbac095c396c", "src_port": 50103, "tcp_stream": 567, "udp_stream": null, "frame_number": 27391, "timestamp_epoch": "1583962744.531400000" }, { "kind": "http_request", "dst_ip": "205.185.216.42", "fields": { "http.host": "ctldl.windowsupdate.com", "http.user_agent": "Microsoft-CryptoAPI/10.0", "http.request.uri": "/msdownload/update/v3/static/trustedr/en/pinrulesstl.cab?38fdc717233a6bf2", "http.response_in": "27396", "http.request.method": "GET", "http.request.full_uri": "http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/pinrulesstl.cab?38fdc717233a6bf2" }, "src_ip": "10.3.11.194", "dst_port": 80, "event_id": "evt-63dfd7a613597a9e0127c72d", "src_port": 50103, "tcp_stream": 567, "udp_stream": null, "frame_number": 27394, "timestamp_epoch": "1583962744.555361000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-bfbf87580df1870a9c9148de", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 27507, "timestamp_epoch": "1583962875.498158000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-ebec47f488823346c9702672", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 27508, "timestamp_epoch": "1583962878.491154000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-3aa1937d16670d737059862a", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 27527, "timestamp_epoch": "1583962881.507060000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-595decbc1458b09818d0b602", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 29184, "timestamp_epoch": "1583963086.283423000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-b73113fd47927e252d587012", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 29202, "timestamp_epoch": "1583963089.279131000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-dd85299cfdbfb0e1ba069e26", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 29233, "timestamp_epoch": "1583963092.293061000" } ], "http_response": [ { "kind": "http_response", "dst_ip": "10.3.11.119", "fields": { "http.request_in": "4366", "http.content_type": "text/html; charset=utf-8", "http.response.code": "200", "http.content_encoding": "gzip", "http.transfer_encoding": "chunked" }, "src_ip": "72.167.191.69", "dst_port": 49743, "event_id": "evt-85c07323a59020fe1404bb32", "src_port": 80, "tcp_stream": 200, "udp_stream": null, "body_sha256": "088111ecdfb3a045b7d594f7c4632561d30b72e15bc771d79812c172ea77e0de", "frame_number": 4381, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 45927, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 45927, "timestamp_epoch": "1583961854.711681000" }, { "kind": "http_response", "dst_ip": "10.3.11.119", "fields": { "http.request_in": "4398", "http.content_type": "text/css", "http.response.code": "200", "http.content_encoding": "gzip", "http.transfer_encoding": "chunked" }, "src_ip": "72.167.191.69", "dst_port": 49743, "event_id": "evt-0c3d5fbb7f59b0ea631eb15e", "src_port": 80, "tcp_stream": 200, "udp_stream": null, "body_sha256": "c4015f58592d68396095b177ad8dd20f7c3910e2e08c0c81b24a9efd0f40c0c8", "frame_number": 4453, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 36818, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 36818, "timestamp_epoch": "1583961854.848373000" }, { "kind": "http_response", "dst_ip": "10.3.11.119", "fields": { "http.request_in": "4433", "http.content_type": "text/css; charset=utf-8", "http.response.code": "200", "http.content_encoding": "gzip", "http.transfer_encoding": "chunked" }, "src_ip": "216.58.194.42", "dst_port": 49748, "event_id": "evt-a4ef3e2b48733e7ab307d449", "src_port": 80, "tcp_stream": 205, "udp_stream": null, "body_sha256": "4b2f13582e24aa18d80a7efd5ca0862cbb68b414a3d9d37a9138c3873bdbbba8", "frame_number": 4490, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 20209, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 20209, "timestamp_epoch": "1583961854.860477000" }, { "kind": "http_response", "dst_ip": "10.3.11.119", "fields": { "http.request_in": "4439", "http.content_type": "text/css; charset=utf-8", "http.response.code": "200", "http.content_encoding": "gzip", "http.transfer_encoding": "chunked" }, "src_ip": "216.58.194.42", "dst_port": 49749, "event_id": "evt-4795339025a935e6711c72e0", "src_port": 80, "tcp_stream": 206, "udp_stream": null, "body_sha256": "00b3e28e084717e5fb9ba1f8a9cf7e9a854ded1b7b4721ed31110513013461dc", "frame_number": 4496, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 2741, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 2741, "timestamp_epoch": "1583961854.864183000" }, { "kind": "http_response", "dst_ip": "10.3.11.119", "fields": { "http.request_in": "4481", "http.content_type": "image/jpeg", "http.response.code": "200", "http.content_length": "12203", "http.content_encoding": "gzip" }, "src_ip": "23.209.74.120", "dst_port": 49753, "event_id": "evt-b595bc64b9772492bfdb1b36", "src_port": 80, "tcp_stream": 210, "udp_stream": null, "body_sha256": "b6c573fcecf8b4204abd88d9076ae381da57f8969c241e9f08215d3016adc612", "frame_number": 4512, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 12245, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 12245, "timestamp_epoch": "1583961854.881864000" }, { "kind": "http_response", "dst_ip": "10.3.11.119", "fields": { "http.request_in": "4477", "http.content_type": "image/jpeg", "http.response.code": "200", "http.content_length": "8084", "http.content_encoding": "gzip" }, "src_ip": "23.209.74.120", "dst_port": 49754, "event_id": "evt-f729caaf7a4cbfa193071519", "src_port": 80, "tcp_stream": 211, "udp_stream": null, "body_sha256": "9b7024bd4a97fed7a3823a6d98653f66ec959b8e5b73aa533f7e78d0900f9e6d", "frame_number": 4522, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 8133, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 8133, "timestamp_epoch": "1583961854.882228000" }, { "kind": "http_response", "dst_ip": "10.3.11.119", "fields": { "http.request_in": "4559", "http.content_type": "text/html", "http.response.code": "308", "http.content_length": "171" }, "src_ip": "72.246.84.150", "dst_port": 49759, "event_id": "evt-c4f63996c50c5dfd811e3839", "src_port": 80, "tcp_stream": 216, "udp_stream": null, "body_sha256": "21bd143d38dbbae427615a7266a86a18dc95c417f3e510632d7a9180d98d3571", "frame_number": 4568, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 171, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 171, "timestamp_epoch": "1583961855.033448000" }, { "kind": "http_response", "dst_ip": "10.3.11.119", "fields": { "http.request_in": "4475", "http.content_type": "application/x-javascript", "http.response.code": "200", "http.content_length": "15038", "http.content_encoding": "gzip" }, "src_ip": "23.211.18.27", "dst_port": 49750, "event_id": "evt-1c073436a186170f2805bd68", "src_port": 80, "tcp_stream": 207, "udp_stream": null, "body_sha256": "1ca2faaa4a7ba86c934c337dcb47ebd521dd5721a9f62302ef36f074c1a4c8d8", "frame_number": 4616, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 41029, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 41029, "timestamp_epoch": "1583961855.132596000" }, { "kind": "http_response", "dst_ip": "10.3.11.119", "fields": { "http.request_in": "4638", "http.content_type": "application/x-javascript", "http.response.code": "200", "http.content_length": "2157", "http.content_encoding": "gzip" }, "src_ip": "23.211.18.27", "dst_port": 49750, "event_id": "evt-6c614694124d6ace573c9d31", "src_port": 80, "tcp_stream": 207, "udp_stream": null, "body_sha256": "d774beebaea68f3e3be399e441d6f5bf073ce036a8cce8a90b444c60d2985f04", "frame_number": 4679, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 5969, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 5969, "timestamp_epoch": "1583961855.206585000" }, { "kind": "http_response", "dst_ip": "10.3.11.119", "fields": { "http.request_in": "4642", "http.content_type": "image/jpeg", "http.response.code": "200", "http.content_length": "1291", "http.content_encoding": "gzip" }, "src_ip": "23.209.74.120", "dst_port": 49753, "event_id": "evt-2c44c94557266704e4de9fff", "src_port": 80, "tcp_stream": 210, "udp_stream": null, "body_sha256": "5b0d6fc1a80187419cfcc2340e6bf1a3e7704e8d65b44bee45a1caaab91138d2", "frame_number": 4693, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 1268, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 1268, "timestamp_epoch": "1583961855.208478000" }, { "kind": "http_response", "dst_ip": "10.3.11.119", "fields": { "http.request_in": "4640", "http.content_type": "image/jpeg", "http.response.code": "200", "http.content_length": "13328", "http.content_encoding": "gzip" }, "src_ip": "23.209.74.120", "dst_port": 49754, "event_id": "evt-8428b318619c5a754993b1c7", "src_port": 80, "tcp_stream": 211, "udp_stream": null, "body_sha256": "c3bdfe5de3424f3d07872f6ecb6de79015e4301a4eb72803fbff251c41311f88", "frame_number": 4694, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 13710, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 13710, "timestamp_epoch": "1583961855.208494000" }, { "kind": "http_response", "dst_ip": "10.3.11.119", "fields": { "http.request_in": "4815", "http.content_type": "image/jpeg", "http.response.code": "200", "http.content_length": "352", "http.content_encoding": "gzip" }, "src_ip": "23.209.74.120", "dst_port": 49753, "event_id": "evt-000cb3cb7370994637d54eb8", "src_port": 80, "tcp_stream": 210, "udp_stream": null, "body_sha256": "f1a04b0b791b515d66978d2f6d2980bec1455795486bb71b19e7ad8a84aab865", "frame_number": 4819, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 617, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 617, "timestamp_epoch": "1583961855.691441000" }, { "kind": "http_response", "dst_ip": "10.3.11.119", "fields": { "http.request_in": "4917", "http.content_type": "font/woff2", "http.response.code": "200", "http.content_length": "14380" }, "src_ip": "216.58.194.131", "dst_port": 49758, "event_id": "evt-78bd7ebbcdb999bc30587e22", "src_port": 80, "tcp_stream": 215, "udp_stream": null, "body_sha256": "9c50a96c859b9beea47b71740bd14e7f69a4df586d015f47434037f8def53b52", "frame_number": 4962, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 14380, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 14380, "timestamp_epoch": "1583961856.090996000" }, { "kind": "http_response", "dst_ip": "10.3.11.119", "fields": { "http.request_in": "4958", "http.content_type": "font/woff2", "http.response.code": "200", "http.content_length": "36608" }, "src_ip": "216.58.194.131", "dst_port": 49765, "event_id": "evt-e4bafe5509df5826d56508d6", "src_port": 80, "tcp_stream": 222, "udp_stream": null, "body_sha256": "5adbad4e799ade940d96f6f293fc1ea535b504a6151555c879c5e183aeac1018", "frame_number": 5029, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 36608, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 36608, "timestamp_epoch": "1583961856.132430000" }, { "kind": "http_response", "dst_ip": "10.3.11.119", "fields": { "http.request_in": "4956", "http.content_type": "font/woff2", "http.response.code": "200", "http.content_length": "68540" }, "src_ip": "216.58.194.131", "dst_port": 49763, "event_id": "evt-6dd7a196a818ae4290803050", "src_port": 80, "tcp_stream": 220, "udp_stream": null, "body_sha256": "974ec9b1a263ff7658a88da7dc41e55989ff284562111577e0b1fd36144c8bd7", "frame_number": 5056, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 68540, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 68540, "timestamp_epoch": "1583961856.172337000" }, { "kind": "http_response", "dst_ip": "10.3.11.119", "fields": { "http.request_in": "5062", "http.content_type": "font/woff2", "http.response.code": "200", "http.content_length": "21160" }, "src_ip": "216.58.194.131", "dst_port": 49758, "event_id": "evt-ef400ea73928c40314102489", "src_port": 80, "tcp_stream": 215, "udp_stream": null, "body_sha256": "3fd2858003c32f1542e7f330cfd1ef2dcd578f20c39bfdd22d70c57a801502b0", "frame_number": 5088, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 21160, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 21160, "timestamp_epoch": "1583961856.225481000" }, { "kind": "http_response", "dst_ip": "10.3.11.119", "fields": { "http.request_in": "5065", "http.content_type": "font/woff2", "http.response.code": "200", "http.content_length": "13224" }, "src_ip": "216.58.194.131", "dst_port": 49765, "event_id": "evt-e953c1d799c6bf538b401e0d", "src_port": 80, "tcp_stream": 222, "udp_stream": null, "body_sha256": "361c9f80feaefdda9eb1bb7ee61de56d922188898f69af4cf8a76c64fb0183ad", "frame_number": 5123, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 13224, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 13224, "timestamp_epoch": "1583961856.293967000" }, { "kind": "http_response", "dst_ip": "10.3.11.119", "fields": { "http.request_in": "5066", "http.content_type": "font/woff2", "http.response.code": "200", "http.content_length": "26984" }, "src_ip": "216.58.194.131", "dst_port": 49763, "event_id": "evt-a8097c0077a376eaba7bf1b4", "src_port": 80, "tcp_stream": 220, "udp_stream": null, "body_sha256": "7c41a77c81ad105a586ea655d38846277c13e59341f0d572b8f0eb5ce8af2000", "frame_number": 5141, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 26984, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 26984, "timestamp_epoch": "1583961856.294900000" }, { "kind": "http_response", "dst_ip": "10.3.11.119", "fields": { "http.request_in": "5071", "http.content_type": "font/woff2", "http.response.code": "200", "http.content_length": "34792" }, "src_ip": "216.58.194.131", "dst_port": 49767, "event_id": "evt-a859ec42932ad9c4391a2d18", "src_port": 80, "tcp_stream": 224, "udp_stream": null, "body_sha256": "06cb95758d706e8359a137118c05fb38af14616f870a0448d327c3203ee69973", "frame_number": 5161, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 34792, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 34792, "timestamp_epoch": "1583961856.325688000" }, { "kind": "http_response", "dst_ip": "10.3.11.119", "fields": { "http.request_in": "5450", "http.content_type": "image/png", "http.response.code": "200", "http.content_length": "3427" }, "src_ip": "23.211.18.27", "dst_port": 49750, "event_id": "evt-e8d1726b59ee22fb0dd722f9", "src_port": 80, "tcp_stream": 207, "udp_stream": null, "body_sha256": "b42b0d8a915682fe8b49af799d072001ddc761191069bd18b2f2974c77a8cf65", "frame_number": 5506, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 3427, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 3427, "timestamp_epoch": "1583961856.604272000" }, { "kind": "http_response", "dst_ip": "10.3.11.119", "fields": { "http.request_in": "5551", "http.content_type": "application/x-javascript", "http.response.code": "200", "http.content_length": "23160", "http.content_encoding": "gzip" }, "src_ip": "23.211.18.27", "dst_port": 49774, "event_id": "evt-4fe433ad2cad027fc1ce13bf", "src_port": 80, "tcp_stream": 231, "udp_stream": null, "body_sha256": "85c54a570e292f19e17fc817bdfdd11f501a95534b8e483629d91c605f38c896", "frame_number": 5791, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 79901, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 79901, "timestamp_epoch": "1583961856.703926000" }, { "kind": "http_response", "dst_ip": "10.3.11.119", "fields": { "http.request_in": "5856", "http.content_type": "text/css", "http.response.code": "200", "http.content_length": "11991", "http.content_encoding": "gzip" }, "src_ip": "23.211.18.27", "dst_port": 49775, "event_id": "evt-667d957f264a2efbd9e9f468", "src_port": 80, "tcp_stream": 232, "udp_stream": null, "body_sha256": "fe4428ffba8707caf8541a0ca37cfc96234012a10d051e3362d9d05fbbd9e659", "frame_number": 5911, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 77910, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 77910, "timestamp_epoch": "1583961856.806925000" }, { "kind": "http_response", "dst_ip": "10.3.11.119", "fields": { "http.request_in": "5452", "http.content_type": "image/jpeg", "http.response.code": "200", "http.content_length": "392169", "http.content_encoding": "gzip" }, "src_ip": "23.209.74.120", "dst_port": 49753, "event_id": "evt-f4e39fcd3552c320119496de", "src_port": 80, "tcp_stream": 210, "udp_stream": null, "body_sha256": "5c06f9a4898eae08a070b18d66d2162fd031833e993d1c0bf3bd9e7e83a6c526", "frame_number": 6059, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": true, "identities": [], "inspected_bytes": 262144, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 404229, "timestamp_epoch": "1583961857.208954000" }, { "kind": "http_response", "dst_ip": "10.3.11.119", "fields": { "http.request_in": "6154", "http.content_type": "application/javascript; charset=utf-8", "http.response.code": "200", "http.content_length": "29100", "http.content_encoding": "gzip" }, "src_ip": "72.21.91.66", "dst_port": 49780, "event_id": "evt-9204eaacf48d6ba1ed54dbdf", "src_port": 80, "tcp_stream": 237, "udp_stream": null, "body_sha256": "95562c2db2cc4094800540ee79790996a5e1fab12a5a3a99432545af45eb2be8", "frame_number": 6254, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 98387, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 98387, "timestamp_epoch": "1583961857.339599000" }, { "kind": "http_response", "dst_ip": "10.3.11.119", "fields": { "http.request_in": "6156", "http.content_type": "image/jpeg", "http.response.code": "200", "http.content_length": "117204", "http.content_encoding": "gzip" }, "src_ip": "23.209.74.120", "dst_port": 49781, "event_id": "evt-db871c82680d661abfba6962", "src_port": 80, "tcp_stream": 238, "udp_stream": null, "body_sha256": "5638ee72bed581aec1cf09b1e7fdeb37a23b69d8f5927ca00b84f2286a695066", "frame_number": 6580, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 117306, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 117306, "timestamp_epoch": "1583961857.418503000" }, { "kind": "http_response", "dst_ip": "10.3.11.119", "fields": { "http.request_in": "6077", "http.content_type": "image/jpeg", "http.response.code": "200", "http.content_length": "264342", "http.content_encoding": "gzip" }, "src_ip": "23.209.74.120", "dst_port": 49754, "event_id": "evt-1d1267b8c34122aec1d0b299", "src_port": 80, "tcp_stream": 211, "udp_stream": null, "body_sha256": "c683bc3d52a2a1a0b299fe17e0ccddf7fdc01d8b246fb1652ea258904a8bff7f", "frame_number": 6900, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": true, "identities": [], "inspected_bytes": 262144, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 302749, "timestamp_epoch": "1583961857.602405000" }, { "kind": "http_response", "dst_ip": "10.3.11.119", "fields": { "http.request_in": "6158", "http.content_type": "image/jpeg", "http.response.code": "200", "http.content_length": "380552", "http.content_encoding": "gzip" }, "src_ip": "23.209.74.120", "dst_port": 49782, "event_id": "evt-bf0a768facd0a06d1496b5d5", "src_port": 80, "tcp_stream": 239, "udp_stream": null, "body_sha256": "f0f761f95b7d8b5f5b64d8c078bb7e9274a0d248d73094d7d16581213c3fb7ef", "frame_number": 6945, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": true, "identities": [], "inspected_bytes": 262144, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 385085, "timestamp_epoch": "1583961857.602983000" }, { "kind": "http_response", "dst_ip": "10.3.11.119", "fields": { "http.request_in": "6075", "http.content_type": "image/jpeg", "http.response.code": "200", "http.content_length": "265315", "http.content_encoding": "gzip" }, "src_ip": "23.209.74.120", "dst_port": 49753, "event_id": "evt-85a9919c7071f3a362e91fdf", "src_port": 80, "tcp_stream": 210, "udp_stream": null, "body_sha256": "567b1b26bdc881dbbae6afca179ba2597c243a6a045984bb61c8138a00389792", "frame_number": 7107, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": true, "identities": [], "inspected_bytes": 262144, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 285252, "timestamp_epoch": "1583961857.788551000" }, { "kind": "http_response", "dst_ip": "10.3.11.119", "fields": { "http.request_in": "7633", "http.response.code": "301", "http.content_length": "0" }, "src_ip": "23.206.208.173", "dst_port": 49790, "event_id": "evt-19e5f4845bdb63770e058613", "src_port": 80, "tcp_stream": 247, "udp_stream": null, "frame_number": 7650, "timestamp_epoch": "1583961859.324481000" }, { "kind": "http_response", "dst_ip": "10.3.11.119", "fields": { "http.request_in": "7675", "http.content_type": "text/html;charset=utf-8", "http.response.code": "404", "http.content_length": "964" }, "src_ip": "72.167.191.69", "dst_port": 49743, "event_id": "evt-666188e4c16ddd2673eb7a05", "src_port": 80, "tcp_stream": 200, "udp_stream": null, "body_sha256": "c623c1144c540ad5f5ee378220c6237026df828fa5d63c95e072de454aa1113a", "frame_number": 7679, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 964, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 964, "timestamp_epoch": "1583961859.636723000" }, { "kind": "http_response", "dst_ip": "10.3.11.119", "fields": { "http.request_in": "7726", "http.content_type": "image/jpeg", "http.response.code": "200", "http.content_length": "334177", "http.content_encoding": "gzip" }, "src_ip": "23.209.74.120", "dst_port": 49753, "event_id": "evt-24ee453d029121104e1bb0c6", "src_port": 80, "tcp_stream": 210, "udp_stream": null, "body_sha256": "2458ec1dbcd980f7d484f0140f1d88e2088249eacf3411b2b2359afdf7774318", "frame_number": 8022, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": true, "identities": [], "inspected_bytes": 262144, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 338308, "timestamp_epoch": "1583961865.090785000" }, { "kind": "http_response", "dst_ip": "10.3.11.119", "fields": { "http.request_in": "8195", "http.content_type": "image/jpeg", "http.response.code": "200", "http.content_length": "359774", "http.content_encoding": "gzip" }, "src_ip": "23.209.74.120", "dst_port": 49753, "event_id": "evt-b14a6dcc192caebc4ca5bad1", "src_port": 80, "tcp_stream": 210, "udp_stream": null, "body_sha256": "0e7a2be431ec48b8483bf126741dba1fc74260a35d944a1b8f0f6c2e0adfc9dd", "frame_number": 8538, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": true, "identities": [], "inspected_bytes": 262144, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 359935, "timestamp_epoch": "1583961872.948085000" }, { "kind": "http_response", "dst_ip": "10.3.11.194", "fields": { "http.request_in": "8616", "http.content_type": "application/x-msdownload", "http.response.code": "200", "http.content_length": "466944" }, "src_ip": "50.87.248.17", "dst_port": 49727, "event_id": "evt-0d3bbd3048b7f3f4c21cbdc5", "src_port": 80, "tcp_stream": 259, "udp_stream": null, "body_sha256": "02db3c6b9aff73bf8a11c41107c836b6c800c919c5d3d1304f336aee03f79f4c", "frame_number": 8998, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": true, "identities": [ { "type": "account", "value": "User", "source": "referenced-profile-path" } ], "inspected_bytes": 262144, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 466944, "timestamp_epoch": "1583961876.987327000" }, { "kind": "http_response", "dst_ip": "10.3.11.119", "fields": { "http.request_in": "9006", "http.content_type": "image/jpeg", "http.response.code": "200", "http.content_encoding": "gzip", "http.transfer_encoding": "chunked" }, "src_ip": "23.209.74.120", "dst_port": 49753, "event_id": "evt-2f4a5d83793b5296d21650c7", "src_port": 80, "tcp_stream": 210, "udp_stream": null, "body_sha256": "a869f2e254fb5a41a1745f2ad858148a990c11f543012e43f14780a0e3b57538", "frame_number": 9409, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": true, "identities": [], "inspected_bytes": 262144, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 422099, "timestamp_epoch": "1583961882.612889000" }, { "kind": "http_response", "dst_ip": "10.3.11.119", "fields": { "http.request_in": "9419", "http.content_type": "image/jpeg", "http.response.code": "200", "http.content_encoding": "gzip", "http.transfer_encoding": "chunked" }, "src_ip": "23.209.74.120", "dst_port": 49753, "event_id": "evt-b5a5cc5393c63fcb0a7b563b", "src_port": 80, "tcp_stream": 210, "udp_stream": null, "body_sha256": "626211f63483c4d5717e680816bc56119bcb9cdb3446c6d9241b119037ae724e", "frame_number": 9736, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": true, "identities": [], "inspected_bytes": 262144, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 380697, "timestamp_epoch": "1583961891.422743000" }, { "kind": "http_response", "dst_ip": "10.3.11.119", "fields": { "http.request_in": "9821", "http.content_type": "image/jpeg", "http.response.code": "200", "http.content_encoding": "gzip", "http.transfer_encoding": "chunked" }, "src_ip": "23.209.74.120", "dst_port": 49753, "event_id": "evt-c0f4fe4814b9402cfe7daba7", "src_port": 80, "tcp_stream": 210, "udp_stream": null, "body_sha256": "8c1c0d96e26bb0fe8578afd07244eae11bab36021b8484862ed81010b97a873d", "frame_number": 10146, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": true, "identities": [], "inspected_bytes": 262144, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 354536, "timestamp_epoch": "1583961896.175938000" }, { "kind": "http_response", "dst_ip": "10.3.11.218", "fields": { "http.request_in": "10329", "http.response.code": "304" }, "src_ip": "8.253.164.248", "dst_port": 49756, "event_id": "evt-fe805e1c596aa2559a51050b", "src_port": 80, "tcp_stream": 268, "udp_stream": null, "frame_number": 10331, "timestamp_epoch": "1583961934.243177000" }, { "kind": "http_response", "dst_ip": "10.3.11.218", "fields": { "http.request_in": "10332", "http.response.code": "304" }, "src_ip": "8.253.164.248", "dst_port": 49756, "event_id": "evt-ffab652056c9e69707086a6e", "src_port": 80, "tcp_stream": 268, "udp_stream": null, "frame_number": 10334, "timestamp_epoch": "1583961934.311397000" }, { "kind": "http_response", "dst_ip": "10.3.11.194", "fields": { "http.request_in": "10500", "http.content_type": "application/ocsp-response", "http.response.code": "200", "http.content_length": "1507" }, "src_ip": "72.21.91.29", "dst_port": 49732, "event_id": "evt-8cc17b8a20df918ac780eb11", "src_port": 80, "tcp_stream": 273, "udp_stream": null, "body_sha256": "2aa0809ab9f586e743514b0ef60ece6f30dc7d5583d64c1d90cfb87c7019a2bf", "frame_number": 10503, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 1507, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 1507, "timestamp_epoch": "1583961955.863202000" }, { "kind": "http_response", "dst_ip": "10.3.11.218", "fields": { "http.request_in": "13309", "http.content_type": "text/html", "http.response.code": "200", "http.content_length": "27226" }, "src_ip": "65.254.227.240", "dst_port": 49783, "event_id": "evt-d0a03f1a3323318d2f9f0c5b", "src_port": 80, "tcp_stream": 344, "udp_stream": null, "body_sha256": "2e8b2448de2607edfbeba46bc40bdf5ff8a97afc21e36e0f2a8faaeb7802651d", "frame_number": 13350, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 27226, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 27226, "timestamp_epoch": "1583962027.488200000" }, { "kind": "http_response", "dst_ip": "10.3.11.218", "fields": { "http.request_in": "13377", "http.content_type": "text/javascript", "http.response.code": "200", "http.content_length": "1292" }, "src_ip": "172.217.6.144", "dst_port": 49790, "event_id": "evt-66d3ec8c569d7d75688861d5", "src_port": 80, "tcp_stream": 351, "udp_stream": null, "body_sha256": "a219ef1a0091feb8ab30c92f4a25833c4f431001bdec691af31878cdcaa1e43d", "frame_number": 13389, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 1292, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 1292, "timestamp_epoch": "1583962027.518133000" }, { "kind": "http_response", "dst_ip": "10.3.11.218", "fields": { "http.request_in": "13363", "http.content_type": "text/css", "http.response.code": "200", "http.content_length": "934" }, "src_ip": "65.254.227.240", "dst_port": 49783, "event_id": "evt-f55f3000f5823ecdce3563d6", "src_port": 80, "tcp_stream": 344, "udp_stream": null, "body_sha256": "3ddb722a10d4664abeb93659beefa009255d6cda0975a47944665976ad9e64cd", "frame_number": 13433, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 934, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 934, "timestamp_epoch": "1583962027.544281000" }, { "kind": "http_response", "dst_ip": "10.3.11.218", "fields": { "http.request_in": "13369", "http.content_type": "image/png", "http.response.code": "200", "http.content_length": "3394" }, "src_ip": "65.254.227.240", "dst_port": 49785, "event_id": "evt-93741c8f894b0cf96b15a9ad", "src_port": 80, "tcp_stream": 346, "udp_stream": null, "body_sha256": "89c5625aa0ecfeaa47ae9da990cda5ab80fe8088ab1cd55ee7394e870de5eafa", "frame_number": 13436, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 3394, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 3394, "timestamp_epoch": "1583962027.544358000" }, { "kind": "http_response", "dst_ip": "10.3.11.218", "fields": { "http.request_in": "13383", "http.content_type": "image/png", "http.response.code": "200", "http.content_length": "3644" }, "src_ip": "65.254.227.240", "dst_port": 49787, "event_id": "evt-6247d91e26b988f71b9d5083", "src_port": 80, "tcp_stream": 348, "udp_stream": null, "body_sha256": "49c45399074a6af07b176d55bb85b3de42b2c2889bf9efa37310b4e71cf14f43", "frame_number": 13457, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 3644, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 3644, "timestamp_epoch": "1583962027.549369000" }, { "kind": "http_response", "dst_ip": "10.3.11.218", "fields": { "http.request_in": "13384", "http.content_type": "image/png", "http.response.code": "200", "http.content_length": "3869" }, "src_ip": "65.254.227.240", "dst_port": 49788, "event_id": "evt-2b1fcfb4bdf28a5597fa6e8d", "src_port": 80, "tcp_stream": 349, "udp_stream": null, "body_sha256": "1e7a8021a029a0b1b97d9df2c059ad4fe80ff8d9db9564c593bdde97df48f5ff", "frame_number": 13460, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 3869, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 3869, "timestamp_epoch": "1583962027.549563000" }, { "kind": "http_response", "dst_ip": "10.3.11.218", "fields": { "http.request_in": "13371", "http.content_type": "image/png", "http.response.code": "200", "http.content_length": "21518" }, "src_ip": "65.254.227.240", "dst_port": 49786, "event_id": "evt-b6b8b3d923a4bf7ef8adecb6", "src_port": 80, "tcp_stream": 347, "udp_stream": null, "body_sha256": "8c426b04cd3debee6a21646f14d72a09db7ad335d1cf348484a654a7905760f5", "frame_number": 13528, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 21518, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 21518, "timestamp_epoch": "1583962027.621691000" }, { "kind": "http_response", "dst_ip": "10.3.11.218", "fields": { "http.request_in": "13453", "http.content_type": "application/x-javascript", "http.response.code": "200", "http.content_length": "35951" }, "src_ip": "65.254.227.240", "dst_port": 49783, "event_id": "evt-66470088ec903751a3b5904e", "src_port": 80, "tcp_stream": 344, "udp_stream": null, "body_sha256": "d5fd173d00d9733900834e0e1083de86b532e048b15c0420ba5c2db0623644b8", "frame_number": 13559, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 35951, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 35951, "timestamp_epoch": "1583962027.622723000" }, { "kind": "http_response", "dst_ip": "10.3.11.218", "fields": { "http.request_in": "13326", "http.content_type": "text/css", "http.response.code": "200", "http.content_length": "141622" }, "src_ip": "65.254.227.240", "dst_port": 49784, "event_id": "evt-a2e012e69d3006e7bc9e1cea", "src_port": 80, "tcp_stream": 345, "udp_stream": null, "body_sha256": "c942686010e285633d77a24341c43850ccd6162fcc7e8281ae8a70c2921a9af5", "frame_number": 13643, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 141622, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 141622, "timestamp_epoch": "1583962027.679109000" }, { "kind": "http_response", "dst_ip": "10.3.11.218", "fields": { "http.request_in": "13473", "http.content_type": "image/jpeg", "http.response.code": "200", "http.content_length": "68850" }, "src_ip": "65.254.227.240", "dst_port": 49794, "event_id": "evt-9be4fd6de7925e5621b9129f", "src_port": 80, "tcp_stream": 355, "udp_stream": null, "body_sha256": "0e687e2d9d394d7247d63b61aa33895b436f347eb73d8d1d1f99c199d2a0486e", "frame_number": 13749, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 68850, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 68850, "timestamp_epoch": "1583962027.772280000" }, { "kind": "http_response", "dst_ip": "10.3.11.218", "fields": { "http.request_in": "13468", "http.content_type": "image/jpeg", "http.response.code": "200", "http.content_length": "69439" }, "src_ip": "65.254.227.240", "dst_port": 49792, "event_id": "evt-4190a7d4fa2cffe31d4824e3", "src_port": 80, "tcp_stream": 353, "udp_stream": null, "body_sha256": "be8eb05fd0a2321d069099b171050e5b03effc735dcb43da10d0751ca721a026", "frame_number": 13774, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 69439, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 69439, "timestamp_epoch": "1583962027.775653000" }, { "kind": "http_response", "dst_ip": "10.3.11.218", "fields": { "http.request_in": "13467", "http.content_type": "image/jpeg", "http.response.code": "200", "http.content_length": "59314" }, "src_ip": "65.254.227.240", "dst_port": 49791, "event_id": "evt-27a196919a0415befe4cc387", "src_port": 80, "tcp_stream": 352, "udp_stream": null, "body_sha256": "876adf01df542fb8b0f263b3c41b1bf5b0c928f5b8a1205f5cb116b650843906", "frame_number": 13819, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 59314, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 59314, "timestamp_epoch": "1583962027.862506000" }, { "kind": "http_response", "dst_ip": "10.3.11.218", "fields": { "http.request_in": "13477", "http.content_type": "image/jpeg", "http.response.code": "200", "http.content_length": "74590" }, "src_ip": "65.254.227.240", "dst_port": 49793, "event_id": "evt-66371556892be5efb169e0c0", "src_port": 80, "tcp_stream": 354, "udp_stream": null, "body_sha256": "4a0ba027a8859545d3caf300e4c8293248c6e878758cacb14f34e1cdc3d2e24d", "frame_number": 13821, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 74590, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 74590, "timestamp_epoch": "1583962027.862565000" }, { "kind": "http_response", "dst_ip": "10.3.11.218", "fields": { "http.request_in": "13836", "http.content_type": "text/javascript; charset=UTF-8", "http.response.code": "200", "http.content_length": "32222", "http.content_encoding": "gzip" }, "src_ip": "172.217.12.74", "dst_port": 49797, "event_id": "evt-432d6a4c7452692dab7484bc", "src_port": 80, "tcp_stream": 358, "udp_stream": null, "body_sha256": "232066e3f6f1351afdaee1acb70c409766641fd5669e0b55ce7c77fac0a857ef", "frame_number": 13891, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 91668, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 91668, "timestamp_epoch": "1583962031.543194000" }, { "kind": "http_response", "dst_ip": "10.3.11.218", "fields": { "http.request_in": "13902", "http.content_type": "text/javascript", "http.response.code": "200", "http.content_length": "61214" }, "src_ip": "172.217.6.144", "dst_port": 49790, "event_id": "evt-ae0bb602a26c1e133fcfa444", "src_port": 80, "tcp_stream": 351, "udp_stream": null, "body_sha256": "d34dc64266e873c506a07bb00c46b2eef77d812e9c312bd12717fbb67b9740c2", "frame_number": 13981, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 61214, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 61214, "timestamp_epoch": "1583962031.731453000" }, { "kind": "http_response", "dst_ip": "10.3.11.218", "fields": { "http.request_in": "13984", "http.content_type": "text/css", "http.response.code": "200", "http.content_length": "12418" }, "src_ip": "172.217.6.144", "dst_port": 49790, "event_id": "evt-db12ce611537de385fa4a933", "src_port": 80, "tcp_stream": 351, "udp_stream": null, "body_sha256": "2ac97370caeb512780c9e407128aaa48e9ea92e34acfb427888e1a8027aa7723", "frame_number": 13996, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 12418, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 12418, "timestamp_epoch": "1583962031.764341000" }, { "kind": "http_response", "dst_ip": "10.3.11.218", "fields": { "http.request_in": "14008", "http.content_type": "image/x-icon", "http.response.code": "200", "http.content_length": "0" }, "src_ip": "65.254.227.240", "dst_port": 49784, "event_id": "evt-1d350c86951de99b95be72d8", "src_port": 80, "tcp_stream": 345, "udp_stream": null, "frame_number": 14010, "timestamp_epoch": "1583962031.959272000" }, { "kind": "http_response", "dst_ip": "10.3.11.194", "fields": { "http.request_in": "14981", "http.response.code": "200", "http.content_length": "16" }, "src_ip": "18.235.112.207", "dst_port": 49787, "event_id": "evt-14b66d5c04c28e7669df2c6b", "src_port": 80, "tcp_stream": 389, "udp_stream": null, "body_sha256": "855a518348bdb64df2ac2fc743b2f2479d4b6fb69d9f87dcdc740ee5d5e03a40", "frame_number": 14988, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 16, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 16, "timestamp_epoch": "1583962320.294784000" }, { "kind": "http_response", "dst_ip": "10.3.11.194", "fields": { "http.request_in": "18431", "http.content_type": "Content-type: application/octet-stream", "http.response.code": "200", "http.content_length": "582656" }, "src_ip": "64.44.133.131", "dst_port": 49816, "event_id": "evt-4ad556e5f8271a93364449d6", "src_port": 80, "tcp_stream": 434, "udp_stream": null, "body_sha256": "8aa9c596dd3eb7560bc7416ba181e858f1174fcbcb5432050f3f9a663ed1ffa2", "frame_number": 18931, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": true, "identities": [], "inspected_bytes": 262144, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 582656, "timestamp_epoch": "1583962607.301052000" }, { "kind": "http_response", "dst_ip": "10.3.11.194", "fields": { "http.request_in": "19116", "http.content_type": "text/plain", "http.response.code": "200", "http.content_length": "3" }, "src_ip": "203.176.135.102", "dst_port": 50080, "event_id": "evt-24791d3af4297d5fdac377fa", "src_port": 8082, "tcp_stream": 448, "udp_stream": null, "body_sha256": "c76ea8b0db60dcccfdc0217059e37eb5b10d10940e649f9bc1d07d4ddcc797d1", "frame_number": 19486, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 3, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 3, "timestamp_epoch": "1583962614.758515000" }, { "kind": "http_response", "dst_ip": "10.3.11.194", "fields": { "http.request_in": "19014", "http.content_type": "Content-type: application/octet-stream", "http.response.code": "200", "http.content_length": "582144" }, "src_ip": "64.44.133.131", "dst_port": 49816, "event_id": "evt-165e8f5d937ea1aab07cd0c5", "src_port": 80, "tcp_stream": 434, "udp_stream": null, "body_sha256": "68798ccf8e2a5f9682a4e011bec288ad9b3f900244f82c6ae5e8ca538725f92e", "frame_number": 19533, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": true, "identities": [], "inspected_bytes": 262144, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 582144, "timestamp_epoch": "1583962614.905262000" }, { "kind": "http_response", "dst_ip": "10.3.11.194", "fields": { "http.request_in": "19547", "http.content_type": "text/plain", "http.response.code": "200", "http.content_length": "3" }, "src_ip": "203.176.135.102", "dst_port": 50081, "event_id": "evt-80f5094acefa9b0281bd335b", "src_port": 8082, "tcp_stream": 449, "udp_stream": null, "body_sha256": "c76ea8b0db60dcccfdc0217059e37eb5b10d10940e649f9bc1d07d4ddcc797d1", "frame_number": 19553, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 3, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 3, "timestamp_epoch": "1583962616.819267000" }, { "kind": "http_response", "dst_ip": "10.3.11.194", "fields": { "http.request_in": "19562", "http.content_type": "Content-type: application/octet-stream", "http.response.code": "200", "http.content_length": "582144" }, "src_ip": "64.44.133.131", "dst_port": 50082, "event_id": "evt-fa09464eb6a473c66d3d33f5", "src_port": 80, "tcp_stream": 450, "udp_stream": null, "body_sha256": "fef9b646dba5c7372fe92b6a9d227833c1d15d8cc3a73fd22be9d1869b21cd67", "frame_number": 20107, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": true, "identities": [], "inspected_bytes": 262144, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 582144, "timestamp_epoch": "1583962619.254091000" }, { "kind": "http_response", "dst_ip": "10.3.11.194", "fields": { "http.request_in": "20660", "http.content_type": "text/plain", "http.response.code": "200", "http.content_length": "3" }, "src_ip": "203.176.135.102", "dst_port": 50091, "event_id": "evt-dbeec15111d473b6184ed960", "src_port": 8082, "tcp_stream": 459, "udp_stream": null, "body_sha256": "c76ea8b0db60dcccfdc0217059e37eb5b10d10940e649f9bc1d07d4ddcc797d1", "frame_number": 20667, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 3, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 3, "timestamp_epoch": "1583962620.967231000" }, { "kind": "http_response", "dst_ip": "10.3.11.194", "fields": { "http.request_in": "21096", "http.content_type": "text/plain", "http.response.code": "200", "http.content_length": "3" }, "src_ip": "203.176.135.102", "dst_port": 50098, "event_id": "evt-00a1f57d9b113406282a2257", "src_port": 8082, "tcp_stream": 465, "udp_stream": null, "body_sha256": "c76ea8b0db60dcccfdc0217059e37eb5b10d10940e649f9bc1d07d4ddcc797d1", "frame_number": 21101, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 3, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 3, "timestamp_epoch": "1583962640.726486000" }, { "kind": "http_response", "dst_ip": "10.3.11.119", "fields": { "http.request_in": "21154", "http.response.code": "301", "http.content_length": "0" }, "src_ip": "23.199.252.214", "dst_port": 49817, "event_id": "evt-707293f91bffe970069b6531", "src_port": 80, "tcp_stream": 467, "udp_stream": null, "frame_number": 21169, "timestamp_epoch": "1583962650.477306000" }, { "kind": "http_response", "dst_ip": "10.3.11.119", "fields": { "http.request_in": "21202", "http.response.code": "301", "http.content_length": "0" }, "src_ip": "72.246.84.229", "dst_port": 49819, "event_id": "evt-556f04b74f59a7017c3a897a", "src_port": 80, "tcp_stream": 469, "udp_stream": null, "frame_number": 21208, "timestamp_epoch": "1583962650.585966000" }, { "kind": "http_response", "dst_ip": "10.3.11.119", "fields": { "http.request_in": "21909", "http.content_type": "application/x-pkcs7-crl", "http.response.code": "200", "http.content_length": "758" }, "src_ip": "23.63.253.208", "dst_port": 49841, "event_id": "evt-0921e8dd29978c3f60dedbae", "src_port": 80, "tcp_stream": 491, "udp_stream": null, "body_sha256": "34efd2a999616fb13ef5fadece4481e978c68f2f3416713a4364a21fe81d3243", "frame_number": 21914, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 758, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 758, "timestamp_epoch": "1583962651.474729000" }, { "kind": "http_response", "dst_ip": "10.3.11.194", "fields": { "http.request_in": "26673", "http.content_type": "text/plain", "http.response.code": "200", "http.content_length": "3" }, "src_ip": "203.176.135.102", "dst_port": 50099, "event_id": "evt-9020b217013b7ec80a73a32c", "src_port": 8082, "tcp_stream": 555, "udp_stream": null, "body_sha256": "c76ea8b0db60dcccfdc0217059e37eb5b10d10940e649f9bc1d07d4ddcc797d1", "frame_number": 26675, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 3, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 3, "timestamp_epoch": "1583962673.814886000" }, { "kind": "http_response", "dst_ip": "10.3.11.194", "fields": { "http.request_in": "27391", "http.response.code": "304" }, "src_ip": "205.185.216.42", "dst_port": 50103, "event_id": "evt-51667bca15c7bdcb91352ba3", "src_port": 80, "tcp_stream": 567, "udp_stream": null, "frame_number": 27393, "timestamp_epoch": "1583962744.548553000" }, { "kind": "http_response", "dst_ip": "10.3.11.194", "fields": { "http.request_in": "27394", "http.response.code": "304" }, "src_ip": "205.185.216.42", "dst_port": 50103, "event_id": "evt-67aeb7b6273e7bfaefcb6183", "src_port": 80, "tcp_stream": 567, "udp_stream": null, "frame_number": 27396, "timestamp_epoch": "1583962744.577279000" } ], "tls_client_hello": [ { "kind": "tls_client_hello", "dst_ip": "40.69.218.62", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "geo.prod.do.dsp.mp.microsoft.com" }, "src_ip": "10.3.11.218", "dst_port": 443, "event_id": "evt-07a9a3c8ea55636d283e1461", "src_port": 49699, "tcp_stream": 27, "udp_stream": null, "frame_number": 530, "timestamp_epoch": "1583961757.985150000" }, { "kind": "tls_client_hello", "dst_ip": "23.4.97.247", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "kv801.prod.do.dsp.mp.microsoft.com" }, "src_ip": "10.3.11.218", "dst_port": 443, "event_id": "evt-54c882c5a453d42d8b7b1356", "src_port": 49703, "tcp_stream": 31, "udp_stream": null, "frame_number": 636, "timestamp_epoch": "1583961758.676091000" }, { "kind": "tls_client_hello", "dst_ip": "23.4.97.247", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "cp801.prod.do.dsp.mp.microsoft.com" }, "src_ip": "10.3.11.218", "dst_port": 443, "event_id": "evt-aacbe3ade746ae9fcee913fe", "src_port": 49705, "tcp_stream": 33, "udp_stream": null, "frame_number": 662, "timestamp_epoch": "1583961759.168742000" }, { "kind": "tls_client_hello", "dst_ip": "23.4.97.247", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "cp801.prod.do.dsp.mp.microsoft.com" }, "src_ip": "10.3.11.218", "dst_port": 443, "event_id": "evt-67b9b20477cb81e2f67782e4", "src_port": 49706, "tcp_stream": 34, "udp_stream": null, "frame_number": 687, "timestamp_epoch": "1583961759.341157000" }, { "kind": "tls_client_hello", "dst_ip": "23.4.97.247", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "disc801.prod.do.dsp.mp.microsoft.com" }, "src_ip": "10.3.11.218", "dst_port": 443, "event_id": "evt-17fff370aca1d5c8151c1d2a", "src_port": 49707, "tcp_stream": 35, "udp_stream": null, "frame_number": 697, "timestamp_epoch": "1583961759.392332000" }, { "kind": "tls_client_hello", "dst_ip": "23.4.97.247", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "cp801.prod.do.dsp.mp.microsoft.com" }, "src_ip": "10.3.11.218", "dst_port": 443, "event_id": "evt-c6c8c27c8b14fc51b4237881", "src_port": 49709, "tcp_stream": 37, "udp_stream": null, "frame_number": 728, "timestamp_epoch": "1583961759.638476000" }, { "kind": "tls_client_hello", "dst_ip": "23.4.97.247", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "disc801.prod.do.dsp.mp.microsoft.com" }, "src_ip": "10.3.11.218", "dst_port": 443, "event_id": "evt-cb5924523f20881b1ce92198", "src_port": 49708, "tcp_stream": 36, "udp_stream": null, "frame_number": 730, "timestamp_epoch": "1583961759.638656000" }, { "kind": "tls_client_hello", "dst_ip": "52.161.15.246", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "array801.prod.do.dsp.mp.microsoft.com" }, "src_ip": "10.3.11.218", "dst_port": 443, "event_id": "evt-cc25ec05d34fe2f752bf3718", "src_port": 49710, "tcp_stream": 38, "udp_stream": null, "frame_number": 763, "timestamp_epoch": "1583961759.819059000" }, { "kind": "tls_client_hello", "dst_ip": "52.161.15.246", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "array801.prod.do.dsp.mp.microsoft.com" }, "src_ip": "10.3.11.218", "dst_port": 443, "event_id": "evt-6500976cef0ff0897354f99c", "src_port": 49711, "tcp_stream": 39, "udp_stream": null, "frame_number": 792, "timestamp_epoch": "1583961760.021836000" }, { "kind": "tls_client_hello", "dst_ip": "23.4.97.247", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "cp801.prod.do.dsp.mp.microsoft.com" }, "src_ip": "10.3.11.218", "dst_port": 443, "event_id": "evt-18981ffaa96a33cd7d6f398a", "src_port": 49713, "tcp_stream": 41, "udp_stream": null, "frame_number": 794, "timestamp_epoch": "1583961760.022112000" }, { "kind": "tls_client_hello", "dst_ip": "23.4.97.247", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "disc801.prod.do.dsp.mp.microsoft.com" }, "src_ip": "10.3.11.218", "dst_port": 443, "event_id": "evt-4af87d200eb62e20af62715a", "src_port": 49712, "tcp_stream": 40, "udp_stream": null, "frame_number": 799, "timestamp_epoch": "1583961760.022422000" }, { "kind": "tls_client_hello", "dst_ip": "23.4.97.247", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "disc801.prod.do.dsp.mp.microsoft.com" }, "src_ip": "10.3.11.218", "dst_port": 443, "event_id": "evt-545572cd2c16bfce83e17c4a", "src_port": 49714, "tcp_stream": 42, "udp_stream": null, "frame_number": 868, "timestamp_epoch": "1583961760.475144000" }, { "kind": "tls_client_hello", "dst_ip": "13.78.177.144", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "array807.prod.do.dsp.mp.microsoft.com" }, "src_ip": "10.3.11.218", "dst_port": 443, "event_id": "evt-1ee2cd75d517e12cee558ab3", "src_port": 49715, "tcp_stream": 43, "udp_stream": null, "frame_number": 883, "timestamp_epoch": "1583961760.712168000" }, { "kind": "tls_client_hello", "dst_ip": "52.161.15.246", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "array801.prod.do.dsp.mp.microsoft.com" }, "src_ip": "10.3.11.218", "dst_port": 443, "event_id": "evt-5152687948687987cd6a07b6", "src_port": 49716, "tcp_stream": 44, "udp_stream": null, "frame_number": 904, "timestamp_epoch": "1583961760.850310000" }, { "kind": "tls_client_hello", "dst_ip": "52.114.77.34", "fields": { "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1", "tls.handshake.extensions_server_name": "self.events.data.microsoft.com" }, "src_ip": "10.3.11.218", "dst_port": 443, "event_id": "evt-238dd61461924fe227d95a1c", "src_port": 49722, "tcp_stream": 50, "udp_stream": null, "frame_number": 1023, "timestamp_epoch": "1583961766.883291000" }, { "kind": "tls_client_hello", "dst_ip": "204.79.197.200", "fields": { "tls.handshake.ja3": "9e10692f1b7f78228b2d4e424db3a98c", "tls.handshake.extensions_server_name": "www.bing.com" }, "src_ip": "10.3.11.218", "dst_port": 443, "event_id": "evt-050e6396b76159f04db4e87e", "src_port": 49735, "tcp_stream": 88, "udp_stream": null, "frame_number": 1808, "timestamp_epoch": "1583961788.875575000" }, { "kind": "tls_client_hello", "dst_ip": "23.46.28.16", "fields": { "tls.handshake.ja3": "9e10692f1b7f78228b2d4e424db3a98c", "tls.handshake.extensions_server_name": "fp-as.azureedge.net" }, "src_ip": "10.3.11.218", "dst_port": 443, "event_id": "evt-445f370943151ae80c1e4722", "src_port": 49736, "tcp_stream": 89, "udp_stream": null, "frame_number": 1830, "timestamp_epoch": "1583961789.129686000" }, { "kind": "tls_client_hello", "dst_ip": "204.79.197.254", "fields": { "tls.handshake.ja3": "9e10692f1b7f78228b2d4e424db3a98c", "tls.handshake.extensions_server_name": "a-ring.msedge.net" }, "src_ip": "10.3.11.218", "dst_port": 443, "event_id": "evt-c41d12268069ba130c53f89a", "src_port": 49737, "tcp_stream": 90, "udp_stream": null, "frame_number": 1848, "timestamp_epoch": "1583961789.173140000" }, { "kind": "tls_client_hello", "dst_ip": "13.107.18.254", "fields": { "tls.handshake.ja3": "9e10692f1b7f78228b2d4e424db3a98c", "tls.handshake.extensions_server_name": "k-ring.msedge.net" }, "src_ip": "10.3.11.218", "dst_port": 443, "event_id": "evt-88229993281f65089acad921", "src_port": 49738, "tcp_stream": 91, "udp_stream": null, "frame_number": 1865, "timestamp_epoch": "1583961789.206292000" }, { "kind": "tls_client_hello", "dst_ip": "13.107.246.10", "fields": { "tls.handshake.ja3": "9e10692f1b7f78228b2d4e424db3a98c", "tls.handshake.extensions_server_name": "fp-afd.azureedge.net" }, "src_ip": "10.3.11.218", "dst_port": 443, "event_id": "evt-f30246910e9b1fd3f5476219", "src_port": 49739, "tcp_stream": 92, "udp_stream": null, "frame_number": 1892, "timestamp_epoch": "1583961789.278144000" }, { "kind": "tls_client_hello", "dst_ip": "204.79.197.222", "fields": { "tls.handshake.ja3": "9e10692f1b7f78228b2d4e424db3a98c", "tls.handshake.extensions_server_name": "7754def074cd4b67fe16c8cfdb10e874.clo.footprintdns.com" }, "src_ip": "10.3.11.218", "dst_port": 443, "event_id": "evt-1dfe31aa616cf155cd2f917e", "src_port": 49740, "tcp_stream": 93, "udp_stream": null, "frame_number": 1896, "timestamp_epoch": "1583961789.281231000" }, { "kind": "tls_client_hello", "dst_ip": "52.98.73.226", "fields": { "tls.handshake.ja3": "9e10692f1b7f78228b2d4e424db3a98c", "tls.handshake.extensions_server_name": "3750657afd7bdc4d4398b8849268b8a3.nrb.footprintdns.com" }, "src_ip": "10.3.11.218", "dst_port": 443, "event_id": "evt-7266b026534bd0a86daa6953", "src_port": 49741, "tcp_stream": 94, "udp_stream": null, "frame_number": 1940, "timestamp_epoch": "1583961789.543776000" }, { "kind": "tls_client_hello", "dst_ip": "52.114.77.34", "fields": { "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1", "tls.handshake.extensions_server_name": "self.events.data.microsoft.com" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-f1d217dade439cfa4d3482f2", "src_port": 49700, "tcp_stream": 99, "udp_stream": null, "frame_number": 2024, "timestamp_epoch": "1583961792.836242000" }, { "kind": "tls_client_hello", "dst_ip": "13.107.21.200", "fields": { "tls.handshake.ja3": "9e10692f1b7f78228b2d4e424db3a98c", "tls.handshake.extensions_server_name": "www.bing.com" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-80aded9fc023a1d91998a7bb", "src_port": 49712, "tcp_stream": 111, "udp_stream": null, "frame_number": 2285, "timestamp_epoch": "1583961806.201646000" }, { "kind": "tls_client_hello", "dst_ip": "13.107.42.254", "fields": { "tls.handshake.ja3": "9e10692f1b7f78228b2d4e424db3a98c", "tls.handshake.extensions_server_name": "l-ring.msedge.net" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-95500abc43a37585fd0d2338", "src_port": 49713, "tcp_stream": 112, "udp_stream": null, "frame_number": 2309, "timestamp_epoch": "1583961806.316069000" }, { "kind": "tls_client_hello", "dst_ip": "13.107.246.254", "fields": { "tls.handshake.ja3": "9e10692f1b7f78228b2d4e424db3a98c", "tls.handshake.extensions_server_name": "t-ring.msedge.net" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-b023e0f2469e9aecf3acc5af", "src_port": 49717, "tcp_stream": 116, "udp_stream": null, "frame_number": 2350, "timestamp_epoch": "1583961806.556626000" }, { "kind": "tls_client_hello", "dst_ip": "13.107.246.254", "fields": { "tls.handshake.ja3": "9e10692f1b7f78228b2d4e424db3a98c", "tls.handshake.extensions_server_name": "tring.clo.footprintdns.com" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-cef3fa03d88f3f5be79ab465", "src_port": 49715, "tcp_stream": 114, "udp_stream": null, "frame_number": 2352, "timestamp_epoch": "1583961806.556962000" }, { "kind": "tls_client_hello", "dst_ip": "13.107.6.254", "fields": { "tls.handshake.ja3": "9e10692f1b7f78228b2d4e424db3a98c", "tls.handshake.extensions_server_name": "b-ring.msedge.net" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-309cea6e98b6794f68f730aa", "src_port": 49716, "tcp_stream": 115, "udp_stream": null, "frame_number": 2371, "timestamp_epoch": "1583961806.629972000" }, { "kind": "tls_client_hello", "dst_ip": "13.107.3.254", "fields": { "tls.handshake.ja3": "9e10692f1b7f78228b2d4e424db3a98c", "tls.handshake.extensions_server_name": "s-ring.msedge.net" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-8c43e3d38c569a3b4c973390", "src_port": 49714, "tcp_stream": 113, "udp_stream": null, "frame_number": 2373, "timestamp_epoch": "1583961806.630592000" }, { "kind": "tls_client_hello", "dst_ip": "13.107.43.14", "fields": { "tls.handshake.ja3": "9e10692f1b7f78228b2d4e424db3a98c", "tls.handshake.extensions_server_name": "rum18.perf.linkedin.com" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-be4a3c6ab5c92dcd2221bcfc", "src_port": 49718, "tcp_stream": 117, "udp_stream": null, "frame_number": 2397, "timestamp_epoch": "1583961806.671116000" }, { "kind": "tls_client_hello", "dst_ip": "40.69.218.62", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "geo.prod.do.dsp.mp.microsoft.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-b5834a1ea7561bf903547529", "src_port": 49695, "tcp_stream": 142, "udp_stream": null, "frame_number": 3011, "timestamp_epoch": "1583961815.375939000" }, { "kind": "tls_client_hello", "dst_ip": "52.109.12.19", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "nexusrules.officeapps.live.com" }, "src_ip": "10.3.11.218", "dst_port": 443, "event_id": "evt-7a2dfe534a2406889321deed", "src_port": 49742, "tcp_stream": 148, "udp_stream": null, "frame_number": 3126, "timestamp_epoch": "1583961816.796778000" }, { "kind": "tls_client_hello", "dst_ip": "23.4.97.247", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "kv801.prod.do.dsp.mp.microsoft.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-476695c3240d5fe933becd38", "src_port": 49700, "tcp_stream": 147, "udp_stream": null, "frame_number": 3145, "timestamp_epoch": "1583961817.068136000" }, { "kind": "tls_client_hello", "dst_ip": "23.4.97.247", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "cp801.prod.do.dsp.mp.microsoft.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-fdbb0d160198137f5205e507", "src_port": 49701, "tcp_stream": 149, "udp_stream": null, "frame_number": 3169, "timestamp_epoch": "1583961817.254324000" }, { "kind": "tls_client_hello", "dst_ip": "23.4.97.247", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "cp801.prod.do.dsp.mp.microsoft.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-e6e5547a7bd796730f83f6a8", "src_port": 49703, "tcp_stream": 151, "udp_stream": null, "frame_number": 3196, "timestamp_epoch": "1583961817.414873000" }, { "kind": "tls_client_hello", "dst_ip": "23.4.97.247", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "disc801.prod.do.dsp.mp.microsoft.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-6126a00ca0e13c9db0e3252e", "src_port": 49702, "tcp_stream": 150, "udp_stream": null, "frame_number": 3197, "timestamp_epoch": "1583961817.414916000" }, { "kind": "tls_client_hello", "dst_ip": "52.161.15.246", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "array801.prod.do.dsp.mp.microsoft.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-0852351adc7b1674a0e93a39", "src_port": 49704, "tcp_stream": 152, "udp_stream": null, "frame_number": 3245, "timestamp_epoch": "1583961817.609710000" }, { "kind": "tls_client_hello", "dst_ip": "23.4.97.247", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "disc801.prod.do.dsp.mp.microsoft.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-a68afa4109ab5027c0d4f8f9", "src_port": 49705, "tcp_stream": 153, "udp_stream": null, "frame_number": 3247, "timestamp_epoch": "1583961817.610058000" }, { "kind": "tls_client_hello", "dst_ip": "23.4.97.247", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "cp801.prod.do.dsp.mp.microsoft.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-d13a8e3fa4052364e9dd1f97", "src_port": 49706, "tcp_stream": 154, "udp_stream": null, "frame_number": 3249, "timestamp_epoch": "1583961817.610179000" }, { "kind": "tls_client_hello", "dst_ip": "23.4.97.247", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "disc801.prod.do.dsp.mp.microsoft.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-7a884ba1b7bb2cc4f939ddb0", "src_port": 49707, "tcp_stream": 155, "udp_stream": null, "frame_number": 3306, "timestamp_epoch": "1583961817.729255000" }, { "kind": "tls_client_hello", "dst_ip": "23.4.97.247", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "cp801.prod.do.dsp.mp.microsoft.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-f4d0d2d33208ab1d002cfad2", "src_port": 49708, "tcp_stream": 156, "udp_stream": null, "frame_number": 3311, "timestamp_epoch": "1583961817.732630000" }, { "kind": "tls_client_hello", "dst_ip": "13.78.187.58", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "array802.prod.do.dsp.mp.microsoft.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-4946b15a3d84df3dc38d7008", "src_port": 49709, "tcp_stream": 157, "udp_stream": null, "frame_number": 3324, "timestamp_epoch": "1583961817.766377000" }, { "kind": "tls_client_hello", "dst_ip": "23.4.97.247", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "disc801.prod.do.dsp.mp.microsoft.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-5143de6a770083601c3c51af", "src_port": 49710, "tcp_stream": 158, "udp_stream": null, "frame_number": 3371, "timestamp_epoch": "1583961817.853953000" }, { "kind": "tls_client_hello", "dst_ip": "23.4.97.247", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "cp801.prod.do.dsp.mp.microsoft.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-f302d157cc930cb7c7e4671c", "src_port": 49711, "tcp_stream": 159, "udp_stream": null, "frame_number": 3378, "timestamp_epoch": "1583961817.868436000" }, { "kind": "tls_client_hello", "dst_ip": "52.161.15.246", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "array801.prod.do.dsp.mp.microsoft.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-e74112a232c12becb49a761a", "src_port": 49712, "tcp_stream": 160, "udp_stream": null, "frame_number": 3391, "timestamp_epoch": "1583961817.934203000" }, { "kind": "tls_client_hello", "dst_ip": "52.161.15.246", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "array801.prod.do.dsp.mp.microsoft.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-91cac735e99cd6903187536e", "src_port": 49713, "tcp_stream": 161, "udp_stream": null, "frame_number": 3433, "timestamp_epoch": "1583961818.069474000" }, { "kind": "tls_client_hello", "dst_ip": "23.4.97.247", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "cp801.prod.do.dsp.mp.microsoft.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-729bb88dda940fba7b448f7a", "src_port": 49715, "tcp_stream": 163, "udp_stream": null, "frame_number": 3455, "timestamp_epoch": "1583961818.252446000" }, { "kind": "tls_client_hello", "dst_ip": "23.4.97.247", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "disc801.prod.do.dsp.mp.microsoft.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-319d37c9ce8ccf3a9d4ef4f6", "src_port": 49714, "tcp_stream": 162, "udp_stream": null, "frame_number": 3457, "timestamp_epoch": "1583961818.252809000" }, { "kind": "tls_client_hello", "dst_ip": "23.4.97.247", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "disc801.prod.do.dsp.mp.microsoft.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-4ad397ea65d85ccc914f7915", "src_port": 49716, "tcp_stream": 164, "udp_stream": null, "frame_number": 3509, "timestamp_epoch": "1583961818.471038000" }, { "kind": "tls_client_hello", "dst_ip": "23.4.97.247", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "cp801.prod.do.dsp.mp.microsoft.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-bdd78f39659da2f2c0be96e6", "src_port": 49717, "tcp_stream": 165, "udp_stream": null, "frame_number": 3522, "timestamp_epoch": "1583961818.522859000" }, { "kind": "tls_client_hello", "dst_ip": "13.78.186.254", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "array803.prod.do.dsp.mp.microsoft.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-fc8b2cf30ebf10c0ff67d8a5", "src_port": 49718, "tcp_stream": 166, "udp_stream": null, "frame_number": 3532, "timestamp_epoch": "1583961818.592581000" }, { "kind": "tls_client_hello", "dst_ip": "23.4.97.247", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "disc801.prod.do.dsp.mp.microsoft.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-460160e00499c57356ed45bb", "src_port": 49720, "tcp_stream": 168, "udp_stream": null, "frame_number": 3576, "timestamp_epoch": "1583961818.884193000" }, { "kind": "tls_client_hello", "dst_ip": "52.161.15.246", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "array801.prod.do.dsp.mp.microsoft.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-52d7247aaea593eccb01d694", "src_port": 49719, "tcp_stream": 167, "udp_stream": null, "frame_number": 3578, "timestamp_epoch": "1583961818.884505000" }, { "kind": "tls_client_hello", "dst_ip": "40.119.2.214", "fields": { "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1", "tls.handshake.extensions_server_name": "settings-win.data.microsoft.com" }, "src_ip": "10.3.11.218", "dst_port": 443, "event_id": "evt-986dff82f329de675dad13cc", "src_port": 49743, "tcp_stream": 174, "udp_stream": null, "frame_number": 3703, "timestamp_epoch": "1583961823.830970000" }, { "kind": "tls_client_hello", "dst_ip": "52.114.132.73", "fields": { "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1", "tls.handshake.extensions_server_name": "self.events.data.microsoft.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-455e46dfe1e560c3fb7abd90", "src_port": 49726, "tcp_stream": 175, "udp_stream": null, "frame_number": 3710, "timestamp_epoch": "1583961824.060099000" }, { "kind": "tls_client_hello", "dst_ip": "204.79.197.200", "fields": { "tls.handshake.ja3": "9e10692f1b7f78228b2d4e424db3a98c", "tls.handshake.extensions_server_name": "www.bing.com" }, "src_ip": "10.3.11.218", "dst_port": 443, "event_id": "evt-eb00d3377d0edbc15fb8cc5d", "src_port": 49744, "tcp_stream": 187, "udp_stream": null, "frame_number": 3984, "timestamp_epoch": "1583961832.930417000" }, { "kind": "tls_client_hello", "dst_ip": "52.179.129.229", "fields": { "tls.handshake.ja3": "9e10692f1b7f78228b2d4e424db3a98c", "tls.handshake.extensions_server_name": "arc.msn.com" }, "src_ip": "10.3.11.218", "dst_port": 443, "event_id": "evt-e219554938a812eb2fa8f8c0", "src_port": 49745, "tcp_stream": 188, "udp_stream": null, "frame_number": 4013, "timestamp_epoch": "1583961833.340258000" }, { "kind": "tls_client_hello", "dst_ip": "13.107.21.200", "fields": { "tls.handshake.ja3": "10ee8d30a5d01c042afd7b2b205facc4", "tls.handshake.extensions_server_name": "www.bing.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-d2919b951e661fe4ddca779b", "src_port": 49738, "tcp_stream": 189, "udp_stream": null, "frame_number": 4042, "timestamp_epoch": "1583961837.147559000" }, { "kind": "tls_client_hello", "dst_ip": "13.107.18.254", "fields": { "tls.handshake.ja3": "10ee8d30a5d01c042afd7b2b205facc4", "tls.handshake.extensions_server_name": "k-ring.msedge.net" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-5b2f69f906690376b6b13f33", "src_port": 49739, "tcp_stream": 190, "udp_stream": null, "frame_number": 4061, "timestamp_epoch": "1583961837.193573000" }, { "kind": "tls_client_hello", "dst_ip": "13.107.136.254", "fields": { "tls.handshake.ja3": "10ee8d30a5d01c042afd7b2b205facc4", "tls.handshake.extensions_server_name": "spo-ring.msedge.net" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-04526502cf06239a58cf2d61", "src_port": 49740, "tcp_stream": 191, "udp_stream": null, "frame_number": 4078, "timestamp_epoch": "1583961837.245010000" }, { "kind": "tls_client_hello", "dst_ip": "72.21.81.200", "fields": { "tls.handshake.ja3": "10ee8d30a5d01c042afd7b2b205facc4", "tls.handshake.extensions_server_name": "fp-vp.azureedge.net" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-5416f561d98e24578d95dd16", "src_port": 49741, "tcp_stream": 192, "udp_stream": null, "frame_number": 4084, "timestamp_epoch": "1583961837.246764000" }, { "kind": "tls_client_hello", "dst_ip": "204.79.197.200", "fields": { "tls.handshake.ja3": "9e10692f1b7f78228b2d4e424db3a98c", "tls.handshake.extensions_server_name": "www.bing.com" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-3c4140896e1287ad5607f6c6", "src_port": 49719, "tcp_stream": 197, "udp_stream": null, "frame_number": 4261, "timestamp_epoch": "1583961848.585761000" }, { "kind": "tls_client_hello", "dst_ip": "52.179.129.229", "fields": { "tls.handshake.ja3": "9e10692f1b7f78228b2d4e424db3a98c", "tls.handshake.extensions_server_name": "arc.msn.com" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-84cc965822f9b33d81dba217", "src_port": 49720, "tcp_stream": 198, "udp_stream": null, "frame_number": 4288, "timestamp_epoch": "1583961848.891023000" }, { "kind": "tls_client_hello", "dst_ip": "13.107.3.128", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "config.edge.skype.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-cd48d595fca9d7301ddaa917", "src_port": 49742, "tcp_stream": 199, "udp_stream": null, "frame_number": 4346, "timestamp_epoch": "1583961854.558232000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.194.42", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "fonts.googleapis.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-6915014da1d2b437f4e0ac86", "src_port": 49745, "tcp_stream": 202, "udp_stream": null, "frame_number": 4402, "timestamp_epoch": "1583961854.778012000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.194.131", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "fonts.gstatic.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-ccfa857775c2b70410f21007", "src_port": 49746, "tcp_stream": 203, "udp_stream": null, "frame_number": 4406, "timestamp_epoch": "1583961854.782581000" }, { "kind": "tls_client_hello", "dst_ip": "23.211.18.27", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "img1.wsimg.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-ea4ed0cdcabb73601c114ef0", "src_port": 49747, "tcp_stream": 204, "udp_stream": null, "frame_number": 4410, "timestamp_epoch": "1583961854.790146000" }, { "kind": "tls_client_hello", "dst_ip": "23.211.18.27", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "img4.wsimg.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-45b8100434a4d9adf7bec0b7", "src_port": 49752, "tcp_stream": 209, "udp_stream": null, "frame_number": 4473, "timestamp_epoch": "1583961854.850374000" }, { "kind": "tls_client_hello", "dst_ip": "104.26.9.32", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "fh-kit.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-e97819d30e5a9b41ea510eed", "src_port": 49756, "tcp_stream": 213, "udp_stream": null, "frame_number": 4483, "timestamp_epoch": "1583961854.852181000" }, { "kind": "tls_client_hello", "dst_ip": "23.211.18.27", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "img2.wsimg.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-b6ab108e72f8436957f89960", "src_port": 49757, "tcp_stream": 214, "udp_stream": null, "frame_number": 4494, "timestamp_epoch": "1583961854.862048000" }, { "kind": "tls_client_hello", "dst_ip": "52.9.108.55", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "fareharbor.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-cac92072c2f18616c8af7354", "src_port": 49760, "tcp_stream": 217, "udp_stream": null, "frame_number": 4563, "timestamp_epoch": "1583961854.999425000" }, { "kind": "tls_client_hello", "dst_ip": "72.246.84.150", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "s7.addthis.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-8f648ed1dd7bd3730f6d0be6", "src_port": 49761, "tcp_stream": 218, "udp_stream": null, "frame_number": 4572, "timestamp_epoch": "1583961855.058332000" }, { "kind": "tls_client_hello", "dst_ip": "23.211.18.27", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "img1.wsimg.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-85b41884522acceb0144c93d", "src_port": 49762, "tcp_stream": 219, "udp_stream": null, "frame_number": 4731, "timestamp_epoch": "1583961855.227464000" }, { "kind": "tls_client_hello", "dst_ip": "13.249.26.99", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "dp58aslhmbcib.cloudfront.net" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-302916f7931983c71b336b58", "src_port": 49772, "tcp_stream": 229, "udp_stream": null, "frame_number": 5234, "timestamp_epoch": "1583961856.361784000" }, { "kind": "tls_client_hello", "dst_ip": "13.249.26.99", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "dp58aslhmbcib.cloudfront.net" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-a4e4b8d5b8f641e06ec1267b", "src_port": 49771, "tcp_stream": 228, "udp_stream": null, "frame_number": 5236, "timestamp_epoch": "1583961856.362025000" }, { "kind": "tls_client_hello", "dst_ip": "13.249.26.99", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "dp58aslhmbcib.cloudfront.net" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-0859a48b454c9396506c347b", "src_port": 49770, "tcp_stream": 227, "udp_stream": null, "frame_number": 5238, "timestamp_epoch": "1583961856.362599000" }, { "kind": "tls_client_hello", "dst_ip": "13.249.26.99", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "dp58aslhmbcib.cloudfront.net" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-7427324cc1a6a90446d0bb58", "src_port": 49769, "tcp_stream": 226, "udp_stream": null, "frame_number": 5240, "timestamp_epoch": "1583961856.362849000" }, { "kind": "tls_client_hello", "dst_ip": "13.249.26.99", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "dp58aslhmbcib.cloudfront.net" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-0222955e3736bb8af65bdaa6", "src_port": 49768, "tcp_stream": 225, "udp_stream": null, "frame_number": 5242, "timestamp_epoch": "1583961856.363062000" }, { "kind": "tls_client_hello", "dst_ip": "23.44.170.27", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "z.moatads.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-4d3955a283bb2bf1966916a9", "src_port": 49773, "tcp_stream": 230, "udp_stream": null, "frame_number": 5257, "timestamp_epoch": "1583961856.395511000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.193.142", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "www.google-analytics.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-a5cc3076a8c9ff2a92c2e7c7", "src_port": 49778, "tcp_stream": 235, "udp_stream": null, "frame_number": 6025, "timestamp_epoch": "1583961857.085776000" }, { "kind": "tls_client_hello", "dst_ip": "31.13.65.7", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "connect.facebook.net" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-1e4880000e4df940883abbd1", "src_port": 49776, "tcp_stream": 233, "udp_stream": null, "frame_number": 6063, "timestamp_epoch": "1583961857.209451000" }, { "kind": "tls_client_hello", "dst_ip": "31.13.65.7", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "connect.facebook.net" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-13d412395c0842ab57be83d1", "src_port": 49779, "tcp_stream": 236, "udp_stream": null, "frame_number": 6070, "timestamp_epoch": "1583961857.209880000" }, { "kind": "tls_client_hello", "dst_ip": "151.101.50.208", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "fh-sites.imgix.net" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-1472f3158af2d9e777dc2423", "src_port": 49777, "tcp_stream": 234, "udp_stream": null, "frame_number": 6072, "timestamp_epoch": "1583961857.210102000" }, { "kind": "tls_client_hello", "dst_ip": "72.21.91.66", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "platform.twitter.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-cacd9d2f5f47d940a2e3172e", "src_port": 49784, "tcp_stream": 241, "udp_stream": null, "frame_number": 6672, "timestamp_epoch": "1583961857.434186000" }, { "kind": "tls_client_hello", "dst_ip": "72.21.91.66", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "platform.twitter.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-c291b6d06ae7f09f76e35335", "src_port": 49784, "tcp_stream": 241, "udp_stream": null, "frame_number": 6820, "timestamp_epoch": "1583961857.462573000" }, { "kind": "tls_client_hello", "dst_ip": "31.13.65.7", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "connect.facebook.net" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-6f14518d941d50923581aedf", "src_port": 49785, "tcp_stream": 242, "udp_stream": null, "frame_number": 6969, "timestamp_epoch": "1583961857.606073000" }, { "kind": "tls_client_hello", "dst_ip": "104.244.42.8", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "syndication.twitter.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-a5c822a460784b58c00c3c87", "src_port": 49786, "tcp_stream": 243, "udp_stream": null, "frame_number": 7201, "timestamp_epoch": "1583961857.859694000" }, { "kind": "tls_client_hello", "dst_ip": "31.13.93.35", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "www.facebook.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-6987d50fabe94c9b157c473d", "src_port": 49787, "tcp_stream": 244, "udp_stream": null, "frame_number": 7216, "timestamp_epoch": "1583961858.018771000" }, { "kind": "tls_client_hello", "dst_ip": "31.13.93.35", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "www.facebook.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-86e8e27a01ad27f7976d42b4", "src_port": 49788, "tcp_stream": 245, "udp_stream": null, "frame_number": 7229, "timestamp_epoch": "1583961858.043596000" }, { "kind": "tls_client_hello", "dst_ip": "23.206.208.173", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "img.secureserver.net" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-433c7da1b016c860143a4201", "src_port": 49791, "tcp_stream": 248, "udp_stream": null, "frame_number": 7657, "timestamp_epoch": "1583961859.434570000" }, { "kind": "tls_client_hello", "dst_ip": "40.126.0.67", "fields": { "tls.handshake.ja3": "9e10692f1b7f78228b2d4e424db3a98c", "tls.handshake.extensions_server_name": "login.microsoftonline.com" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-436267256f445644ce55a871", "src_port": 49725, "tcp_stream": 255, "udp_stream": null, "frame_number": 8142, "timestamp_epoch": "1583961870.514628000" }, { "kind": "tls_client_hello", "dst_ip": "52.109.12.19", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "nexusrules.officeapps.live.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-a1c17bbacdc088bad2dc11d2", "src_port": 49797, "tcp_stream": 257, "udp_stream": null, "frame_number": 8547, "timestamp_epoch": "1583961873.895527000" }, { "kind": "tls_client_hello", "dst_ip": "40.90.22.185", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "login.live.com" }, "src_ip": "10.3.11.218", "dst_port": 443, "event_id": "evt-676092878f1bdcbf57f67b4c", "src_port": 49750, "tcp_stream": 258, "udp_stream": null, "frame_number": 8559, "timestamp_epoch": "1583961874.042185000" }, { "kind": "tls_client_hello", "dst_ip": "52.114.132.73", "fields": { "tls.handshake.ja3": "37f463bf4616ecd445d4a1937da06e19", "tls.handshake.extensions_server_name": "self.events.data.microsoft.com" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-72c4ac69f516e5b39e4efbf4", "src_port": 49728, "tcp_stream": 260, "udp_stream": null, "frame_number": 9010, "timestamp_epoch": "1583961880.113934000" }, { "kind": "tls_client_hello", "dst_ip": "13.107.6.158", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "edge.microsoft.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-3b7a56f6fe6bacf2726c2345", "src_port": 49802, "tcp_stream": 267, "udp_stream": null, "frame_number": 10216, "timestamp_epoch": "1583961911.827180000" }, { "kind": "tls_client_hello", "dst_ip": "52.109.12.19", "fields": { "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1", "tls.handshake.extensions_server_name": "nexusrules.officeapps.live.com" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-cd1dc758149d8a078af2d52c", "src_port": 49729, "tcp_stream": 269, "udp_stream": null, "frame_number": 10343, "timestamp_epoch": "1583961936.268519000" }, { "kind": "tls_client_hello", "dst_ip": "204.79.197.200", "fields": { "tls.handshake.ja3": "9e10692f1b7f78228b2d4e424db3a98c", "tls.handshake.extensions_server_name": "www.bing.com" }, "src_ip": "10.3.11.218", "dst_port": 443, "event_id": "evt-f114fb68fdb5fd7e64dac149", "src_port": 49757, "tcp_stream": 270, "udp_stream": null, "frame_number": 10361, "timestamp_epoch": "1583961938.572660000" }, { "kind": "tls_client_hello", "dst_ip": "13.68.93.109", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "slscr.update.microsoft.com" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-c573c141cd783835accd9af6", "src_port": 49730, "tcp_stream": 271, "udp_stream": null, "frame_number": 10460, "timestamp_epoch": "1583961954.945579000" }, { "kind": "tls_client_hello", "dst_ip": "40.90.22.191", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "login.live.com" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-a7867dccca5970f7f1ecca08", "src_port": 49731, "tcp_stream": 272, "udp_stream": null, "frame_number": 10486, "timestamp_epoch": "1583961955.673504000" }, { "kind": "tls_client_hello", "dst_ip": "40.91.76.238", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "licensing.mp.microsoft.com" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-c1aafe50d1a4d0d9f1d1dd39", "src_port": 49733, "tcp_stream": 274, "udp_stream": null, "frame_number": 10544, "timestamp_epoch": "1583961956.451347000" }, { "kind": "tls_client_hello", "dst_ip": "40.91.76.238", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "licensing.mp.microsoft.com" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-fa03432949a22a4193b4cad3", "src_port": 49734, "tcp_stream": 275, "udp_stream": null, "frame_number": 10579, "timestamp_epoch": "1583961956.967598000" }, { "kind": "tls_client_hello", "dst_ip": "40.91.76.238", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "licensing.mp.microsoft.com" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-a311bc1ad6f8a3312f378374", "src_port": 49735, "tcp_stream": 276, "udp_stream": null, "frame_number": 10619, "timestamp_epoch": "1583961957.509495000" }, { "kind": "tls_client_hello", "dst_ip": "40.91.76.238", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "licensing.mp.microsoft.com" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-72f76c28a78c1c9ce2cacfa2", "src_port": 49736, "tcp_stream": 277, "udp_stream": null, "frame_number": 10654, "timestamp_epoch": "1583961957.908155000" }, { "kind": "tls_client_hello", "dst_ip": "40.91.76.238", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "licensing.mp.microsoft.com" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-0490bd6736432d065906efa6", "src_port": 49737, "tcp_stream": 278, "udp_stream": null, "frame_number": 10693, "timestamp_epoch": "1583961958.473427000" }, { "kind": "tls_client_hello", "dst_ip": "40.91.76.238", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "licensing.mp.microsoft.com" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-90707c110fae245c744a82b1", "src_port": 49738, "tcp_stream": 279, "udp_stream": null, "frame_number": 10731, "timestamp_epoch": "1583961958.952336000" }, { "kind": "tls_client_hello", "dst_ip": "40.91.76.238", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "licensing.mp.microsoft.com" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-224e5db6f071939aa0568202", "src_port": 49739, "tcp_stream": 280, "udp_stream": null, "frame_number": 10770, "timestamp_epoch": "1583961959.444313000" }, { "kind": "tls_client_hello", "dst_ip": "40.91.76.238", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "licensing.mp.microsoft.com" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-1673a6931bfb74fd4ddfa5f3", "src_port": 49740, "tcp_stream": 281, "udp_stream": null, "frame_number": 10806, "timestamp_epoch": "1583961959.828090000" }, { "kind": "tls_client_hello", "dst_ip": "40.91.76.238", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "licensing.mp.microsoft.com" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-801f3d3d1b11d2001d96bc3c", "src_port": 49741, "tcp_stream": 282, "udp_stream": null, "frame_number": 10847, "timestamp_epoch": "1583961960.315824000" }, { "kind": "tls_client_hello", "dst_ip": "40.91.76.238", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "licensing.mp.microsoft.com" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-b576e9f35cb6b74682623154", "src_port": 49742, "tcp_stream": 283, "udp_stream": null, "frame_number": 10885, "timestamp_epoch": "1583961960.723260000" }, { "kind": "tls_client_hello", "dst_ip": "40.91.76.238", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "licensing.mp.microsoft.com" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-87c20834b95adbbc2279d5b8", "src_port": 49743, "tcp_stream": 284, "udp_stream": null, "frame_number": 10922, "timestamp_epoch": "1583961961.138026000" }, { "kind": "tls_client_hello", "dst_ip": "40.91.76.238", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "licensing.mp.microsoft.com" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-8a000f467e885a22ff649d27", "src_port": 49744, "tcp_stream": 285, "udp_stream": null, "frame_number": 10961, "timestamp_epoch": "1583961961.686454000" }, { "kind": "tls_client_hello", "dst_ip": "40.91.76.238", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "licensing.mp.microsoft.com" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-832abf6ee758721dc29a965d", "src_port": 49745, "tcp_stream": 286, "udp_stream": null, "frame_number": 11000, "timestamp_epoch": "1583961962.169425000" }, { "kind": "tls_client_hello", "dst_ip": "40.91.76.238", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "licensing.mp.microsoft.com" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-21a0439973f88d147050818b", "src_port": 49746, "tcp_stream": 287, "udp_stream": null, "frame_number": 11036, "timestamp_epoch": "1583961962.564634000" }, { "kind": "tls_client_hello", "dst_ip": "40.91.76.238", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "licensing.mp.microsoft.com" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-b331317990465f239321cece", "src_port": 49747, "tcp_stream": 288, "udp_stream": null, "frame_number": 11075, "timestamp_epoch": "1583961963.076170000" }, { "kind": "tls_client_hello", "dst_ip": "40.91.76.238", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "licensing.mp.microsoft.com" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-90f27d8b85517a445f5d88d8", "src_port": 49748, "tcp_stream": 289, "udp_stream": null, "frame_number": 11111, "timestamp_epoch": "1583961963.485586000" }, { "kind": "tls_client_hello", "dst_ip": "40.91.76.238", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "licensing.mp.microsoft.com" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-b119a4eaa885bb4b5fcaf7a7", "src_port": 49749, "tcp_stream": 290, "udp_stream": null, "frame_number": 11147, "timestamp_epoch": "1583961963.853634000" }, { "kind": "tls_client_hello", "dst_ip": "40.91.76.238", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "licensing.mp.microsoft.com" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-1a51198e2c816c851d238a09", "src_port": 49750, "tcp_stream": 291, "udp_stream": null, "frame_number": 11182, "timestamp_epoch": "1583961964.383785000" }, { "kind": "tls_client_hello", "dst_ip": "40.91.76.238", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "licensing.mp.microsoft.com" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-e5562c97d72e62cd37075290", "src_port": 49751, "tcp_stream": 292, "udp_stream": null, "frame_number": 11224, "timestamp_epoch": "1583961964.797598000" }, { "kind": "tls_client_hello", "dst_ip": "40.91.76.238", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "licensing.mp.microsoft.com" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-648609c60f0c2d87b59b1f1e", "src_port": 49752, "tcp_stream": 293, "udp_stream": null, "frame_number": 11261, "timestamp_epoch": "1583961965.392365000" }, { "kind": "tls_client_hello", "dst_ip": "40.91.76.238", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "licensing.mp.microsoft.com" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-4524a55cff17bedb8d83ccea", "src_port": 49753, "tcp_stream": 294, "udp_stream": null, "frame_number": 11300, "timestamp_epoch": "1583961965.819240000" }, { "kind": "tls_client_hello", "dst_ip": "40.91.76.238", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "licensing.mp.microsoft.com" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-816f5059bae824b0266cb30a", "src_port": 49754, "tcp_stream": 295, "udp_stream": null, "frame_number": 11337, "timestamp_epoch": "1583961966.211132000" }, { "kind": "tls_client_hello", "dst_ip": "40.91.76.238", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "licensing.mp.microsoft.com" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-c90722e616d563ca94d35681", "src_port": 49755, "tcp_stream": 296, "udp_stream": null, "frame_number": 11373, "timestamp_epoch": "1583961966.659923000" }, { "kind": "tls_client_hello", "dst_ip": "40.91.76.238", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "licensing.mp.microsoft.com" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-af1b2efebd279547c362d2ff", "src_port": 49756, "tcp_stream": 297, "udp_stream": null, "frame_number": 11412, "timestamp_epoch": "1583961967.161856000" }, { "kind": "tls_client_hello", "dst_ip": "40.91.76.238", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "licensing.mp.microsoft.com" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-61305c47240ae7169b8763db", "src_port": 49757, "tcp_stream": 298, "udp_stream": null, "frame_number": 11450, "timestamp_epoch": "1583961967.687981000" }, { "kind": "tls_client_hello", "dst_ip": "40.91.76.238", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "licensing.mp.microsoft.com" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-1ca068e67736e91df110954c", "src_port": 49758, "tcp_stream": 299, "udp_stream": null, "frame_number": 11489, "timestamp_epoch": "1583961968.157052000" }, { "kind": "tls_client_hello", "dst_ip": "40.91.76.238", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "licensing.mp.microsoft.com" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-b25a1eaa0c51244c5495ab63", "src_port": 49759, "tcp_stream": 300, "udp_stream": null, "frame_number": 11524, "timestamp_epoch": "1583961968.577132000" }, { "kind": "tls_client_hello", "dst_ip": "40.91.76.238", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "licensing.mp.microsoft.com" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-d30d4debe7c2c9460cea3562", "src_port": 49760, "tcp_stream": 301, "udp_stream": null, "frame_number": 11559, "timestamp_epoch": "1583961969.015303000" }, { "kind": "tls_client_hello", "dst_ip": "40.91.76.238", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "licensing.mp.microsoft.com" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-4c4ef4092849baa6f1e149d9", "src_port": 49761, "tcp_stream": 302, "udp_stream": null, "frame_number": 11598, "timestamp_epoch": "1583961969.527340000" }, { "kind": "tls_client_hello", "dst_ip": "40.91.76.238", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "licensing.mp.microsoft.com" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-1cc2b64f96314efa81782ba4", "src_port": 49762, "tcp_stream": 303, "udp_stream": null, "frame_number": 11638, "timestamp_epoch": "1583961969.985622000" }, { "kind": "tls_client_hello", "dst_ip": "40.91.76.238", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "licensing.mp.microsoft.com" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-9b5100949d91e6eebd314c80", "src_port": 49763, "tcp_stream": 304, "udp_stream": null, "frame_number": 11677, "timestamp_epoch": "1583961970.523937000" }, { "kind": "tls_client_hello", "dst_ip": "40.91.76.238", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "licensing.mp.microsoft.com" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-6f9523a95fe4f64cfeca3fa8", "src_port": 49764, "tcp_stream": 305, "udp_stream": null, "frame_number": 11713, "timestamp_epoch": "1583961970.933434000" }, { "kind": "tls_client_hello", "dst_ip": "40.91.76.238", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "licensing.mp.microsoft.com" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-c52183ec5d48c156862132e1", "src_port": 49765, "tcp_stream": 306, "udp_stream": null, "frame_number": 11748, "timestamp_epoch": "1583961971.343610000" }, { "kind": "tls_client_hello", "dst_ip": "40.91.76.238", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "licensing.mp.microsoft.com" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-2e339674f8a06d6db043c903", "src_port": 49766, "tcp_stream": 307, "udp_stream": null, "frame_number": 11788, "timestamp_epoch": "1583961972.489254000" }, { "kind": "tls_client_hello", "dst_ip": "40.91.76.238", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "licensing.mp.microsoft.com" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-36dffe87dd76e20100082f89", "src_port": 49767, "tcp_stream": 308, "udp_stream": null, "frame_number": 11825, "timestamp_epoch": "1583961972.976924000" }, { "kind": "tls_client_hello", "dst_ip": "40.91.76.238", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "licensing.mp.microsoft.com" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-fdf64d38adb6e8a1799d1513", "src_port": 49768, "tcp_stream": 309, "udp_stream": null, "frame_number": 11864, "timestamp_epoch": "1583961973.572380000" }, { "kind": "tls_client_hello", "dst_ip": "40.91.76.238", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "licensing.mp.microsoft.com" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-90265ccb8329e41fe2fa060c", "src_port": 49769, "tcp_stream": 310, "udp_stream": null, "frame_number": 11903, "timestamp_epoch": "1583961974.271138000" }, { "kind": "tls_client_hello", "dst_ip": "40.91.76.238", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "licensing.mp.microsoft.com" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-c62d46fe13fb280d89473ab8", "src_port": 49770, "tcp_stream": 311, "udp_stream": null, "frame_number": 11939, "timestamp_epoch": "1583961974.959790000" }, { "kind": "tls_client_hello", "dst_ip": "40.91.76.238", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "licensing.mp.microsoft.com" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-8e54f01280e279f04a5f09a7", "src_port": 49771, "tcp_stream": 312, "udp_stream": null, "frame_number": 11974, "timestamp_epoch": "1583961975.364312000" }, { "kind": "tls_client_hello", "dst_ip": "40.91.76.238", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "licensing.mp.microsoft.com" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-296470be4182ccf2da2a17e9", "src_port": 49772, "tcp_stream": 313, "udp_stream": null, "frame_number": 12010, "timestamp_epoch": "1583961975.740339000" }, { "kind": "tls_client_hello", "dst_ip": "40.91.76.238", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "licensing.mp.microsoft.com" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-e680c131b4a8d2d9323c552f", "src_port": 49773, "tcp_stream": 314, "udp_stream": null, "frame_number": 12047, "timestamp_epoch": "1583961976.484372000" }, { "kind": "tls_client_hello", "dst_ip": "40.91.76.238", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "licensing.mp.microsoft.com" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-d4ecaa51c8f55cbb9d3e525b", "src_port": 49774, "tcp_stream": 315, "udp_stream": null, "frame_number": 12087, "timestamp_epoch": "1583961976.993879000" }, { "kind": "tls_client_hello", "dst_ip": "40.91.76.238", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "licensing.mp.microsoft.com" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-74e994dc310a7a3386fbf96a", "src_port": 49775, "tcp_stream": 316, "udp_stream": null, "frame_number": 12122, "timestamp_epoch": "1583961977.407484000" }, { "kind": "tls_client_hello", "dst_ip": "40.91.76.238", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "licensing.mp.microsoft.com" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-66ef0ec9cba50bcc0a39797c", "src_port": 49776, "tcp_stream": 317, "udp_stream": null, "frame_number": 12158, "timestamp_epoch": "1583961977.822361000" }, { "kind": "tls_client_hello", "dst_ip": "40.91.76.238", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "licensing.mp.microsoft.com" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-c45152acb83f5beb5a4c1054", "src_port": 49777, "tcp_stream": 318, "udp_stream": null, "frame_number": 12196, "timestamp_epoch": "1583961978.325089000" }, { "kind": "tls_client_hello", "dst_ip": "40.90.22.185", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "login.live.com" }, "src_ip": "10.3.11.218", "dst_port": 443, "event_id": "evt-3d10b052b49e4f2e76285372", "src_port": 49758, "tcp_stream": 319, "udp_stream": null, "frame_number": 12309, "timestamp_epoch": "1583961994.005859000" }, { "kind": "tls_client_hello", "dst_ip": "52.242.211.89", "fields": { "tls.handshake.ja3": "3b5074b1b5d032e5620f69f9f700ff0e", "tls.handshake.extensions_server_name": "client.wns.windows.com" }, "src_ip": "10.3.11.218", "dst_port": 443, "event_id": "evt-643ce062c3954951774de872", "src_port": 49759, "tcp_stream": 320, "udp_stream": null, "frame_number": 12361, "timestamp_epoch": "1583961994.771137000" }, { "kind": "tls_client_hello", "dst_ip": "13.107.246.10", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "pti.store.microsoft.com" }, "src_ip": "10.3.11.218", "dst_port": 443, "event_id": "evt-fc8f51c766ac3bf786e188a3", "src_port": 49760, "tcp_stream": 321, "udp_stream": null, "frame_number": 12416, "timestamp_epoch": "1583961995.606172000" }, { "kind": "tls_client_hello", "dst_ip": "204.79.197.222", "fields": { "tls.handshake.ja3": "9e10692f1b7f78228b2d4e424db3a98c", "tls.handshake.extensions_server_name": "fp.msedge.net" }, "src_ip": "10.3.11.218", "dst_port": 443, "event_id": "evt-ee65abda7f8eab0e5a4db0b1", "src_port": 49761, "tcp_stream": 322, "udp_stream": null, "frame_number": 12456, "timestamp_epoch": "1583962013.030078000" }, { "kind": "tls_client_hello", "dst_ip": "23.211.36.128", "fields": { "tls.handshake.ja3": "9e10692f1b7f78228b2d4e424db3a98c", "tls.handshake.extensions_server_name": "go.microsoft.com" }, "src_ip": "10.3.11.218", "dst_port": 443, "event_id": "evt-b49a4632d28f87dae97fa1bf", "src_port": 49762, "tcp_stream": 323, "udp_stream": null, "frame_number": 12487, "timestamp_epoch": "1583962014.158514000" }, { "kind": "tls_client_hello", "dst_ip": "23.211.36.128", "fields": { "tls.handshake.ja3": "9e10692f1b7f78228b2d4e424db3a98c", "tls.handshake.extensions_server_name": "go.microsoft.com" }, "src_ip": "10.3.11.218", "dst_port": 443, "event_id": "evt-bce285a1bb0aa2a8c291bce9", "src_port": 49763, "tcp_stream": 324, "udp_stream": null, "frame_number": 12489, "timestamp_epoch": "1583962014.158741000" }, { "kind": "tls_client_hello", "dst_ip": "52.173.134.115", "fields": { "tls.handshake.ja3": "9e10692f1b7f78228b2d4e424db3a98c", "tls.handshake.extensions_server_name": "ie11welcome.microsoft.com" }, "src_ip": "10.3.11.218", "dst_port": 443, "event_id": "evt-bbbe103ea7719cad963bfd28", "src_port": 49765, "tcp_stream": 326, "udp_stream": null, "frame_number": 12520, "timestamp_epoch": "1583962014.639751000" }, { "kind": "tls_client_hello", "dst_ip": "52.173.134.115", "fields": { "tls.handshake.ja3": "9e10692f1b7f78228b2d4e424db3a98c", "tls.handshake.extensions_server_name": "ie11welcome.microsoft.com" }, "src_ip": "10.3.11.218", "dst_port": 443, "event_id": "evt-2eccfdc1353179542a7c8c6b", "src_port": 49764, "tcp_stream": 325, "udp_stream": null, "frame_number": 12521, "timestamp_epoch": "1583962014.639796000" }, { "kind": "tls_client_hello", "dst_ip": "52.173.134.115", "fields": { "tls.handshake.ja3": "9e10692f1b7f78228b2d4e424db3a98c", "tls.handshake.extensions_server_name": "ie11welcome.microsoft.com" }, "src_ip": "10.3.11.218", "dst_port": 443, "event_id": "evt-a7a0868df9a45123c67498b0", "src_port": 49766, "tcp_stream": 327, "udp_stream": null, "frame_number": 12582, "timestamp_epoch": "1583962015.029351000" }, { "kind": "tls_client_hello", "dst_ip": "204.79.197.254", "fields": { "tls.handshake.ja3": "9e10692f1b7f78228b2d4e424db3a98c", "tls.handshake.extensions_server_name": "3af21bab922f1a3fff13816e3eed341a.clo.footprintdns.com" }, "src_ip": "10.3.11.218", "dst_port": 443, "event_id": "evt-85e689f794d9bf10da51ed83", "src_port": 49767, "tcp_stream": 328, "udp_stream": null, "frame_number": 12631, "timestamp_epoch": "1583962015.382586000" }, { "kind": "tls_client_hello", "dst_ip": "52.173.134.115", "fields": { "tls.handshake.ja3": "9e10692f1b7f78228b2d4e424db3a98c", "tls.handshake.extensions_server_name": "ie11welcome.microsoft.com" }, "src_ip": "10.3.11.218", "dst_port": 443, "event_id": "evt-25ae475606dc4151bd25c640", "src_port": 49768, "tcp_stream": 329, "udp_stream": null, "frame_number": 12708, "timestamp_epoch": "1583962015.557342000" }, { "kind": "tls_client_hello", "dst_ip": "52.173.134.115", "fields": { "tls.handshake.ja3": "9e10692f1b7f78228b2d4e424db3a98c", "tls.handshake.extensions_server_name": "ie11welcome.microsoft.com" }, "src_ip": "10.3.11.218", "dst_port": 443, "event_id": "evt-4caf07661d38c4c156e001e4", "src_port": 49769, "tcp_stream": 330, "udp_stream": null, "frame_number": 12717, "timestamp_epoch": "1583962015.557795000" }, { "kind": "tls_client_hello", "dst_ip": "52.173.134.115", "fields": { "tls.handshake.ja3": "9e10692f1b7f78228b2d4e424db3a98c", "tls.handshake.extensions_server_name": "ie11welcome.microsoft.com" }, "src_ip": "10.3.11.218", "dst_port": 443, "event_id": "evt-9716e640ed288a79ae599312", "src_port": 49770, "tcp_stream": 331, "udp_stream": null, "frame_number": 12721, "timestamp_epoch": "1583962015.558204000" }, { "kind": "tls_client_hello", "dst_ip": "152.199.4.33", "fields": { "tls.handshake.ja3": "9e10692f1b7f78228b2d4e424db3a98c", "tls.handshake.extensions_server_name": "az725175.vo.msecnd.net" }, "src_ip": "10.3.11.218", "dst_port": 443, "event_id": "evt-199cc9a3685615f11a3f8dd7", "src_port": 49772, "tcp_stream": 333, "udp_stream": null, "frame_number": 12731, "timestamp_epoch": "1583962015.559942000" }, { "kind": "tls_client_hello", "dst_ip": "152.199.4.33", "fields": { "tls.handshake.ja3": "9e10692f1b7f78228b2d4e424db3a98c", "tls.handshake.extensions_server_name": "az725175.vo.msecnd.net" }, "src_ip": "10.3.11.218", "dst_port": 443, "event_id": "evt-f4e052faff82bf1fe8294d35", "src_port": 49771, "tcp_stream": 332, "udp_stream": null, "frame_number": 12733, "timestamp_epoch": "1583962015.561629000" }, { "kind": "tls_client_hello", "dst_ip": "13.107.18.254", "fields": { "tls.handshake.ja3": "9e10692f1b7f78228b2d4e424db3a98c", "tls.handshake.extensions_server_name": "k-ring.msedge.net" }, "src_ip": "10.3.11.218", "dst_port": 443, "event_id": "evt-b4fea5b9414adcb20375f553", "src_port": 49773, "tcp_stream": 334, "udp_stream": null, "frame_number": 12835, "timestamp_epoch": "1583962015.720421000" }, { "kind": "tls_client_hello", "dst_ip": "13.107.136.254", "fields": { "tls.handshake.ja3": "9e10692f1b7f78228b2d4e424db3a98c", "tls.handshake.extensions_server_name": "spo-ring.msedge.net" }, "src_ip": "10.3.11.218", "dst_port": 443, "event_id": "evt-10db6ebdf055f453d24aad4b", "src_port": 49774, "tcp_stream": 335, "udp_stream": null, "frame_number": 12913, "timestamp_epoch": "1583962015.892849000" }, { "kind": "tls_client_hello", "dst_ip": "64.4.54.254", "fields": { "tls.handshake.ja3": "9e10692f1b7f78228b2d4e424db3a98c", "tls.handshake.extensions_server_name": "web.vortex.data.microsoft.com" }, "src_ip": "10.3.11.218", "dst_port": 443, "event_id": "evt-a97774702e75598491a1468b", "src_port": 49780, "tcp_stream": 341, "udp_stream": null, "frame_number": 12979, "timestamp_epoch": "1583962016.009136000" }, { "kind": "tls_client_hello", "dst_ip": "64.4.54.254", "fields": { "tls.handshake.ja3": "9e10692f1b7f78228b2d4e424db3a98c", "tls.handshake.extensions_server_name": "web.vortex.data.microsoft.com" }, "src_ip": "10.3.11.218", "dst_port": 443, "event_id": "evt-bdfb9099480f39618f7fd47a", "src_port": 49776, "tcp_stream": 337, "udp_stream": null, "frame_number": 12981, "timestamp_epoch": "1583962016.009516000" }, { "kind": "tls_client_hello", "dst_ip": "64.4.54.254", "fields": { "tls.handshake.ja3": "9e10692f1b7f78228b2d4e424db3a98c", "tls.handshake.extensions_server_name": "web.vortex.data.microsoft.com" }, "src_ip": "10.3.11.218", "dst_port": 443, "event_id": "evt-dbc61719604f740e252320a1", "src_port": 49777, "tcp_stream": 338, "udp_stream": null, "frame_number": 12983, "timestamp_epoch": "1583962016.009694000" }, { "kind": "tls_client_hello", "dst_ip": "64.4.54.254", "fields": { "tls.handshake.ja3": "9e10692f1b7f78228b2d4e424db3a98c", "tls.handshake.extensions_server_name": "web.vortex.data.microsoft.com" }, "src_ip": "10.3.11.218", "dst_port": 443, "event_id": "evt-e5e16bb61d1f3ecee6423b2d", "src_port": 49779, "tcp_stream": 340, "udp_stream": null, "frame_number": 12985, "timestamp_epoch": "1583962016.009868000" }, { "kind": "tls_client_hello", "dst_ip": "64.4.54.254", "fields": { "tls.handshake.ja3": "9e10692f1b7f78228b2d4e424db3a98c", "tls.handshake.extensions_server_name": "web.vortex.data.microsoft.com" }, "src_ip": "10.3.11.218", "dst_port": 443, "event_id": "evt-afe871c5542cb952de88519f", "src_port": 49778, "tcp_stream": 339, "udp_stream": null, "frame_number": 12987, "timestamp_epoch": "1583962016.010114000" }, { "kind": "tls_client_hello", "dst_ip": "64.4.54.254", "fields": { "tls.handshake.ja3": "9e10692f1b7f78228b2d4e424db3a98c", "tls.handshake.extensions_server_name": "web.vortex.data.microsoft.com" }, "src_ip": "10.3.11.218", "dst_port": 443, "event_id": "evt-f5f4f2eebf093829dd056a3b", "src_port": 49775, "tcp_stream": 336, "udp_stream": null, "frame_number": 12989, "timestamp_epoch": "1583962016.010255000" }, { "kind": "tls_client_hello", "dst_ip": "13.107.5.80", "fields": { "tls.handshake.ja3": "9e10692f1b7f78228b2d4e424db3a98c", "tls.handshake.extensions_server_name": "api.bing.com" }, "src_ip": "10.3.11.218", "dst_port": 443, "event_id": "evt-e5a2ee6fea7f25bb34d19911", "src_port": 49781, "tcp_stream": 342, "udp_stream": null, "frame_number": 13138, "timestamp_epoch": "1583962020.851264000" }, { "kind": "tls_client_hello", "dst_ip": "13.107.5.80", "fields": { "tls.handshake.ja3": "9e10692f1b7f78228b2d4e424db3a98c", "tls.handshake.extensions_server_name": "api.bing.com" }, "src_ip": "10.3.11.218", "dst_port": 443, "event_id": "evt-c10050a125a526d6b9a1b2c2", "src_port": 49782, "tcp_stream": 343, "udp_stream": null, "frame_number": 13147, "timestamp_epoch": "1583962020.904625000" }, { "kind": "tls_client_hello", "dst_ip": "172.217.12.74", "fields": { "tls.handshake.ja3": "9e10692f1b7f78228b2d4e424db3a98c", "tls.handshake.extensions_server_name": "ajax.googleapis.com" }, "src_ip": "10.3.11.218", "dst_port": 443, "event_id": "evt-023a63c4c062787fc713f29d", "src_port": 49796, "tcp_stream": 357, "udp_stream": null, "frame_number": 13838, "timestamp_epoch": "1583962031.485558000" }, { "kind": "tls_client_hello", "dst_ip": "172.217.12.74", "fields": { "tls.handshake.ja3": "9e10692f1b7f78228b2d4e424db3a98c", "tls.handshake.extensions_server_name": "ajax.googleapis.com" }, "src_ip": "10.3.11.218", "dst_port": 443, "event_id": "evt-1b4bc2c470378c9b7bd30fe2", "src_port": 49795, "tcp_stream": 356, "udp_stream": null, "frame_number": 13842, "timestamp_epoch": "1583962031.489355000" }, { "kind": "tls_client_hello", "dst_ip": "52.242.211.89", "fields": { "tls.handshake.ja3": "3b5074b1b5d032e5620f69f9f700ff0e", "tls.handshake.extensions_server_name": "client.wns.windows.com" }, "src_ip": "10.3.11.218", "dst_port": 443, "event_id": "evt-d0a00893c224673593c9f131", "src_port": 49798, "tcp_stream": 359, "udp_stream": null, "frame_number": 14085, "timestamp_epoch": "1583962054.624999000" }, { "kind": "tls_client_hello", "dst_ip": "204.79.197.200", "fields": { "tls.handshake.ja3": "9e10692f1b7f78228b2d4e424db3a98c", "tls.handshake.extensions_server_name": "www.bing.com" }, "src_ip": "10.3.11.218", "dst_port": 443, "event_id": "evt-d687d6fce99708f6d286f6f3", "src_port": 49799, "tcp_stream": 360, "udp_stream": null, "frame_number": 14098, "timestamp_epoch": "1583962054.701413000" }, { "kind": "tls_client_hello", "dst_ip": "52.114.77.34", "fields": { "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1", "tls.handshake.extensions_server_name": "self.events.data.microsoft.com" }, "src_ip": "10.3.11.218", "dst_port": 443, "event_id": "evt-8f1d3ed25c6fa067231447ff", "src_port": 49804, "tcp_stream": 365, "udp_stream": null, "frame_number": 14262, "timestamp_epoch": "1583962086.400945000" }, { "kind": "tls_client_hello", "dst_ip": "52.114.77.34", "fields": { "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1", "tls.handshake.extensions_server_name": "self.events.data.microsoft.com" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-37c91355eb2d967814531b61", "src_port": 49778, "tcp_stream": 366, "udp_stream": null, "frame_number": 14319, "timestamp_epoch": "1583962112.351640000" }, { "kind": "tls_client_hello", "dst_ip": "52.109.8.30", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "mrodevicemgr.officeapps.live.com" }, "src_ip": "10.3.11.218", "dst_port": 443, "event_id": "evt-0e0d73c16a0573c29ba1a650", "src_port": 49805, "tcp_stream": 371, "udp_stream": null, "frame_number": 14425, "timestamp_epoch": "1583962114.710649000" }, { "kind": "tls_client_hello", "dst_ip": "52.114.132.73", "fields": { "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1", "tls.handshake.extensions_server_name": "self.events.data.microsoft.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-792b612a8cde5f6283b33b58", "src_port": 49807, "tcp_stream": 372, "udp_stream": null, "frame_number": 14483, "timestamp_epoch": "1583962143.682391000" }, { "kind": "tls_client_hello", "dst_ip": "52.114.132.73", "fields": { "tls.handshake.ja3": "37f463bf4616ecd445d4a1937da06e19", "tls.handshake.extensions_server_name": "self.events.data.microsoft.com" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-2b9cbae9e10ec4bf123c51df", "src_port": 49779, "tcp_stream": 373, "udp_stream": null, "frame_number": 14512, "timestamp_epoch": "1583962155.990990000" }, { "kind": "tls_client_hello", "dst_ip": "13.107.246.10", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "pti.store.microsoft.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-56188ff9eca90f71ff7cb59a", "src_port": 49809, "tcp_stream": 381, "udp_stream": null, "frame_number": 14750, "timestamp_epoch": "1583962291.285102000" }, { "kind": "tls_client_hello", "dst_ip": "52.242.211.89", "fields": { "tls.handshake.ja3": "3b5074b1b5d032e5620f69f9f700ff0e", "tls.handshake.extensions_server_name": "client.wns.windows.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-bc597d43d3c922ec71262a1c", "src_port": 49808, "tcp_stream": 380, "udp_stream": null, "frame_number": 14752, "timestamp_epoch": "1583962291.287376000" }, { "kind": "tls_client_hello", "dst_ip": "45.148.120.153", "fields": { "tls.handshake.ja3": "72a589da586844d7f0818ce684948eea" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-8b20607e31493ebbb6e0c6fb", "src_port": 49783, "tcp_stream": 385, "udp_stream": null, "frame_number": 14837, "timestamp_epoch": "1583962318.356428000" }, { "kind": "tls_client_hello", "dst_ip": "51.254.164.244", "fields": { "tls.handshake.ja3": "72a589da586844d7f0818ce684948eea" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-7f0a317ee3ad817795f50a1e", "src_port": 49784, "tcp_stream": 386, "udp_stream": null, "frame_number": 14905, "timestamp_epoch": "1583962319.541662000" }, { "kind": "tls_client_hello", "dst_ip": "13.107.246.10", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "pti.store.microsoft.com" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-8f35e6cc1be0296ada20b7cd", "src_port": 49785, "tcp_stream": 387, "udp_stream": null, "frame_number": 14925, "timestamp_epoch": "1583962319.971860000" }, { "kind": "tls_client_hello", "dst_ip": "52.230.222.68", "fields": { "tls.handshake.ja3": "3b5074b1b5d032e5620f69f9f700ff0e", "tls.handshake.extensions_server_name": "client.wns.windows.com" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-00be28fd292bfeaccda7f9a3", "src_port": 49786, "tcp_stream": 388, "udp_stream": null, "frame_number": 14936, "timestamp_epoch": "1583962320.006168000" }, { "kind": "tls_client_hello", "dst_ip": "190.214.13.2", "fields": { "tls.handshake.ja3": "72a589da586844d7f0818ce684948eea" }, "src_ip": "10.3.11.194", "dst_port": 449, "event_id": "evt-c30c9f66acacc796f67a36e3", "src_port": 49788, "tcp_stream": 391, "udp_stream": null, "frame_number": 15091, "timestamp_epoch": "1583962328.193347000" }, { "kind": "tls_client_hello", "dst_ip": "52.230.222.68", "fields": { "tls.handshake.ja3": "3b5074b1b5d032e5620f69f9f700ff0e", "tls.handshake.extensions_server_name": "client.wns.windows.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-35b759396e1c5f1a2f647d7b", "src_port": 49810, "tcp_stream": 392, "udp_stream": null, "frame_number": 15140, "timestamp_epoch": "1583962351.787373000" }, { "kind": "tls_client_hello", "dst_ip": "52.230.220.159", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "fe2cr.update.microsoft.com" }, "src_ip": "10.3.11.218", "dst_port": 443, "event_id": "evt-3eb5838d100eda3d53a53a5d", "src_port": 49806, "tcp_stream": 393, "udp_stream": null, "frame_number": 15208, "timestamp_epoch": "1583962359.799458000" }, { "kind": "tls_client_hello", "dst_ip": "111.221.29.40", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "fe3cr.delivery.mp.microsoft.com" }, "src_ip": "10.3.11.218", "dst_port": 443, "event_id": "evt-9541f9e1d61df42adb108186", "src_port": 49807, "tcp_stream": 394, "udp_stream": null, "frame_number": 15319, "timestamp_epoch": "1583962361.123697000" }, { "kind": "tls_client_hello", "dst_ip": "52.230.222.68", "fields": { "tls.handshake.ja3": "3b5074b1b5d032e5620f69f9f700ff0e", "tls.handshake.extensions_server_name": "client.wns.windows.com" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-15d7ceda31ebbd73e1c6975e", "src_port": 49789, "tcp_stream": 395, "udp_stream": null, "frame_number": 15382, "timestamp_epoch": "1583962380.339986000" }, { "kind": "tls_client_hello", "dst_ip": "40.119.2.214", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "settings-win.data.microsoft.com" }, "src_ip": "10.3.11.218", "dst_port": 443, "event_id": "evt-4e014179de4bcaeb3c555534", "src_port": 49808, "tcp_stream": 396, "udp_stream": null, "frame_number": 15401, "timestamp_epoch": "1583962380.471041000" }, { "kind": "tls_client_hello", "dst_ip": "40.90.22.187", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "login.live.com" }, "src_ip": "10.3.11.218", "dst_port": 443, "event_id": "evt-4ea8536f0a3d36e6e1ea3d74", "src_port": 49811, "tcp_stream": 397, "udp_stream": null, "frame_number": 15445, "timestamp_epoch": "1583962381.450797000" }, { "kind": "tls_client_hello", "dst_ip": "40.91.76.238", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "licensing.mp.microsoft.com" }, "src_ip": "10.3.11.218", "dst_port": 443, "event_id": "evt-857044fd72c94a678955b313", "src_port": 49812, "tcp_stream": 398, "udp_stream": null, "frame_number": 15493, "timestamp_epoch": "1583962382.048860000" }, { "kind": "tls_client_hello", "dst_ip": "13.78.168.230", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "slscr.update.microsoft.com" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-59437dc9fe2387b8fc46f9bf", "src_port": 49790, "tcp_stream": 401, "udp_stream": null, "frame_number": 15555, "timestamp_epoch": "1583962385.574608000" }, { "kind": "tls_client_hello", "dst_ip": "23.206.213.111", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "storecatalogrevocation.storequality.microsoft.com" }, "src_ip": "10.3.11.218", "dst_port": 443, "event_id": "evt-97406a9e4d6046a04e7c3db5", "src_port": 49816, "tcp_stream": 402, "udp_stream": null, "frame_number": 15575, "timestamp_epoch": "1583962385.683749000" }, { "kind": "tls_client_hello", "dst_ip": "52.230.220.159", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "fe2cr.update.microsoft.com" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-b7e79ff07a2b1a1f6ab416d9", "src_port": 49791, "tcp_stream": 403, "udp_stream": null, "frame_number": 15605, "timestamp_epoch": "1583962386.178664000" }, { "kind": "tls_client_hello", "dst_ip": "40.119.2.214", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "settings-win.data.microsoft.com" }, "src_ip": "10.3.11.218", "dst_port": 443, "event_id": "evt-8b2ec9d3cd429b2d60e24bfb", "src_port": 49818, "tcp_stream": 405, "udp_stream": null, "frame_number": 15717, "timestamp_epoch": "1583962387.261460000" }, { "kind": "tls_client_hello", "dst_ip": "52.230.222.68", "fields": { "tls.handshake.ja3": "3b5074b1b5d032e5620f69f9f700ff0e", "tls.handshake.extensions_server_name": "client.wns.windows.com" }, "src_ip": "10.3.11.218", "dst_port": 443, "event_id": "evt-8bf8521c026e23c37204d6f4", "src_port": 49820, "tcp_stream": 408, "udp_stream": null, "frame_number": 15752, "timestamp_epoch": "1583962387.508138000" }, { "kind": "tls_client_hello", "dst_ip": "40.119.2.214", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "settings-win.data.microsoft.com" }, "src_ip": "10.3.11.218", "dst_port": 443, "event_id": "evt-2b3cec182996f5602383ce6e", "src_port": 49819, "tcp_stream": 407, "udp_stream": null, "frame_number": 15754, "timestamp_epoch": "1583962387.520876000" }, { "kind": "tls_client_hello", "dst_ip": "111.221.29.40", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "fe3cr.delivery.mp.microsoft.com" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-4ee5423d08b3c122fe7b343c", "src_port": 49792, "tcp_stream": 406, "udp_stream": null, "frame_number": 15769, "timestamp_epoch": "1583962387.595655000" }, { "kind": "tls_client_hello", "dst_ip": "52.230.220.159", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "fe2cr.update.microsoft.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-b9fce99533cafd77ea8424c6", "src_port": 49811, "tcp_stream": 409, "udp_stream": null, "frame_number": 15927, "timestamp_epoch": "1583962417.015109000" }, { "kind": "tls_client_hello", "dst_ip": "111.221.29.40", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "fe3cr.delivery.mp.microsoft.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-c3eb199c1df14fb7b083062b", "src_port": 49812, "tcp_stream": 410, "udp_stream": null, "frame_number": 16032, "timestamp_epoch": "1583962418.609032000" }, { "kind": "tls_client_hello", "dst_ip": "52.230.222.68", "fields": { "tls.handshake.ja3": "3b5074b1b5d032e5620f69f9f700ff0e", "tls.handshake.extensions_server_name": "client.wns.windows.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-1fa2963f70a7de08d6dd0361", "src_port": 49814, "tcp_stream": 412, "udp_stream": null, "frame_number": 16118, "timestamp_epoch": "1583962434.543570000" }, { "kind": "tls_client_hello", "dst_ip": "54.153.98.238", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "fareharbor.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-a93074e22448d5785c0a1bf3", "src_port": 49815, "tcp_stream": 413, "udp_stream": null, "frame_number": 16288, "timestamp_epoch": "1583962457.989600000" }, { "kind": "tls_client_hello", "dst_ip": "40.119.2.214", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "settings-win.data.microsoft.com" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-0561fdd5f92267c100baa512", "src_port": 49794, "tcp_stream": 415, "udp_stream": null, "frame_number": 16333, "timestamp_epoch": "1583962544.850204000" }, { "kind": "tls_client_hello", "dst_ip": "40.91.76.238", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "licensing.mp.microsoft.com" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-2f9a1f57f8a9dceb84a2db35", "src_port": 49796, "tcp_stream": 417, "udp_stream": null, "frame_number": 16391, "timestamp_epoch": "1583962545.368275000" }, { "kind": "tls_client_hello", "dst_ip": "52.230.222.68", "fields": { "tls.handshake.ja3": "3b5074b1b5d032e5620f69f9f700ff0e", "tls.handshake.extensions_server_name": "client.wns.windows.com" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-0cfcc067a2b3d7d93ea76c21", "src_port": 49797, "tcp_stream": 418, "udp_stream": null, "frame_number": 16408, "timestamp_epoch": "1583962545.481010000" }, { "kind": "tls_client_hello", "dst_ip": "52.230.222.68", "fields": { "tls.handshake.ja3": "3b5074b1b5d032e5620f69f9f700ff0e", "tls.handshake.extensions_server_name": "client.wns.windows.com" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-abaa9548607579bc4d6d2ed3", "src_port": 49798, "tcp_stream": 419, "udp_stream": null, "frame_number": 16449, "timestamp_epoch": "1583962545.791547000" }, { "kind": "tls_client_hello", "dst_ip": "204.79.197.200", "fields": { "tls.handshake.ja3": "9e10692f1b7f78228b2d4e424db3a98c", "tls.handshake.extensions_server_name": "www.bing.com" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-1494df239d88873579f5a55a", "src_port": 49801, "tcp_stream": 420, "udp_stream": null, "frame_number": 16493, "timestamp_epoch": "1583962547.170961000" }, { "kind": "tls_client_hello", "dst_ip": "23.206.213.111", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "storecatalogrevocation.storequality.microsoft.com" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-7c8b3f053eff8df62d1a7c6a", "src_port": 49803, "tcp_stream": 421, "udp_stream": null, "frame_number": 16528, "timestamp_epoch": "1583962549.089942000" }, { "kind": "tls_client_hello", "dst_ip": "40.119.2.214", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "settings-win.data.microsoft.com" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-321b2f2e79d4bd67fa65ed85", "src_port": 49806, "tcp_stream": 424, "udp_stream": null, "frame_number": 16570, "timestamp_epoch": "1583962550.983275000" }, { "kind": "tls_client_hello", "dst_ip": "40.119.2.214", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "settings-win.data.microsoft.com" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-a12a4803e90727871414fce5", "src_port": 49807, "tcp_stream": 425, "udp_stream": null, "frame_number": 16595, "timestamp_epoch": "1583962551.126244000" }, { "kind": "tls_client_hello", "dst_ip": "185.14.31.98", "fields": { "tls.handshake.ja3": "72a589da586844d7f0818ce684948eea" }, "src_ip": "10.3.11.194", "dst_port": 447, "event_id": "evt-6c44f0264f60394498a9113a", "src_port": 49808, "tcp_stream": 426, "udp_stream": null, "frame_number": 16623, "timestamp_epoch": "1583962553.540512000" }, { "kind": "tls_client_hello", "dst_ip": "190.214.13.2", "fields": { "tls.handshake.ja3": "72a589da586844d7f0818ce684948eea" }, "src_ip": "10.3.11.194", "dst_port": 449, "event_id": "evt-7b2bb214db7bd8a07ee7f633", "src_port": 49809, "tcp_stream": 427, "udp_stream": null, "frame_number": 17529, "timestamp_epoch": "1583962556.162562000" }, { "kind": "tls_client_hello", "dst_ip": "190.214.13.2", "fields": { "tls.handshake.ja3": "72a589da586844d7f0818ce684948eea" }, "src_ip": "10.3.11.194", "dst_port": 449, "event_id": "evt-08c31edf6dfd35685b84a25d", "src_port": 49810, "tcp_stream": 428, "udp_stream": null, "frame_number": 17553, "timestamp_epoch": "1583962558.378835000" }, { "kind": "tls_client_hello", "dst_ip": "190.214.13.2", "fields": { "tls.handshake.ja3": "72a589da586844d7f0818ce684948eea" }, "src_ip": "10.3.11.194", "dst_port": 449, "event_id": "evt-6102ffdc669211dcda11b023", "src_port": 50092, "tcp_stream": 460, "udp_stream": null, "frame_number": 20684, "timestamp_epoch": "1583962621.648089000" }, { "kind": "tls_client_hello", "dst_ip": "72.246.84.150", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "m.addthis.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-ab562b1e7fb031f2a964d4fb", "src_port": 49816, "tcp_stream": 466, "udp_stream": null, "frame_number": 21146, "timestamp_epoch": "1583962650.385589000" }, { "kind": "tls_client_hello", "dst_ip": "72.246.84.229", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "www.newegg.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-da7cb6502bcec5d006073f4e", "src_port": 49820, "tcp_stream": 470, "udp_stream": null, "frame_number": 21215, "timestamp_epoch": "1583962650.619185000" }, { "kind": "tls_client_hello", "dst_ip": "72.246.84.229", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "promotions.newegg.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-79c5555fad66fe2aae355600", "src_port": 49821, "tcp_stream": 471, "udp_stream": null, "frame_number": 21302, "timestamp_epoch": "1583962650.966488000" }, { "kind": "tls_client_hello", "dst_ip": "72.246.84.229", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "c1.neweggimages.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-54240827e0eb1e7ced7e52d1", "src_port": 49822, "tcp_stream": 472, "udp_stream": null, "frame_number": 21304, "timestamp_epoch": "1583962650.966874000" }, { "kind": "tls_client_hello", "dst_ip": "23.199.253.39", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "assets.adobedtm.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-95d38e72ad462503198e9d17", "src_port": 49823, "tcp_stream": 473, "udp_stream": null, "frame_number": 21340, "timestamp_epoch": "1583962650.990680000" }, { "kind": "tls_client_hello", "dst_ip": "72.246.84.229", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "c1.neweggimages.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-f6d64d03bffa9e49c8cda885", "src_port": 49826, "tcp_stream": 476, "udp_stream": null, "frame_number": 21347, "timestamp_epoch": "1583962650.991222000" }, { "kind": "tls_client_hello", "dst_ip": "72.246.84.229", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "c1.neweggimages.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-c76442575e4302bd2dae61dc", "src_port": 49825, "tcp_stream": 475, "udp_stream": null, "frame_number": 21352, "timestamp_epoch": "1583962650.991571000" }, { "kind": "tls_client_hello", "dst_ip": "72.246.84.229", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "c1.neweggimages.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-760f711285f4551b9e0a53c6", "src_port": 49824, "tcp_stream": 474, "udp_stream": null, "frame_number": 21355, "timestamp_epoch": "1583962650.991880000" }, { "kind": "tls_client_hello", "dst_ip": "72.246.84.229", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "c1.neweggimages.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-a54bf567d1f10946abdd499e", "src_port": 49829, "tcp_stream": 479, "udp_stream": null, "frame_number": 21357, "timestamp_epoch": "1583962650.992120000" }, { "kind": "tls_client_hello", "dst_ip": "72.246.84.229", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "c1.neweggimages.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-8b771b8b715a581b2d681afd", "src_port": 49828, "tcp_stream": 478, "udp_stream": null, "frame_number": 21359, "timestamp_epoch": "1583962650.992366000" }, { "kind": "tls_client_hello", "dst_ip": "72.246.84.229", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "c1.neweggimages.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-a8a8b4e21590498fb9d8041f", "src_port": 49827, "tcp_stream": 477, "udp_stream": null, "frame_number": 21361, "timestamp_epoch": "1583962650.992708000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.194.131", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "fonts.gstatic.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-9111f9cbca1a55a4ef61a093", "src_port": 49831, "tcp_stream": 481, "udp_stream": null, "frame_number": 21370, "timestamp_epoch": "1583962651.019579000" }, { "kind": "tls_client_hello", "dst_ip": "152.199.4.210", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "tags.tiqcdn.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-48aacf1fccbb2423568bb440", "src_port": 49830, "tcp_stream": 480, "udp_stream": null, "frame_number": 21484, "timestamp_epoch": "1583962651.131970000" }, { "kind": "tls_client_hello", "dst_ip": "72.246.84.229", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "help.newegg.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-4b84da35dd7655cd1a842081", "src_port": 49835, "tcp_stream": 485, "udp_stream": null, "frame_number": 21487, "timestamp_epoch": "1583962651.135893000" }, { "kind": "tls_client_hello", "dst_ip": "72.246.84.229", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "images10.newegg.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-713f772e48dec31f88f7e0f9", "src_port": 49833, "tcp_stream": 483, "udp_stream": null, "frame_number": 21489, "timestamp_epoch": "1583962651.136224000" }, { "kind": "tls_client_hello", "dst_ip": "72.246.84.229", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "secure.newegg.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-f3d955db73cd64f594ba0058", "src_port": 49832, "tcp_stream": 482, "udp_stream": null, "frame_number": 21491, "timestamp_epoch": "1583962651.136634000" }, { "kind": "tls_client_hello", "dst_ip": "3.219.244.74", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "states.newegg.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-ae39bc72932cbd40b9d328d0", "src_port": 49834, "tcp_stream": 484, "udp_stream": null, "frame_number": 21568, "timestamp_epoch": "1583962651.195071000" }, { "kind": "tls_client_hello", "dst_ip": "152.199.4.210", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "tags.tiqcdn.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-fd53be877c22e99984016071", "src_port": 49830, "tcp_stream": 480, "udp_stream": null, "frame_number": 21581, "timestamp_epoch": "1583962651.195962000" }, { "kind": "tls_client_hello", "dst_ip": "23.204.16.227", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "sealserver.trustwave.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-55f5d354624c7da11e59440a", "src_port": 49836, "tcp_stream": 486, "udp_stream": null, "frame_number": 21606, "timestamp_epoch": "1583962651.197319000" }, { "kind": "tls_client_hello", "dst_ip": "104.117.242.71", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "se.monetate.net" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-a6c341c8d385aad4bf1df94c", "src_port": 49837, "tcp_stream": 487, "udp_stream": null, "frame_number": 21630, "timestamp_epoch": "1583962651.198570000" }, { "kind": "tls_client_hello", "dst_ip": "72.246.84.229", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "pf.newegg.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-126eedb2fa6c0ad344de4298", "src_port": 49838, "tcp_stream": 488, "udp_stream": null, "frame_number": 21637, "timestamp_epoch": "1583962651.199705000" }, { "kind": "tls_client_hello", "dst_ip": "72.246.84.229", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "ec-apis.newegg.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-bab59420a50561a360f23a36", "src_port": 49839, "tcp_stream": 489, "udp_stream": null, "frame_number": 21684, "timestamp_epoch": "1583962651.226524000" }, { "kind": "tls_client_hello", "dst_ip": "72.246.84.229", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "www2.newegg.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-983d20c7bc7718c5bcb129ac", "src_port": 49840, "tcp_stream": 490, "udp_stream": null, "frame_number": 21711, "timestamp_epoch": "1583962651.228233000" }, { "kind": "tls_client_hello", "dst_ip": "34.208.131.21", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "dpm.demdex.net" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-ed417d8df99694a5a1d3bbb1", "src_port": 49842, "tcp_stream": 492, "udp_stream": null, "frame_number": 22169, "timestamp_epoch": "1583962651.577149000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.194.131", "fields": { "tls.handshake.ja3": "554719594ba90b02ae410c297c6e50ad", "tls.handshake.extensions_server_name": "fonts.gstatic.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-ee784c16e7ac8aea3a9ae1bc", "src_port": 49843, "tcp_stream": 493, "udp_stream": null, "frame_number": 23124, "timestamp_epoch": "1583962651.740172000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.194.131", "fields": { "tls.handshake.ja3": "554719594ba90b02ae410c297c6e50ad", "tls.handshake.extensions_server_name": "fonts.gstatic.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-c5e4683d085c34b216c97210", "src_port": 49844, "tcp_stream": 494, "udp_stream": null, "frame_number": 23172, "timestamp_epoch": "1583962651.760798000" }, { "kind": "tls_client_hello", "dst_ip": "34.209.127.1", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "newegginc.demdex.net" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-ff5162d700e001342d02a1b9", "src_port": 49845, "tcp_stream": 495, "udp_stream": null, "frame_number": 23814, "timestamp_epoch": "1583962652.506365000" }, { "kind": "tls_client_hello", "dst_ip": "13.107.6.158", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "edge.microsoft.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-29f6bb792ec0fc289a730e2b", "src_port": 49846, "tcp_stream": 496, "udp_stream": null, "frame_number": 23959, "timestamp_epoch": "1583962652.682957000" }, { "kind": "tls_client_hello", "dst_ip": "3.219.244.74", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "states.newegg.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-fdbd0859c6393edc13eb22ce", "src_port": 49848, "tcp_stream": 498, "udp_stream": null, "frame_number": 24004, "timestamp_epoch": "1583962652.725185000" }, { "kind": "tls_client_hello", "dst_ip": "192.243.232.58", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "cm.everesttech.net" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-a795a18c491bbdbdd219bb56", "src_port": 49847, "tcp_stream": 497, "udp_stream": null, "frame_number": 24019, "timestamp_epoch": "1583962652.735242000" }, { "kind": "tls_client_hello", "dst_ip": "172.217.6.174", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "www.googlecommerce.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-f1169699041c3bf22b9883d1", "src_port": 49850, "tcp_stream": 500, "udp_stream": null, "frame_number": 24112, "timestamp_epoch": "1583962652.935543000" }, { "kind": "tls_client_hello", "dst_ip": "172.217.14.162", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "www.googletagservices.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-6c688ab9d64d8950ab45bb18", "src_port": 49849, "tcp_stream": 499, "udp_stream": null, "frame_number": 24114, "timestamp_epoch": "1583962652.936184000" }, { "kind": "tls_client_hello", "dst_ip": "34.211.22.199", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "f.monetate.net" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-b1afc2ea43021a402e12d805", "src_port": 49851, "tcp_stream": 501, "udp_stream": null, "frame_number": 24150, "timestamp_epoch": "1583962652.979663000" }, { "kind": "tls_client_hello", "dst_ip": "172.217.14.162", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "adservice.google.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-10f48ac75b4a19bb99dcb9b7", "src_port": 49854, "tcp_stream": 504, "udp_stream": null, "frame_number": 24244, "timestamp_epoch": "1583962653.171689000" }, { "kind": "tls_client_hello", "dst_ip": "172.217.9.4", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "www.google.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-cf2a4ee38272a96ff4ca3b2a", "src_port": 49853, "tcp_stream": 503, "udp_stream": null, "frame_number": 24246, "timestamp_epoch": "1583962653.172191000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.194.98", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "securepubads.g.doubleclick.net" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-4bb308da59126b770e026b9a", "src_port": 49852, "tcp_stream": 502, "udp_stream": null, "frame_number": 24248, "timestamp_epoch": "1583962653.172435000" }, { "kind": "tls_client_hello", "dst_ip": "172.217.6.142", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "apis.google.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-6b3b1ba8bf490565491aa207", "src_port": 49858, "tcp_stream": 508, "udp_stream": null, "frame_number": 24535, "timestamp_epoch": "1583962654.507148000" }, { "kind": "tls_client_hello", "dst_ip": "172.217.14.161", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "tpc.googlesyndication.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-b26ef3a2c24e35c0a96cc03f", "src_port": 49859, "tcp_stream": 509, "udp_stream": null, "frame_number": 24552, "timestamp_epoch": "1583962654.542479000" }, { "kind": "tls_client_hello", "dst_ip": "34.211.22.199", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "f.monetate.net" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-453b06d6fe63d1f6ebf1ab18", "src_port": 49857, "tcp_stream": 507, "udp_stream": null, "frame_number": 24610, "timestamp_epoch": "1583962654.547506000" }, { "kind": "tls_client_hello", "dst_ip": "34.211.22.199", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "f.monetate.net" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-52b556553f5aa9da965caf15", "src_port": 49856, "tcp_stream": 506, "udp_stream": null, "frame_number": 24612, "timestamp_epoch": "1583962654.547981000" }, { "kind": "tls_client_hello", "dst_ip": "34.211.22.199", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "f.monetate.net" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-1ae5ff658763d15c17fa02bb", "src_port": 49855, "tcp_stream": 505, "udp_stream": null, "frame_number": 24614, "timestamp_epoch": "1583962654.548269000" }, { "kind": "tls_client_hello", "dst_ip": "173.194.223.154", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "stats.g.doubleclick.net" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-bffb9a2e6109844338963a94", "src_port": 49860, "tcp_stream": 510, "udp_stream": null, "frame_number": 24879, "timestamp_epoch": "1583962654.735156000" }, { "kind": "tls_client_hello", "dst_ip": "172.217.1.142", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "play.google.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-e6c3949075339ed4e4fede33", "src_port": 49861, "tcp_stream": 511, "udp_stream": null, "frame_number": 25139, "timestamp_epoch": "1583962655.310032000" }, { "kind": "tls_client_hello", "dst_ip": "172.217.2.226", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "www.googleadservices.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-110c736b8e39e1ab4dfae4b1", "src_port": 49862, "tcp_stream": 512, "udp_stream": null, "frame_number": 25183, "timestamp_epoch": "1583962655.369994000" }, { "kind": "tls_client_hello", "dst_ip": "31.13.65.7", "fields": { "tls.handshake.ja3": "0ae18052c288c1bd39910255598ed827", "tls.handshake.extensions_server_name": "connect.facebook.net" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-b471ffb5cebe467b28dd6771", "src_port": 49863, "tcp_stream": 513, "udp_stream": null, "frame_number": 25255, "timestamp_epoch": "1583962655.507108000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.194.104", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "www.googletagmanager.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-d7ba6fd874e2557b62a8ad83", "src_port": 49868, "tcp_stream": 518, "udp_stream": null, "frame_number": 25260, "timestamp_epoch": "1583962655.526230000" }, { "kind": "tls_client_hello", "dst_ip": "169.60.153.61", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "dx.steelhousemedia.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-ca5b28818a7ed5ad2a43c053", "src_port": 49867, "tcp_stream": 517, "udp_stream": null, "frame_number": 25270, "timestamp_epoch": "1583962655.536065000" }, { "kind": "tls_client_hello", "dst_ip": "34.102.147.248", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "tag.rmp.rakuten.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-afe350de2fb0790a3d63cf38", "src_port": 49866, "tcp_stream": 516, "udp_stream": null, "frame_number": 25272, "timestamp_epoch": "1583962655.536358000" }, { "kind": "tls_client_hello", "dst_ip": "172.217.12.84", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "triggeredmail.appspot.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-32b5ebf6f0cf7201a6abe406", "src_port": 49865, "tcp_stream": 515, "udp_stream": null, "frame_number": 25274, "timestamp_epoch": "1583962655.536611000" }, { "kind": "tls_client_hello", "dst_ip": "63.148.46.76", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "sts.eccmp.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-b50ae1217f67e384e0b24a89", "src_port": 49864, "tcp_stream": 514, "udp_stream": null, "frame_number": 25314, "timestamp_epoch": "1583962655.627441000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.194.112", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "storage.googleapis.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-83d469fa35c752286911d860", "src_port": 49869, "tcp_stream": 519, "udp_stream": null, "frame_number": 25503, "timestamp_epoch": "1583962655.878836000" }, { "kind": "tls_client_hello", "dst_ip": "35.241.23.116", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "consent.mediaforge.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-96a667322c46074efdef8553", "src_port": 49874, "tcp_stream": 524, "udp_stream": null, "frame_number": 25559, "timestamp_epoch": "1583962655.959394000" }, { "kind": "tls_client_hello", "dst_ip": "35.241.23.116", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "ut.ra.linksynergy.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-e065c39ce2c22f0bb0bccd48", "src_port": 49872, "tcp_stream": 522, "udp_stream": null, "frame_number": 25561, "timestamp_epoch": "1583962655.959746000" }, { "kind": "tls_client_hello", "dst_ip": "35.241.23.116", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "consent.dc-storm.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-169d9b801fa2c39a8dc4c3f2", "src_port": 49875, "tcp_stream": 525, "udp_stream": null, "frame_number": 25599, "timestamp_epoch": "1583962655.996983000" }, { "kind": "tls_client_hello", "dst_ip": "35.241.23.116", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "consent.nxtck.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-5b7c09a0665196ecf90d904e", "src_port": 49873, "tcp_stream": 523, "udp_stream": null, "frame_number": 25718, "timestamp_epoch": "1583962656.142900000" }, { "kind": "tls_client_hello", "dst_ip": "34.98.67.3", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "tags.rd.linksynergy.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-e5451b84889338a58f9efc7a", "src_port": 49871, "tcp_stream": 521, "udp_stream": null, "frame_number": 25720, "timestamp_epoch": "1583962656.143263000" }, { "kind": "tls_client_hello", "dst_ip": "35.241.23.116", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "consent.jrs5.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-3414cd19a6441c5cb7aee9bd", "src_port": 49870, "tcp_stream": 520, "udp_stream": null, "frame_number": 25722, "timestamp_epoch": "1583962656.143522000" }, { "kind": "tls_client_hello", "dst_ip": "35.241.23.116", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "consent.linksynergy.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-b7135806c6861f01dc3eadf7", "src_port": 49876, "tcp_stream": 527, "udp_stream": null, "frame_number": 25739, "timestamp_epoch": "1583962656.160004000" }, { "kind": "tls_client_hello", "dst_ip": "35.241.23.116", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "consent.linksynergy.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-5c582df2e384292f676397f1", "src_port": 49877, "tcp_stream": 528, "udp_stream": null, "frame_number": 25752, "timestamp_epoch": "1583962656.163391000" }, { "kind": "tls_client_hello", "dst_ip": "63.148.46.76", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "sts.eccmp.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-4aaab0668b57a3092d5cc4c5", "src_port": 49878, "tcp_stream": 529, "udp_stream": null, "frame_number": 25834, "timestamp_epoch": "1583962656.368355000" }, { "kind": "tls_client_hello", "dst_ip": "31.13.65.36", "fields": { "tls.handshake.ja3": "0ae18052c288c1bd39910255598ed827", "tls.handshake.extensions_server_name": "www.facebook.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-3a7a915b70ccf63a1f32cdad", "src_port": 49879, "tcp_stream": 530, "udp_stream": null, "frame_number": 25891, "timestamp_epoch": "1583962656.695963000" }, { "kind": "tls_client_hello", "dst_ip": "35.190.72.21", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "idsync.rlcdn.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-e262c682cc7e9d74b62c079f", "src_port": 49880, "tcp_stream": 531, "udp_stream": null, "frame_number": 25920, "timestamp_epoch": "1583962656.815217000" }, { "kind": "tls_client_hello", "dst_ip": "139.178.81.9", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "loadus.exelator.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-76bbb05ca682bc60425717ac", "src_port": 49881, "tcp_stream": 532, "udp_stream": null, "frame_number": 25965, "timestamp_epoch": "1583962656.856532000" }, { "kind": "tls_client_hello", "dst_ip": "130.211.21.54", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "act-us.rd.linksynergy.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-e70cf10fe81f77f29ba2a1eb", "src_port": 49882, "tcp_stream": 533, "udp_stream": null, "frame_number": 26020, "timestamp_epoch": "1583962656.976931000" }, { "kind": "tls_client_hello", "dst_ip": "18.213.117.209", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "insight.adsrvr.org" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-2dfd14e5ff31d57c7393e755", "src_port": 49884, "tcp_stream": 535, "udp_stream": null, "frame_number": 26041, "timestamp_epoch": "1583962657.062255000" }, { "kind": "tls_client_hello", "dst_ip": "3.225.102.19", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "match.adsrvr.org" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-9f4f1a353c6d0de52c5c5628", "src_port": 49883, "tcp_stream": 534, "udp_stream": null, "frame_number": 26043, "timestamp_epoch": "1583962657.062865000" }, { "kind": "tls_client_hello", "dst_ip": "172.217.2.226", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "cm.g.doubleclick.net" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-fee7a2f08ce0e76d78b2c94a", "src_port": 49888, "tcp_stream": 539, "udp_stream": null, "frame_number": 26103, "timestamp_epoch": "1583962657.150270000" }, { "kind": "tls_client_hello", "dst_ip": "35.244.140.139", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "eu-u.openx.net" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-38f4e8dd050011babb18e423", "src_port": 49889, "tcp_stream": 540, "udp_stream": null, "frame_number": 26107, "timestamp_epoch": "1583962657.152339000" }, { "kind": "tls_client_hello", "dst_ip": "89.187.164.37", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "load77.exelator.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-6610d7d17c56dadcf88cb1b5", "src_port": 49887, "tcp_stream": 538, "udp_stream": null, "frame_number": 26116, "timestamp_epoch": "1583962657.165018000" }, { "kind": "tls_client_hello", "dst_ip": "8.43.72.97", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "pixel.rubiconproject.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-a0e3196546dabb779f16f1d1", "src_port": 49885, "tcp_stream": 536, "udp_stream": null, "frame_number": 26150, "timestamp_epoch": "1583962657.208684000" }, { "kind": "tls_client_hello", "dst_ip": "104.254.148.166", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "secure.adnxs.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-6bf6e6f8c4d3677d6ad3595d", "src_port": 49886, "tcp_stream": 537, "udp_stream": null, "frame_number": 26185, "timestamp_epoch": "1583962657.267107000" }, { "kind": "tls_client_hello", "dst_ip": "23.199.253.53", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "dsum-sec.casalemedia.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-aef0c2ff428fe20f2bae305a", "src_port": 49892, "tcp_stream": 543, "udp_stream": null, "frame_number": 26187, "timestamp_epoch": "1583962657.268445000" }, { "kind": "tls_client_hello", "dst_ip": "34.231.157.146", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "match.360yield.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-0e2620f649894bd90ab57b75", "src_port": 49891, "tcp_stream": 542, "udp_stream": null, "frame_number": 26189, "timestamp_epoch": "1583962657.268730000" }, { "kind": "tls_client_hello", "dst_ip": "3.215.9.190", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "pixel.advertising.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-90fa4213b909683fa49e2d70", "src_port": 49890, "tcp_stream": 541, "udp_stream": null, "frame_number": 26191, "timestamp_epoch": "1583962657.269010000" }, { "kind": "tls_client_hello", "dst_ip": "199.187.193.166", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "rtb-csync.smartadserver.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-bf7bda40201cbaa3a8ca97d9", "src_port": 49893, "tcp_stream": 544, "udp_stream": null, "frame_number": 26247, "timestamp_epoch": "1583962657.359466000" }, { "kind": "tls_client_hello", "dst_ip": "130.211.28.134", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "mapping.nxtck.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-7bbdab3dece5c6823050c103", "src_port": 49894, "tcp_stream": 545, "udp_stream": null, "frame_number": 26258, "timestamp_epoch": "1583962657.368952000" }, { "kind": "tls_client_hello", "dst_ip": "199.187.193.166", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "rtb-csync.smartadserver.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-d9190bde9396097a0e942703", "src_port": 49895, "tcp_stream": 546, "udp_stream": null, "frame_number": 26299, "timestamp_epoch": "1583962657.447591000" }, { "kind": "tls_client_hello", "dst_ip": "104.36.113.17", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "image2.pubmatic.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-574bf7d0754d7647dd498da4", "src_port": 49896, "tcp_stream": 547, "udp_stream": null, "frame_number": 26337, "timestamp_epoch": "1583962657.544729000" }, { "kind": "tls_client_hello", "dst_ip": "52.45.33.138", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "ups.analytics.yahoo.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-f9abb3a79692c481903dc277", "src_port": 49897, "tcp_stream": 548, "udp_stream": null, "frame_number": 26406, "timestamp_epoch": "1583962657.853227000" }, { "kind": "tls_client_hello", "dst_ip": "169.46.74.216", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "px.steelhousemedia.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-b7c42ba2272aed0c2776acfe", "src_port": 49898, "tcp_stream": 549, "udp_stream": null, "frame_number": 26437, "timestamp_epoch": "1583962659.002722000" }, { "kind": "tls_client_hello", "dst_ip": "169.46.74.216", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "px.steelhousemedia.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-a360eb76bce2257a91b79065", "src_port": 49899, "tcp_stream": 550, "udp_stream": null, "frame_number": 26491, "timestamp_epoch": "1583962661.185111000" }, { "kind": "tls_client_hello", "dst_ip": "169.46.74.216", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "px.steelhousemedia.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-2a8591cecdfca07802359147", "src_port": 49901, "tcp_stream": 552, "udp_stream": null, "frame_number": 26542, "timestamp_epoch": "1583962661.497727000" }, { "kind": "tls_client_hello", "dst_ip": "34.234.197.182", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "match.prod.bidr.io" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-ec7aca14c0c4d048e3d9c51d", "src_port": 49900, "tcp_stream": 551, "udp_stream": null, "frame_number": 26549, "timestamp_epoch": "1583962661.521962000" }, { "kind": "tls_client_hello", "dst_ip": "54.244.36.123", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "cookie-sync-service-prod.steelhousemedia.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-8baaf766fc050c5a00e74be1", "src_port": 49902, "tcp_stream": 553, "udp_stream": null, "frame_number": 26581, "timestamp_epoch": "1583962661.942793000" }, { "kind": "tls_client_hello", "dst_ip": "169.60.140.161", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "ww.steelhousemedia.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-6bb2175e5298f6aac0cf850d", "src_port": 49903, "tcp_stream": 554, "udp_stream": null, "frame_number": 26620, "timestamp_epoch": "1583962663.632257000" }, { "kind": "tls_client_hello", "dst_ip": "40.90.22.187", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "login.live.com" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-bdef7354be14e412214c6f1c", "src_port": 50101, "tcp_stream": 557, "udp_stream": null, "frame_number": 26727, "timestamp_epoch": "1583962684.021932000" }, { "kind": "tls_client_hello", "dst_ip": "20.44.86.43", "fields": { "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1", "tls.handshake.extensions_server_name": "watson.telemetry.microsoft.com" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-6ad058e605761bcfb33cd502", "src_port": 50102, "tcp_stream": 558, "udp_stream": null, "frame_number": 26770, "timestamp_epoch": "1583962684.378942000" }, { "kind": "tls_client_hello", "dst_ip": "13.107.3.128", "fields": { "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1", "tls.handshake.extensions_server_name": "config.edge.skype.com" }, "src_ip": "10.3.11.218", "dst_port": 443, "event_id": "evt-5691d30c74b0b3fcf618511f", "src_port": 49822, "tcp_stream": 559, "udp_stream": null, "frame_number": 26799, "timestamp_epoch": "1583962685.627144000" }, { "kind": "tls_client_hello", "dst_ip": "13.107.3.128", "fields": { "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1", "tls.handshake.extensions_server_name": "config.edge.skype.com" }, "src_ip": "10.3.11.218", "dst_port": 443, "event_id": "evt-8cdc95292d2a60d1f32c9839", "src_port": 49823, "tcp_stream": 560, "udp_stream": null, "frame_number": 26833, "timestamp_epoch": "1583962685.853264000" }, { "kind": "tls_client_hello", "dst_ip": "13.107.3.128", "fields": { "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1", "tls.handshake.extensions_server_name": "config.edge.skype.com" }, "src_ip": "10.3.11.218", "dst_port": 443, "event_id": "evt-4361727b83147f365e547ecf", "src_port": 49824, "tcp_stream": 561, "udp_stream": null, "frame_number": 26853, "timestamp_epoch": "1583962685.883420000" }, { "kind": "tls_client_hello", "dst_ip": "13.107.3.128", "fields": { "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1", "tls.handshake.extensions_server_name": "config.edge.skype.com" }, "src_ip": "10.3.11.218", "dst_port": 443, "event_id": "evt-2687a2f3a4a0eaa0136e9d6f", "src_port": 49825, "tcp_stream": 562, "udp_stream": null, "frame_number": 26855, "timestamp_epoch": "1583962685.883687000" }, { "kind": "tls_client_hello", "dst_ip": "13.107.3.128", "fields": { "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1", "tls.handshake.extensions_server_name": "config.edge.skype.com" }, "src_ip": "10.3.11.218", "dst_port": 443, "event_id": "evt-086b1b4e761a88ecceb868b8", "src_port": 49826, "tcp_stream": 563, "udp_stream": null, "frame_number": 26857, "timestamp_epoch": "1583962685.883957000" }, { "kind": "tls_client_hello", "dst_ip": "13.107.3.128", "fields": { "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1", "tls.handshake.extensions_server_name": "config.edge.skype.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-1c94534c43057aa65a036b17", "src_port": 49905, "tcp_stream": 565, "udp_stream": null, "frame_number": 27318, "timestamp_epoch": "1583962732.931229000" }, { "kind": "tls_client_hello", "dst_ip": "13.107.3.128", "fields": { "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1", "tls.handshake.extensions_server_name": "config.edge.skype.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-c46156f5de1bf2d0a0d351bd", "src_port": 49906, "tcp_stream": 566, "udp_stream": null, "frame_number": 27331, "timestamp_epoch": "1583962732.970807000" }, { "kind": "tls_client_hello", "dst_ip": "40.91.76.238", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "licensing.mp.microsoft.com" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-1d7e2fd0bbd1a1381f0da08c", "src_port": 50104, "tcp_stream": 568, "udp_stream": null, "frame_number": 27440, "timestamp_epoch": "1583962857.819657000" }, { "kind": "tls_client_hello", "dst_ip": "23.206.213.111", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "storecatalogrevocation.storequality.microsoft.com" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-218458f445e4c05a7593bdee", "src_port": 50105, "tcp_stream": 569, "udp_stream": null, "frame_number": 27482, "timestamp_epoch": "1583962861.387323000" }, { "kind": "tls_client_hello", "dst_ip": "13.78.168.230", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "slscr.update.microsoft.com" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-c8b077242a193c00e835d194", "src_port": 50111, "tcp_stream": 572, "udp_stream": null, "frame_number": 27542, "timestamp_epoch": "1583962904.927272000" }, { "kind": "tls_client_hello", "dst_ip": "190.214.13.2", "fields": { "tls.handshake.ja3": "72a589da586844d7f0818ce684948eea" }, "src_ip": "10.3.11.194", "dst_port": 449, "event_id": "evt-73b4f8d176f07dc458f6c8d5", "src_port": 50112, "tcp_stream": 573, "udp_stream": null, "frame_number": 27568, "timestamp_epoch": "1583962932.874828000" }, { "kind": "tls_client_hello", "dst_ip": "185.14.31.98", "fields": { "tls.handshake.ja3": "72a589da586844d7f0818ce684948eea" }, "src_ip": "10.3.11.194", "dst_port": 447, "event_id": "evt-0c50085885cf91d67b0a0959", "src_port": 50113, "tcp_stream": 574, "udp_stream": null, "frame_number": 27581, "timestamp_epoch": "1583962934.022591000" }, { "kind": "tls_client_hello", "dst_ip": "190.214.13.2", "fields": { "tls.handshake.ja3": "72a589da586844d7f0818ce684948eea" }, "src_ip": "10.3.11.194", "dst_port": 449, "event_id": "evt-5ecc19731dcc10525b4e1bba", "src_port": 50114, "tcp_stream": 575, "udp_stream": null, "frame_number": 27612, "timestamp_epoch": "1583962937.710734000" }, { "kind": "tls_client_hello", "dst_ip": "199.247.13.144", "fields": { "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1", "tls.handshake.extensions_server_name": "hakunamatatata.com" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-e8dd90ee5713eca41f320194", "src_port": 50128, "tcp_stream": 589, "udp_stream": null, "frame_number": 27780, "timestamp_epoch": "1583963020.547148000" }, { "kind": "tls_client_hello", "dst_ip": "209.97.130.197", "fields": { "tls.handshake.ja3": "37f463bf4616ecd445d4a1937da06e19", "tls.handshake.extensions_server_name": "helpforyourservice.com" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-e3baf80526e26b1e37a945a9", "src_port": 50131, "tcp_stream": 592, "udp_stream": null, "frame_number": 28325, "timestamp_epoch": "1583963031.337903000" }, { "kind": "tls_client_hello", "dst_ip": "209.97.130.197", "fields": { "tls.handshake.ja3": "37f463bf4616ecd445d4a1937da06e19", "tls.handshake.extensions_server_name": "helpforyourservice.com" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-c54d7b65b5000f003e13838b", "src_port": 50132, "tcp_stream": 593, "udp_stream": null, "frame_number": 28568, "timestamp_epoch": "1583963032.456885000" }, { "kind": "tls_client_hello", "dst_ip": "209.97.130.197", "fields": { "tls.handshake.ja3": "37f463bf4616ecd445d4a1937da06e19", "tls.handshake.extensions_server_name": "helpforyourservice.com" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-84f816c234c3e78f7ebbf0c0", "src_port": 50134, "tcp_stream": 595, "udp_stream": null, "frame_number": 28593, "timestamp_epoch": "1583963038.380480000" }, { "kind": "tls_client_hello", "dst_ip": "185.14.31.98", "fields": { "tls.handshake.ja3": "72a589da586844d7f0818ce684948eea" }, "src_ip": "10.3.11.194", "dst_port": 447, "event_id": "evt-a259eacc228d131c9435fd10", "src_port": 50136, "tcp_stream": 597, "udp_stream": null, "frame_number": 28626, "timestamp_epoch": "1583963042.872381000" }, { "kind": "tls_client_hello", "dst_ip": "209.97.130.197", "fields": { "tls.handshake.ja3": "37f463bf4616ecd445d4a1937da06e19", "tls.handshake.extensions_server_name": "helpforyourservice.com" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-c681ff1983644bec770a34b8", "src_port": 50137, "tcp_stream": 598, "udp_stream": null, "frame_number": 28731, "timestamp_epoch": "1583963044.340672000" }, { "kind": "tls_client_hello", "dst_ip": "209.97.130.197", "fields": { "tls.handshake.ja3": "37f463bf4616ecd445d4a1937da06e19", "tls.handshake.extensions_server_name": "helpforyourservice.com" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-f44ae36688eefa763ca19f45", "src_port": 50138, "tcp_stream": 599, "udp_stream": null, "frame_number": 28754, "timestamp_epoch": "1583963050.026088000" }, { "kind": "tls_client_hello", "dst_ip": "209.97.130.197", "fields": { "tls.handshake.ja3": "37f463bf4616ecd445d4a1937da06e19", "tls.handshake.extensions_server_name": "helpforyourservice.com" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-0275d5ebe854da5ad561c48b", "src_port": 50142, "tcp_stream": 603, "udp_stream": null, "frame_number": 28800, "timestamp_epoch": "1583963055.686781000" }, { "kind": "tls_client_hello", "dst_ip": "209.97.130.197", "fields": { "tls.handshake.ja3": "37f463bf4616ecd445d4a1937da06e19", "tls.handshake.extensions_server_name": "helpforyourservice.com" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-9b5b2578d4fbdb245f9860e1", "src_port": 50144, "tcp_stream": 605, "udp_stream": null, "frame_number": 28824, "timestamp_epoch": "1583963061.330535000" }, { "kind": "tls_client_hello", "dst_ip": "209.97.130.197", "fields": { "tls.handshake.ja3": "37f463bf4616ecd445d4a1937da06e19", "tls.handshake.extensions_server_name": "helpforyourservice.com" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-b61cd1005d1bafbcc89c8896", "src_port": 50146, "tcp_stream": 607, "udp_stream": null, "frame_number": 28851, "timestamp_epoch": "1583963066.986810000" }, { "kind": "tls_client_hello", "dst_ip": "209.97.130.197", "fields": { "tls.handshake.ja3": "37f463bf4616ecd445d4a1937da06e19", "tls.handshake.extensions_server_name": "helpforyourservice.com" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-4e864b06c00d8de28b4980db", "src_port": 50147, "tcp_stream": 608, "udp_stream": null, "frame_number": 28874, "timestamp_epoch": "1583963072.718134000" }, { "kind": "tls_client_hello", "dst_ip": "209.97.130.197", "fields": { "tls.handshake.ja3": "37f463bf4616ecd445d4a1937da06e19", "tls.handshake.extensions_server_name": "helpforyourservice.com" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-55622d573379a0307d977846", "src_port": 50150, "tcp_stream": 610, "udp_stream": null, "frame_number": 29109, "timestamp_epoch": "1583963076.561312000" }, { "kind": "tls_client_hello", "dst_ip": "209.97.130.197", "fields": { "tls.handshake.ja3": "37f463bf4616ecd445d4a1937da06e19", "tls.handshake.extensions_server_name": "helpforyourservice.com" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-c16b113e8dbf82cf3e19bb2a", "src_port": 50152, "tcp_stream": 612, "udp_stream": null, "frame_number": 29140, "timestamp_epoch": "1583963082.191127000" }, { "kind": "tls_client_hello", "dst_ip": "209.97.130.197", "fields": { "tls.handshake.ja3": "37f463bf4616ecd445d4a1937da06e19", "tls.handshake.extensions_server_name": "helpforyourservice.com" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-f864096c9b8aa668ee52d8e1", "src_port": 50153, "tcp_stream": 613, "udp_stream": null, "frame_number": 29157, "timestamp_epoch": "1583963082.833470000" }, { "kind": "tls_client_hello", "dst_ip": "209.97.130.197", "fields": { "tls.handshake.ja3": "37f463bf4616ecd445d4a1937da06e19", "tls.handshake.extensions_server_name": "helpforyourservice.com" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-563673a8c535526e06e604a1", "src_port": 50158, "tcp_stream": 615, "udp_stream": null, "frame_number": 29188, "timestamp_epoch": "1583963088.543433000" }, { "kind": "tls_client_hello", "dst_ip": "209.97.130.197", "fields": { "tls.handshake.ja3": "37f463bf4616ecd445d4a1937da06e19", "tls.handshake.extensions_server_name": "helpforyourservice.com" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-49024a709c2021d593585e7e", "src_port": 50162, "tcp_stream": 619, "udp_stream": null, "frame_number": 29237, "timestamp_epoch": "1583963094.199022000" }, { "kind": "tls_client_hello", "dst_ip": "209.97.130.197", "fields": { "tls.handshake.ja3": "37f463bf4616ecd445d4a1937da06e19", "tls.handshake.extensions_server_name": "helpforyourservice.com" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-e9b8f0b9b53998c7925d8ab1", "src_port": 50163, "tcp_stream": 620, "udp_stream": null, "frame_number": 29254, "timestamp_epoch": "1583963099.794939000" }, { "kind": "tls_client_hello", "dst_ip": "209.97.130.197", "fields": { "tls.handshake.ja3": "37f463bf4616ecd445d4a1937da06e19", "tls.handshake.extensions_server_name": "helpforyourservice.com" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-9c18497e78a5053c8ba3d949", "src_port": 50166, "tcp_stream": 623, "udp_stream": null, "frame_number": 29297, "timestamp_epoch": "1583963105.686170000" }, { "kind": "tls_client_hello", "dst_ip": "209.97.130.197", "fields": { "tls.handshake.ja3": "37f463bf4616ecd445d4a1937da06e19", "tls.handshake.extensions_server_name": "helpforyourservice.com" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-d2fad1cd2a944569d592538d", "src_port": 50168, "tcp_stream": 625, "udp_stream": null, "frame_number": 29330, "timestamp_epoch": "1583963111.295175000" }, { "kind": "tls_client_hello", "dst_ip": "209.97.130.197", "fields": { "tls.handshake.ja3": "37f463bf4616ecd445d4a1937da06e19", "tls.handshake.extensions_server_name": "helpforyourservice.com" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-e54d4045c62cf64e0934d879", "src_port": 50170, "tcp_stream": 627, "udp_stream": null, "frame_number": 29359, "timestamp_epoch": "1583963116.920691000" }, { "kind": "tls_client_hello", "dst_ip": "209.97.130.197", "fields": { "tls.handshake.ja3": "37f463bf4616ecd445d4a1937da06e19", "tls.handshake.extensions_server_name": "helpforyourservice.com" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-d427f32cff99c913a49c1f4d", "src_port": 50171, "tcp_stream": 628, "udp_stream": null, "frame_number": 29378, "timestamp_epoch": "1583963122.530013000" }, { "kind": "tls_client_hello", "dst_ip": "209.97.130.197", "fields": { "tls.handshake.ja3": "37f463bf4616ecd445d4a1937da06e19", "tls.handshake.extensions_server_name": "helpforyourservice.com" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-ea890be26778b0802500e773", "src_port": 50172, "tcp_stream": 629, "udp_stream": null, "frame_number": 29395, "timestamp_epoch": "1583963123.115052000" }, { "kind": "tls_client_hello", "dst_ip": "13.107.21.200", "fields": { "tls.handshake.ja3": "9e10692f1b7f78228b2d4e424db3a98c", "tls.handshake.extensions_server_name": "www.bing.com" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-8cf24ecb83b3b6d55ba9441f", "src_port": 50180, "tcp_stream": 637, "udp_stream": null, "frame_number": 29479, "timestamp_epoch": "1583963163.078841000" }, { "kind": "tls_client_hello", "dst_ip": "204.79.197.200", "fields": { "tls.handshake.ja3": "9e10692f1b7f78228b2d4e424db3a98c", "tls.handshake.extensions_server_name": "www.bing.com" }, "src_ip": "10.3.11.218", "dst_port": 443, "event_id": "evt-a68c948efedf010b00bc9b60", "src_port": 49827, "tcp_stream": 642, "udp_stream": null, "frame_number": 29616, "timestamp_epoch": "1583963186.465756000" }, { "kind": "tls_client_hello", "dst_ip": "52.109.88.36", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "nexusrules.officeapps.live.com" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-2923e6d7ab185fbbe0ffea46", "src_port": 50185, "tcp_stream": 647, "udp_stream": null, "frame_number": 29850, "timestamp_epoch": "1583963487.870712000" }, { "kind": "tls_client_hello", "dst_ip": "13.78.177.144", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "array807.prod.do.dsp.mp.microsoft.com" }, "src_ip": "10.3.11.218", "dst_port": 443, "event_id": "evt-51b8a6783ff8a89026c4aaae", "src_port": 49831, "tcp_stream": 649, "udp_stream": null, "frame_number": 29900, "timestamp_epoch": "1583963577.962639000" }, { "kind": "tls_client_hello", "dst_ip": "52.161.15.246", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "array801.prod.do.dsp.mp.microsoft.com" }, "src_ip": "10.3.11.218", "dst_port": 443, "event_id": "evt-55ec0526cc3b28e6edec5a04", "src_port": 49833, "tcp_stream": 652, "udp_stream": null, "frame_number": 29984, "timestamp_epoch": "1583963646.363909000" }, { "kind": "tls_client_hello", "dst_ip": "13.78.187.58", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "array802.prod.do.dsp.mp.microsoft.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-7aed5ffcd5981afc8cf4763b", "src_port": 49910, "tcp_stream": 653, "udp_stream": null, "frame_number": 30011, "timestamp_epoch": "1583963703.402183000" }, { "kind": "tls_client_hello", "dst_ip": "52.161.15.246", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "array801.prod.do.dsp.mp.microsoft.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-cb715e68ce283b0c4b6f12ec", "src_port": 49911, "tcp_stream": 654, "udp_stream": null, "frame_number": 30039, "timestamp_epoch": "1583963756.619519000" }, { "kind": "tls_client_hello", "dst_ip": "52.161.15.246", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "array801.prod.do.dsp.mp.microsoft.com" }, "src_ip": "10.3.11.218", "dst_port": 443, "event_id": "evt-69d3ff06210ccdafd78ac0c5", "src_port": 49838, "tcp_stream": 655, "udp_stream": null, "frame_number": 30072, "timestamp_epoch": "1583963838.012937000" }, { "kind": "tls_client_hello", "dst_ip": "52.161.15.246", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "array801.prod.do.dsp.mp.microsoft.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-612337e1c06b6a5776d9514f", "src_port": 49912, "tcp_stream": 656, "udp_stream": null, "frame_number": 30112, "timestamp_epoch": "1583964000.153219000" }, { "kind": "tls_client_hello", "dst_ip": "52.161.15.246", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "array801.prod.do.dsp.mp.microsoft.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-26e4b32db8758fda2d76ef34", "src_port": 49913, "tcp_stream": 657, "udp_stream": null, "frame_number": 30149, "timestamp_epoch": "1583964094.984345000" }, { "kind": "tls_client_hello", "dst_ip": "52.161.15.246", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "array801.prod.do.dsp.mp.microsoft.com" }, "src_ip": "10.3.11.218", "dst_port": 443, "event_id": "evt-c06c2f7cf2fba2a18f886b20", "src_port": 49840, "tcp_stream": 658, "udp_stream": null, "frame_number": 30173, "timestamp_epoch": "1583964109.370351000" }, { "kind": "tls_client_hello", "dst_ip": "52.161.15.246", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "array801.prod.do.dsp.mp.microsoft.com" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-1199de50dc529187075ae4d3", "src_port": 49914, "tcp_stream": 659, "udp_stream": null, "frame_number": 30203, "timestamp_epoch": "1583964262.889030000" } ], "unclassified_tcp": [ { "kind": "unclassified_tcp", "dst_ip": "10.3.11.3", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.218", "dst_port": 445, "event_id": "evt-5a192ca2d2151c67cfc19bde", "src_port": 49680, "tcp_stream": 9, "udp_stream": null, "frame_number": 2060, "timestamp_epoch": "1583961796.494666000" }, { "kind": "unclassified_tcp", "dst_ip": "10.3.11.3", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.194", "dst_port": 445, "event_id": "evt-cce9b2ddeeaaf1b87cd44b93", "src_port": 49683, "tcp_stream": 65, "udp_stream": null, "frame_number": 3691, "timestamp_epoch": "1583961822.264668000" }, { "kind": "unclassified_tcp", "dst_ip": "10.3.11.3", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.218", "dst_port": 445, "event_id": "evt-cbe704e616ddc05d54224def", "src_port": 49680, "tcp_stream": 9, "udp_stream": null, "frame_number": 3761, "timestamp_epoch": "1583961826.511746000" }, { "kind": "unclassified_tcp", "dst_ip": "10.3.11.3", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.218", "dst_port": 445, "event_id": "evt-dfbf3e448a52dfd14ac5ab45", "src_port": 49730, "tcp_stream": 83, "udp_stream": null, "frame_number": 3765, "timestamp_epoch": "1583961828.777311000" }, { "kind": "unclassified_tcp", "dst_ip": "10.3.11.3", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.194", "dst_port": 445, "event_id": "evt-012fff13e4ff19b63cbba8c9", "src_port": 49707, "tcp_stream": 106, "udp_stream": null, "frame_number": 4171, "timestamp_epoch": "1583961843.701848000" }, { "kind": "unclassified_tcp", "dst_ip": "10.3.11.3", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.194", "dst_port": 445, "event_id": "evt-8228dd9533545734d9b055a0", "src_port": 49683, "tcp_stream": 65, "udp_stream": null, "frame_number": 4312, "timestamp_epoch": "1583961852.280455000" }, { "kind": "unclassified_tcp", "dst_ip": "10.3.11.3", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 445, "event_id": "evt-9ecdf60c018392ff1382ba63", "src_port": 49682, "tcp_stream": 131, "udp_stream": null, "frame_number": 4334, "timestamp_epoch": "1583961854.170469000" }, { "kind": "unclassified_tcp", "dst_ip": "10.3.11.3", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.218", "dst_port": 445, "event_id": "evt-c1c9f6daf61603c09db32d2d", "src_port": 49680, "tcp_stream": 9, "udp_stream": null, "frame_number": 5384, "timestamp_epoch": "1583961856.526776000" }, { "kind": "unclassified_tcp", "dst_ip": "10.3.11.3", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.218", "dst_port": 445, "event_id": "evt-c8ea5d322d69f40017b766fe", "src_port": 49730, "tcp_stream": 83, "udp_stream": null, "frame_number": 7561, "timestamp_epoch": "1583961858.793481000" }, { "kind": "unclassified_tcp", "dst_ip": "10.3.11.3", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.194", "dst_port": 445, "event_id": "evt-6e25a86edcea22051f19677b", "src_port": 49707, "tcp_stream": 106, "udp_stream": null, "frame_number": 8540, "timestamp_epoch": "1583961873.703185000" }, { "kind": "unclassified_tcp", "dst_ip": "10.3.11.3", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 445, "event_id": "evt-67243033dd3737f3b51bfe62", "src_port": 49733, "tcp_stream": 182, "udp_stream": null, "frame_number": 8604, "timestamp_epoch": "1583961875.623963000" }, { "kind": "unclassified_tcp", "dst_ip": "10.3.11.3", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.194", "dst_port": 445, "event_id": "evt-bfb09b7867f15aa50da64384", "src_port": 49683, "tcp_stream": 65, "udp_stream": null, "frame_number": 9357, "timestamp_epoch": "1583961882.295920000" }, { "kind": "unclassified_tcp", "dst_ip": "10.3.11.3", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 445, "event_id": "evt-b7970f634ac8b9d2c07cf260", "src_port": 49682, "tcp_stream": 131, "udp_stream": null, "frame_number": 9411, "timestamp_epoch": "1583961884.172292000" }, { "kind": "unclassified_tcp", "dst_ip": "10.3.11.218", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.3", "dst_port": 49680, "event_id": "evt-86792c326ea658b328484754", "src_port": 445, "tcp_stream": 9, "udp_stream": null, "frame_number": 9413, "timestamp_epoch": "1583961886.514224000" }, { "kind": "unclassified_tcp", "dst_ip": "10.3.11.3", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.218", "dst_port": 445, "event_id": "evt-a949870828d5a97050b389e2", "src_port": 49680, "tcp_stream": 9, "udp_stream": null, "frame_number": 9415, "timestamp_epoch": "1583961886.528637000" }, { "kind": "unclassified_tcp", "dst_ip": "13.107.3.128", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-8a2be6b18a5590abc37c1aa2", "src_port": 49742, "tcp_stream": 199, "udp_stream": null, "frame_number": 10173, "timestamp_epoch": "1583961899.752039000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.194.42", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-b2217785dc4c529132fbc85d", "src_port": 49748, "tcp_stream": 205, "udp_stream": null, "frame_number": 10174, "timestamp_epoch": "1583961899.861890000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.194.42", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-60d6f444f187d186a1e7f390", "src_port": 49749, "tcp_stream": 206, "udp_stream": null, "frame_number": 10175, "timestamp_epoch": "1583961899.865870000" }, { "kind": "unclassified_tcp", "dst_ip": "72.246.84.150", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-d154d6d901f308d5b9f416a7", "src_port": 49759, "tcp_stream": 216, "udp_stream": null, "frame_number": 10176, "timestamp_epoch": "1583961900.035039000" }, { "kind": "unclassified_tcp", "dst_ip": "104.26.9.32", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-f214406f30a286cb6c3c7caa", "src_port": 49756, "tcp_stream": 213, "udp_stream": null, "frame_number": 10177, "timestamp_epoch": "1583961900.267563000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.194.131", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-5a36939fcf8e4ab1e4126ad9", "src_port": 49758, "tcp_stream": 215, "udp_stream": null, "frame_number": 10178, "timestamp_epoch": "1583961901.227747000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.194.131", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-6eb1e74611449890dc2c43d7", "src_port": 49765, "tcp_stream": 222, "udp_stream": null, "frame_number": 10179, "timestamp_epoch": "1583961901.295661000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.194.131", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-70155380c6d0b0ef6b1462f7", "src_port": 49763, "tcp_stream": 220, "udp_stream": null, "frame_number": 10180, "timestamp_epoch": "1583961901.295721000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.194.131", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-d79a9d248b46171157239b44", "src_port": 49767, "tcp_stream": 224, "udp_stream": null, "frame_number": 10181, "timestamp_epoch": "1583961901.327658000" }, { "kind": "unclassified_tcp", "dst_ip": "23.211.18.27", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-5dbab5b95ed38d18e5389556", "src_port": 49750, "tcp_stream": 207, "udp_stream": null, "frame_number": 10182, "timestamp_epoch": "1583961901.605505000" }, { "kind": "unclassified_tcp", "dst_ip": "23.211.18.27", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-021fb1b3bef6eb5eecf41b2b", "src_port": 49774, "tcp_stream": 231, "udp_stream": null, "frame_number": 10183, "timestamp_epoch": "1583961901.705780000" }, { "kind": "unclassified_tcp", "dst_ip": "13.249.26.99", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-b3ffe231b6889b7d8e6fbba2", "src_port": 49768, "tcp_stream": 225, "udp_stream": null, "frame_number": 10184, "timestamp_epoch": "1583961901.705829000" }, { "kind": "unclassified_tcp", "dst_ip": "52.9.108.55", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-9e583f5ef67af4e95275942d", "src_port": 49760, "tcp_stream": 217, "udp_stream": null, "frame_number": 10189, "timestamp_epoch": "1583961902.211259000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.193.142", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-22e8164f879d3356e1906db2", "src_port": 49778, "tcp_stream": 235, "udp_stream": null, "frame_number": 10190, "timestamp_epoch": "1583961902.323513000" }, { "kind": "unclassified_tcp", "dst_ip": "72.21.91.66", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-ae3a81b42e378cdad077b487", "src_port": 49780, "tcp_stream": 237, "udp_stream": null, "frame_number": 10191, "timestamp_epoch": "1583961902.341489000" }, { "kind": "unclassified_tcp", "dst_ip": "31.13.65.7", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-8631dce546a0947ff101ee7d", "src_port": 49779, "tcp_stream": 236, "udp_stream": null, "frame_number": 10192, "timestamp_epoch": "1583961902.409386000" }, { "kind": "unclassified_tcp", "dst_ip": "23.209.74.120", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-e39e383be5c698602cb90cde", "src_port": 49781, "tcp_stream": 238, "udp_stream": null, "frame_number": 10193, "timestamp_epoch": "1583961902.421372000" }, { "kind": "unclassified_tcp", "dst_ip": "151.101.50.208", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-6523387fa6b436b070dad17c", "src_port": 49777, "tcp_stream": 234, "udp_stream": null, "frame_number": 10194, "timestamp_epoch": "1583961902.435382000" }, { "kind": "unclassified_tcp", "dst_ip": "23.209.74.120", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-ed93350545d08897283786a1", "src_port": 49754, "tcp_stream": 211, "udp_stream": null, "frame_number": 10195, "timestamp_epoch": "1583961902.603481000" }, { "kind": "unclassified_tcp", "dst_ip": "23.209.74.120", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-90e449d7469e30c5dacd50ec", "src_port": 49782, "tcp_stream": 239, "udp_stream": null, "frame_number": 10196, "timestamp_epoch": "1583961902.604427000" }, { "kind": "unclassified_tcp", "dst_ip": "31.13.65.7", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-b76054b59074245a563c01be", "src_port": 49785, "tcp_stream": 242, "udp_stream": null, "frame_number": 10197, "timestamp_epoch": "1583961902.860405000" }, { "kind": "unclassified_tcp", "dst_ip": "72.21.91.66", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-dde6ef050aeec9ad0b14734c", "src_port": 49784, "tcp_stream": 241, "udp_stream": null, "frame_number": 10198, "timestamp_epoch": "1583961902.860465000" }, { "kind": "unclassified_tcp", "dst_ip": "104.244.42.8", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-d5dda98e87db53810fd852a0", "src_port": 49786, "tcp_stream": 243, "udp_stream": null, "frame_number": 10199, "timestamp_epoch": "1583961903.373961000" }, { "kind": "unclassified_tcp", "dst_ip": "23.206.208.173", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-bb9cab806327f6b944a10b05", "src_port": 49790, "tcp_stream": 247, "udp_stream": null, "frame_number": 10200, "timestamp_epoch": "1583961904.327081000" }, { "kind": "unclassified_tcp", "dst_ip": "23.206.208.173", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-37744b43567534e654e7cd4e", "src_port": 49791, "tcp_stream": 248, "udp_stream": null, "frame_number": 10201, "timestamp_epoch": "1583961904.566862000" }, { "kind": "unclassified_tcp", "dst_ip": "31.13.93.35", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-c668e5261bf4653e2820076c", "src_port": 49787, "tcp_stream": 244, "udp_stream": null, "frame_number": 10202, "timestamp_epoch": "1583961905.592654000" }, { "kind": "unclassified_tcp", "dst_ip": "10.3.11.3", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 445, "event_id": "evt-c5b685000f6aa33ada7d9967", "src_port": 49733, "tcp_stream": 182, "udp_stream": null, "frame_number": 10203, "timestamp_epoch": "1583961905.625185000" }, { "kind": "unclassified_tcp", "dst_ip": "10.3.11.194", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.3", "dst_port": 49683, "event_id": "evt-aa75c7ef671be0e7612bb3f3", "src_port": 445, "tcp_stream": 65, "udp_stream": null, "frame_number": 10238, "timestamp_epoch": "1583961912.296606000" }, { "kind": "unclassified_tcp", "dst_ip": "10.3.11.3", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.194", "dst_port": 445, "event_id": "evt-709fe9b4edbed5f97533270c", "src_port": 49683, "tcp_stream": 65, "udp_stream": null, "frame_number": 10240, "timestamp_epoch": "1583961912.314226000" }, { "kind": "unclassified_tcp", "dst_ip": "10.3.11.3", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 445, "event_id": "evt-9112a0db6de28e145f8e096a", "src_port": 49682, "tcp_stream": 131, "udp_stream": null, "frame_number": 10246, "timestamp_epoch": "1583961914.173222000" }, { "kind": "unclassified_tcp", "dst_ip": "10.3.11.3", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.218", "dst_port": 445, "event_id": "evt-05c0179d9db161f0bc4b88e7", "src_port": 49680, "tcp_stream": 9, "udp_stream": null, "frame_number": 10250, "timestamp_epoch": "1583961916.544574000" }, { "kind": "unclassified_tcp", "dst_ip": "10.3.11.218", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.3", "dst_port": 49730, "event_id": "evt-845fd81b8aef43161c9aef3c", "src_port": 445, "tcp_stream": 83, "udp_stream": null, "frame_number": 10254, "timestamp_epoch": "1583961918.811856000" }, { "kind": "unclassified_tcp", "dst_ip": "10.3.11.194", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.3", "dst_port": 49707, "event_id": "evt-c0349ed7a4c3c5999cb7e9e6", "src_port": 445, "tcp_stream": 106, "udp_stream": null, "frame_number": 10322, "timestamp_epoch": "1583961933.749465000" }, { "kind": "unclassified_tcp", "dst_ip": "23.209.74.120", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-990c3f096ee4d48d81c71875", "src_port": 49753, "tcp_stream": 210, "udp_stream": null, "frame_number": 10390, "timestamp_epoch": "1583961941.177978000" }, { "kind": "unclassified_tcp", "dst_ip": "10.3.11.3", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.194", "dst_port": 445, "event_id": "evt-6d5af2dc2cbc934886114f7e", "src_port": 49683, "tcp_stream": 65, "udp_stream": null, "frame_number": 10391, "timestamp_epoch": "1583961942.345482000" }, { "kind": "unclassified_tcp", "dst_ip": "10.3.11.3", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 445, "event_id": "evt-2c7fba3df95c0b3221452344", "src_port": 49682, "tcp_stream": 131, "udp_stream": null, "frame_number": 10393, "timestamp_epoch": "1583961944.174686000" }, { "kind": "unclassified_tcp", "dst_ip": "10.3.11.119", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.3", "dst_port": 49682, "event_id": "evt-f6a64dad1c972617a69b90a9", "src_port": 445, "tcp_stream": 131, "udp_stream": null, "frame_number": 10395, "timestamp_epoch": "1583961944.218349000" }, { "kind": "unclassified_tcp", "dst_ip": "13.107.3.128", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-69bc063a7aa73185c7e70573", "src_port": 49742, "tcp_stream": 199, "udp_stream": null, "frame_number": 10397, "timestamp_epoch": "1583961944.753477000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.194.42", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-9a0436a2acf2cffc51f66af3", "src_port": 49748, "tcp_stream": 205, "udp_stream": null, "frame_number": 10399, "timestamp_epoch": "1583961944.863433000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.194.42", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-fafc0dcf79508442032c37d7", "src_port": 49749, "tcp_stream": 206, "udp_stream": null, "frame_number": 10401, "timestamp_epoch": "1583961944.867423000" }, { "kind": "unclassified_tcp", "dst_ip": "72.246.84.150", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-76916e338acf192f416e501a", "src_port": 49759, "tcp_stream": 216, "udp_stream": null, "frame_number": 10403, "timestamp_epoch": "1583961945.036826000" }, { "kind": "unclassified_tcp", "dst_ip": "104.26.9.32", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-9a548931fe6d0a53c75b6955", "src_port": 49756, "tcp_stream": 213, "udp_stream": null, "frame_number": 10405, "timestamp_epoch": "1583961945.269483000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.194.131", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-3a77b9cb7227320006053988", "src_port": 49758, "tcp_stream": 215, "udp_stream": null, "frame_number": 10407, "timestamp_epoch": "1583961946.229046000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.194.131", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-acf11ae4198af0f61d64383b", "src_port": 49765, "tcp_stream": 222, "udp_stream": null, "frame_number": 10409, "timestamp_epoch": "1583961946.308649000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.194.131", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-c01f6499389935cc9807c7a0", "src_port": 49763, "tcp_stream": 220, "udp_stream": null, "frame_number": 10410, "timestamp_epoch": "1583961946.308696000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.194.131", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-ba2ca422f9157d7579d1aea1", "src_port": 49767, "tcp_stream": 224, "udp_stream": null, "frame_number": 10413, "timestamp_epoch": "1583961946.329352000" }, { "kind": "unclassified_tcp", "dst_ip": "23.211.18.27", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-dd5113b3dcaaad2a3af5214d", "src_port": 49750, "tcp_stream": 207, "udp_stream": null, "frame_number": 10415, "timestamp_epoch": "1583961946.606683000" }, { "kind": "unclassified_tcp", "dst_ip": "23.211.18.27", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-59249f7f983c3784852c9463", "src_port": 49774, "tcp_stream": 231, "udp_stream": null, "frame_number": 10417, "timestamp_epoch": "1583961946.708728000" }, { "kind": "unclassified_tcp", "dst_ip": "13.249.26.99", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-325810dcb53f3d26b52bfae2", "src_port": 49768, "tcp_stream": 225, "udp_stream": null, "frame_number": 10418, "timestamp_epoch": "1583961946.708788000" }, { "kind": "unclassified_tcp", "dst_ip": "52.9.108.55", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-690ee0bf91d43d4452b838d8", "src_port": 49760, "tcp_stream": 217, "udp_stream": null, "frame_number": 10421, "timestamp_epoch": "1583961947.211791000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.193.142", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-54e637c9a87c47dfcf5ac7a2", "src_port": 49778, "tcp_stream": 235, "udp_stream": null, "frame_number": 10423, "timestamp_epoch": "1583961947.324213000" }, { "kind": "unclassified_tcp", "dst_ip": "72.21.91.66", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-fdb7178840d58efc82f1c2ad", "src_port": 49780, "tcp_stream": 237, "udp_stream": null, "frame_number": 10425, "timestamp_epoch": "1583961947.342172000" }, { "kind": "unclassified_tcp", "dst_ip": "23.209.74.120", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-8b42ab362b5ce7057a731170", "src_port": 49781, "tcp_stream": 238, "udp_stream": null, "frame_number": 10427, "timestamp_epoch": "1583961947.422275000" }, { "kind": "unclassified_tcp", "dst_ip": "151.101.50.208", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-d12331e85dfe846dc92a14ca", "src_port": 49777, "tcp_stream": 234, "udp_stream": null, "frame_number": 10429, "timestamp_epoch": "1583961947.436320000" }, { "kind": "unclassified_tcp", "dst_ip": "23.209.74.120", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-4b0e4576c8864f541fb71cfb", "src_port": 49754, "tcp_stream": 211, "udp_stream": null, "frame_number": 10431, "timestamp_epoch": "1583961947.605144000" }, { "kind": "unclassified_tcp", "dst_ip": "23.209.74.120", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-162ccfad7111c7794a119b7f", "src_port": 49782, "tcp_stream": 239, "udp_stream": null, "frame_number": 10433, "timestamp_epoch": "1583961947.606205000" }, { "kind": "unclassified_tcp", "dst_ip": "72.21.91.66", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-cbe441e2155615294ea60565", "src_port": 49784, "tcp_stream": 241, "udp_stream": null, "frame_number": 10435, "timestamp_epoch": "1583961947.861860000" }, { "kind": "unclassified_tcp", "dst_ip": "104.244.42.8", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-e15af45f47c341c4e9b74d1c", "src_port": 49786, "tcp_stream": 243, "udp_stream": null, "frame_number": 10437, "timestamp_epoch": "1583961948.375770000" }, { "kind": "unclassified_tcp", "dst_ip": "23.206.208.173", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-61f946569e77dae18e44f6b1", "src_port": 49790, "tcp_stream": 247, "udp_stream": null, "frame_number": 10439, "timestamp_epoch": "1583961949.328707000" }, { "kind": "unclassified_tcp", "dst_ip": "23.206.208.173", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-e5d579c7891552a462a4dcbb", "src_port": 49791, "tcp_stream": 248, "udp_stream": null, "frame_number": 10441, "timestamp_epoch": "1583961949.568536000" }, { "kind": "unclassified_tcp", "dst_ip": "13.107.6.158", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-f6c8f38e51806d49a035b30b", "src_port": 49802, "tcp_stream": 267, "udp_stream": null, "frame_number": 10602, "timestamp_epoch": "1583961957.250971000" }, { "kind": "unclassified_tcp", "dst_ip": "10.3.11.119", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.3", "dst_port": 49733, "event_id": "evt-731bafd990a55d99c93a7671", "src_port": 445, "tcp_stream": 182, "udp_stream": null, "frame_number": 11283, "timestamp_epoch": "1583961965.671720000" }, { "kind": "unclassified_tcp", "dst_ip": "10.3.11.3", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 445, "event_id": "evt-31afe79bf3f79f59659d2caa", "src_port": 49682, "tcp_stream": 131, "udp_stream": null, "frame_number": 11896, "timestamp_epoch": "1583961974.176444000" }, { "kind": "unclassified_tcp", "dst_ip": "23.209.74.120", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-bb0b16080d7b2fb15e6bb562", "src_port": 49753, "tcp_stream": 210, "udp_stream": null, "frame_number": 12257, "timestamp_epoch": "1583961986.179385000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.194.42", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-c879c81e0790a851408c6454", "src_port": 49748, "tcp_stream": 205, "udp_stream": null, "frame_number": 12259, "timestamp_epoch": "1583961989.864779000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.194.42", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-521ecb66ef5128f0534b3146", "src_port": 49749, "tcp_stream": 206, "udp_stream": null, "frame_number": 12261, "timestamp_epoch": "1583961989.868721000" }, { "kind": "unclassified_tcp", "dst_ip": "72.246.84.150", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-a3c7a302ffa08c17112f66c1", "src_port": 49759, "tcp_stream": 216, "udp_stream": null, "frame_number": 12267, "timestamp_epoch": "1583961990.037951000" }, { "kind": "unclassified_tcp", "dst_ip": "104.26.9.32", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-9c6c17680ad976a11c251a7e", "src_port": 49756, "tcp_stream": 213, "udp_stream": null, "frame_number": 12269, "timestamp_epoch": "1583961990.271410000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.194.131", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-1d2456fef6e4d230a3961bb2", "src_port": 49758, "tcp_stream": 215, "udp_stream": null, "frame_number": 12274, "timestamp_epoch": "1583961991.230275000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.194.131", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-048e353ac7333196976dddfb", "src_port": 49765, "tcp_stream": 222, "udp_stream": null, "frame_number": 12276, "timestamp_epoch": "1583961991.311292000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.194.131", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-e2c8b6ba197a21d7bdea69e7", "src_port": 49763, "tcp_stream": 220, "udp_stream": null, "frame_number": 12277, "timestamp_epoch": "1583961991.311378000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.194.131", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-f8e864a166948c9aafe318c5", "src_port": 49767, "tcp_stream": 224, "udp_stream": null, "frame_number": 12280, "timestamp_epoch": "1583961991.331338000" }, { "kind": "unclassified_tcp", "dst_ip": "23.211.18.27", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-3a0afda062b83a4776ab8c09", "src_port": 49750, "tcp_stream": 207, "udp_stream": null, "frame_number": 12282, "timestamp_epoch": "1583961991.609390000" }, { "kind": "unclassified_tcp", "dst_ip": "23.211.18.27", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-f1d28440673bba752eace171", "src_port": 49774, "tcp_stream": 231, "udp_stream": null, "frame_number": 12284, "timestamp_epoch": "1583961991.711081000" }, { "kind": "unclassified_tcp", "dst_ip": "13.249.26.99", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-04b0d8d32a17028eaf9d8c64", "src_port": 49768, "tcp_stream": 225, "udp_stream": null, "frame_number": 12285, "timestamp_epoch": "1583961991.711127000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.193.142", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-1a25f8f5ee5bbd6e4f1a34e8", "src_port": 49778, "tcp_stream": 235, "udp_stream": null, "frame_number": 12288, "timestamp_epoch": "1583961992.325652000" }, { "kind": "unclassified_tcp", "dst_ip": "72.21.91.66", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-fb210e31d6a641f39a7223dc", "src_port": 49780, "tcp_stream": 237, "udp_stream": null, "frame_number": 12290, "timestamp_epoch": "1583961992.343628000" }, { "kind": "unclassified_tcp", "dst_ip": "23.209.74.120", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-f1c1b2bebdbdc3b985c97676", "src_port": 49781, "tcp_stream": 238, "udp_stream": null, "frame_number": 12292, "timestamp_epoch": "1583961992.423732000" }, { "kind": "unclassified_tcp", "dst_ip": "151.101.50.208", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-073e122e950669d8e4fb003e", "src_port": 49777, "tcp_stream": 234, "udp_stream": null, "frame_number": 12294, "timestamp_epoch": "1583961992.437703000" }, { "kind": "unclassified_tcp", "dst_ip": "23.209.74.120", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-8af1f6f490d47277da194836", "src_port": 49782, "tcp_stream": 239, "udp_stream": null, "frame_number": 12296, "timestamp_epoch": "1583961992.608977000" }, { "kind": "unclassified_tcp", "dst_ip": "23.209.74.120", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-7166ed2e034edc4e45e0e1b8", "src_port": 49754, "tcp_stream": 211, "udp_stream": null, "frame_number": 12298, "timestamp_epoch": "1583961992.609070000" }, { "kind": "unclassified_tcp", "dst_ip": "72.21.91.66", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-43e195aa32d157820d005aa9", "src_port": 49784, "tcp_stream": 241, "udp_stream": null, "frame_number": 12302, "timestamp_epoch": "1583961992.863537000" }, { "kind": "unclassified_tcp", "dst_ip": "104.244.42.8", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-38c8c2a35a94e8e767be4f10", "src_port": 49786, "tcp_stream": 243, "udp_stream": null, "frame_number": 12304, "timestamp_epoch": "1583961993.393224000" }, { "kind": "unclassified_tcp", "dst_ip": "23.206.208.173", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-b3665f57021155dfee54f456", "src_port": 49790, "tcp_stream": 247, "udp_stream": null, "frame_number": 12338, "timestamp_epoch": "1583961994.330017000" }, { "kind": "unclassified_tcp", "dst_ip": "23.206.208.173", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-3a85f112b6926532711a2522", "src_port": 49791, "tcp_stream": 248, "udp_stream": null, "frame_number": 12355, "timestamp_epoch": "1583961994.570040000" }, { "kind": "unclassified_tcp", "dst_ip": "13.107.6.158", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-b050c71afd82613b3728f365", "src_port": 49802, "tcp_stream": 267, "udp_stream": null, "frame_number": 12449, "timestamp_epoch": "1583962002.252874000" }, { "kind": "unclassified_tcp", "dst_ip": "52.9.108.55", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-ab81861f2f4c4bf4009341eb", "src_port": 49760, "tcp_stream": 217, "udp_stream": null, "frame_number": 13224, "timestamp_epoch": "1583962024.025038000" }, { "kind": "unclassified_tcp", "dst_ip": "23.209.74.120", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-3eca877b4246d38efc8780f5", "src_port": 49753, "tcp_stream": 210, "udp_stream": null, "frame_number": 13826, "timestamp_epoch": "1583962031.195226000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.194.42", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-72c88cb0c61abdf69709f0d0", "src_port": 49748, "tcp_stream": 205, "udp_stream": null, "frame_number": 14012, "timestamp_epoch": "1583962034.866547000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.194.42", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-22cb12b9ce86e75ef293fdd5", "src_port": 49749, "tcp_stream": 206, "udp_stream": null, "frame_number": 14014, "timestamp_epoch": "1583962034.870478000" }, { "kind": "unclassified_tcp", "dst_ip": "72.246.84.150", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-8924fda733f23dde7ac3d870", "src_port": 49759, "tcp_stream": 216, "udp_stream": null, "frame_number": 14016, "timestamp_epoch": "1583962035.038821000" }, { "kind": "unclassified_tcp", "dst_ip": "104.26.9.32", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-c01c404d5bdef4a3118eb7f9", "src_port": 49756, "tcp_stream": 213, "udp_stream": null, "frame_number": 14018, "timestamp_epoch": "1583962035.273146000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.194.131", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-db510f60fcc15f0b3a568557", "src_port": 49758, "tcp_stream": 215, "udp_stream": null, "frame_number": 14020, "timestamp_epoch": "1583962036.232187000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.194.131", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-9e1312decc5dc30f428c71d4", "src_port": 49765, "tcp_stream": 222, "udp_stream": null, "frame_number": 14022, "timestamp_epoch": "1583962036.312979000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.194.131", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-2dda71ab98da6aea06a9a239", "src_port": 49763, "tcp_stream": 220, "udp_stream": null, "frame_number": 14023, "timestamp_epoch": "1583962036.313037000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.194.131", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-3ee986617d226b17b4fe3585", "src_port": 49767, "tcp_stream": 224, "udp_stream": null, "frame_number": 14026, "timestamp_epoch": "1583962036.334031000" }, { "kind": "unclassified_tcp", "dst_ip": "23.211.18.27", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-95a69bbe32a04089d0683fd9", "src_port": 49750, "tcp_stream": 207, "udp_stream": null, "frame_number": 14028, "timestamp_epoch": "1583962036.611807000" }, { "kind": "unclassified_tcp", "dst_ip": "23.211.18.27", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-b2171be39ac608f99eddccab", "src_port": 49774, "tcp_stream": 231, "udp_stream": null, "frame_number": 14030, "timestamp_epoch": "1583962036.712588000" }, { "kind": "unclassified_tcp", "dst_ip": "13.249.26.99", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-d719d64b98dafb8ec97feb2f", "src_port": 49768, "tcp_stream": 225, "udp_stream": null, "frame_number": 14032, "timestamp_epoch": "1583962036.712722000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.193.142", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-62ab28f55f01bbfb6dab620a", "src_port": 49778, "tcp_stream": 235, "udp_stream": null, "frame_number": 14034, "timestamp_epoch": "1583962037.327500000" }, { "kind": "unclassified_tcp", "dst_ip": "23.209.74.120", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-51de589b525c7aed1bdfae2d", "src_port": 49781, "tcp_stream": 238, "udp_stream": null, "frame_number": 14036, "timestamp_epoch": "1583962037.424540000" }, { "kind": "unclassified_tcp", "dst_ip": "151.101.50.208", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-965173e0da85c90db8cdd252", "src_port": 49777, "tcp_stream": 234, "udp_stream": null, "frame_number": 14038, "timestamp_epoch": "1583962037.439529000" }, { "kind": "unclassified_tcp", "dst_ip": "23.209.74.120", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-ce69bf4beccbda865f13bc67", "src_port": 49782, "tcp_stream": 239, "udp_stream": null, "frame_number": 14042, "timestamp_epoch": "1583962037.609528000" }, { "kind": "unclassified_tcp", "dst_ip": "23.209.74.120", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-b4266921ce4ff71b31e494bb", "src_port": 49754, "tcp_stream": 211, "udp_stream": null, "frame_number": 14043, "timestamp_epoch": "1583962037.609574000" }, { "kind": "unclassified_tcp", "dst_ip": "72.21.91.66", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-576d80707f4bddb58cd13c1e", "src_port": 49780, "tcp_stream": 237, "udp_stream": null, "frame_number": 14046, "timestamp_epoch": "1583962037.696102000" }, { "kind": "unclassified_tcp", "dst_ip": "104.244.42.8", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-3a85ae84f349526698a40a90", "src_port": 49786, "tcp_stream": 243, "udp_stream": null, "frame_number": 14047, "timestamp_epoch": "1583962038.396110000" }, { "kind": "unclassified_tcp", "dst_ip": "10.3.11.218", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.3", "dst_port": 49730, "event_id": "evt-152980506ad0ba29c7b44f8e", "src_port": 445, "tcp_stream": 83, "udp_stream": null, "frame_number": 14049, "timestamp_epoch": "1583962038.829702000" }, { "kind": "unclassified_tcp", "dst_ip": "23.206.208.173", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-71e857ec445004079fea9511", "src_port": 49790, "tcp_stream": 247, "udp_stream": null, "frame_number": 14069, "timestamp_epoch": "1583962039.331432000" }, { "kind": "unclassified_tcp", "dst_ip": "23.206.208.173", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-a8d84a4484b3f8f64f046dcf", "src_port": 49791, "tcp_stream": 248, "udp_stream": null, "frame_number": 14071, "timestamp_epoch": "1583962039.571194000" }, { "kind": "unclassified_tcp", "dst_ip": "10.3.11.194", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.3", "dst_port": 49707, "event_id": "evt-0e1dbd3be69161787f1536c2", "src_port": 445, "tcp_stream": 106, "udp_stream": null, "frame_number": 14077, "timestamp_epoch": "1583962053.767565000" }, { "kind": "unclassified_tcp", "dst_ip": "52.9.108.55", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-e7ca434887349d5af6d45cca", "src_port": 49760, "tcp_stream": 217, "udp_stream": null, "frame_number": 14212, "timestamp_epoch": "1583962069.025964000" }, { "kind": "unclassified_tcp", "dst_ip": "23.209.74.120", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-e50aaf16704d4b3ef60d3eaf", "src_port": 49753, "tcp_stream": 210, "udp_stream": null, "frame_number": 14214, "timestamp_epoch": "1583962076.197385000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.194.42", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-23691ed0a93d8d0cf3c4b966", "src_port": 49748, "tcp_stream": 205, "udp_stream": null, "frame_number": 14216, "timestamp_epoch": "1583962079.868193000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.194.42", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-31cd692b1a4cf67aba0356ff", "src_port": 49749, "tcp_stream": 206, "udp_stream": null, "frame_number": 14218, "timestamp_epoch": "1583962079.872267000" }, { "kind": "unclassified_tcp", "dst_ip": "72.246.84.150", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-ae289946b204cbbb1929883e", "src_port": 49759, "tcp_stream": 216, "udp_stream": null, "frame_number": 14220, "timestamp_epoch": "1583962080.040890000" }, { "kind": "unclassified_tcp", "dst_ip": "104.26.9.32", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-ec14738ce34786ba0128ab38", "src_port": 49756, "tcp_stream": 213, "udp_stream": null, "frame_number": 14222, "timestamp_epoch": "1583962080.274591000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.194.131", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-05f56e263c98ae9e096c123e", "src_port": 49758, "tcp_stream": 215, "udp_stream": null, "frame_number": 14224, "timestamp_epoch": "1583962081.234108000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.194.131", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-06d9da57a6c2b36e5820db80", "src_port": 49765, "tcp_stream": 222, "udp_stream": null, "frame_number": 14226, "timestamp_epoch": "1583962081.315023000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.194.131", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-d51eb64c0d1262a26cd6d15d", "src_port": 49763, "tcp_stream": 220, "udp_stream": null, "frame_number": 14227, "timestamp_epoch": "1583962081.315084000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.194.131", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-6588cd6c5475fed66f728576", "src_port": 49767, "tcp_stream": 224, "udp_stream": null, "frame_number": 14230, "timestamp_epoch": "1583962081.335095000" }, { "kind": "unclassified_tcp", "dst_ip": "23.211.18.27", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-19a789f97b99e9869eec756c", "src_port": 49750, "tcp_stream": 207, "udp_stream": null, "frame_number": 14232, "timestamp_epoch": "1583962081.613898000" }, { "kind": "unclassified_tcp", "dst_ip": "23.211.18.27", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-30daedc31dd905b4f3893135", "src_port": 49774, "tcp_stream": 231, "udp_stream": null, "frame_number": 14234, "timestamp_epoch": "1583962081.714594000" }, { "kind": "unclassified_tcp", "dst_ip": "13.249.26.99", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-04ef0a80a5bbd4a5062887b6", "src_port": 49768, "tcp_stream": 225, "udp_stream": null, "frame_number": 14235, "timestamp_epoch": "1583962081.714666000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.193.142", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-15cc7e15d386f64c0dd480f2", "src_port": 49778, "tcp_stream": 235, "udp_stream": null, "frame_number": 14238, "timestamp_epoch": "1583962082.328905000" }, { "kind": "unclassified_tcp", "dst_ip": "23.209.74.120", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-586105c43384c555cdfd3719", "src_port": 49781, "tcp_stream": 238, "udp_stream": null, "frame_number": 14240, "timestamp_epoch": "1583962082.426072000" }, { "kind": "unclassified_tcp", "dst_ip": "151.101.50.208", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-e82514c5a30cdf239fc160e0", "src_port": 49777, "tcp_stream": 234, "udp_stream": null, "frame_number": 14242, "timestamp_epoch": "1583962082.441148000" }, { "kind": "unclassified_tcp", "dst_ip": "72.21.91.66", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-4ce91b8df096957f38e6eb38", "src_port": 49784, "tcp_stream": 241, "udp_stream": null, "frame_number": 14244, "timestamp_epoch": "1583962082.510758000" }, { "kind": "unclassified_tcp", "dst_ip": "23.209.74.120", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-2cec9747a0ff565db50fc889", "src_port": 49782, "tcp_stream": 239, "udp_stream": null, "frame_number": 14245, "timestamp_epoch": "1583962082.611088000" }, { "kind": "unclassified_tcp", "dst_ip": "23.209.74.120", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-ffdd8433c6938de1355fa966", "src_port": 49754, "tcp_stream": 211, "udp_stream": null, "frame_number": 14247, "timestamp_epoch": "1583962082.612189000" }, { "kind": "unclassified_tcp", "dst_ip": "72.21.91.66", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-2bd79f39c3b9c5ad29ba1ff4", "src_port": 49780, "tcp_stream": 237, "udp_stream": null, "frame_number": 14249, "timestamp_epoch": "1583962082.697918000" }, { "kind": "unclassified_tcp", "dst_ip": "104.244.42.8", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-9bfd7a9ac06de4b6034e49f7", "src_port": 49786, "tcp_stream": 243, "udp_stream": null, "frame_number": 14251, "timestamp_epoch": "1583962083.398459000" }, { "kind": "unclassified_tcp", "dst_ip": "23.206.208.173", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-b6286088811330e7ce71e443", "src_port": 49790, "tcp_stream": 247, "udp_stream": null, "frame_number": 14253, "timestamp_epoch": "1583962084.333170000" }, { "kind": "unclassified_tcp", "dst_ip": "23.206.208.173", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-22e8bde504e88fdc3bf31b03", "src_port": 49791, "tcp_stream": 248, "udp_stream": null, "frame_number": 14255, "timestamp_epoch": "1583962084.572982000" }, { "kind": "unclassified_tcp", "dst_ip": "10.3.11.119", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.3", "dst_port": 49733, "event_id": "evt-1822bce57bf6cb9e43807740", "src_port": 445, "tcp_stream": 182, "udp_stream": null, "frame_number": 14257, "timestamp_epoch": "1583962085.689649000" }, { "kind": "unclassified_tcp", "dst_ip": "52.9.108.55", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-25e6f26466d2724c034ccb9f", "src_port": 49760, "tcp_stream": 217, "udp_stream": null, "frame_number": 14417, "timestamp_epoch": "1583962114.027713000" }, { "kind": "unclassified_tcp", "dst_ip": "23.209.74.120", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-959d6d0c205352fbeb9e5df8", "src_port": 49753, "tcp_stream": 210, "udp_stream": null, "frame_number": 14442, "timestamp_epoch": "1583962121.199408000" }, { "kind": "unclassified_tcp", "dst_ip": "72.246.84.150", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-6d57c0ddddda45d176473c9a", "src_port": 49759, "tcp_stream": 216, "udp_stream": null, "frame_number": 14444, "timestamp_epoch": "1583962125.042995000" }, { "kind": "unclassified_tcp", "dst_ip": "104.26.9.32", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-733bd268ac7633995c5ac58c", "src_port": 49756, "tcp_stream": 213, "udp_stream": null, "frame_number": 14446, "timestamp_epoch": "1583962125.276808000" }, { "kind": "unclassified_tcp", "dst_ip": "23.211.18.27", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-3505d7173c4873134e13eac9", "src_port": 49750, "tcp_stream": 207, "udp_stream": null, "frame_number": 14448, "timestamp_epoch": "1583962126.615250000" }, { "kind": "unclassified_tcp", "dst_ip": "23.211.18.27", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-8166d184cb19eda40fd4f31a", "src_port": 49774, "tcp_stream": 231, "udp_stream": null, "frame_number": 14450, "timestamp_epoch": "1583962126.716894000" }, { "kind": "unclassified_tcp", "dst_ip": "23.209.74.120", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-d53abbab4e3d09c94aa06ef2", "src_port": 49781, "tcp_stream": 238, "udp_stream": null, "frame_number": 14452, "timestamp_epoch": "1583962127.427588000" }, { "kind": "unclassified_tcp", "dst_ip": "151.101.50.208", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-a3f666c99e02304504a2cba5", "src_port": 49777, "tcp_stream": 234, "udp_stream": null, "frame_number": 14454, "timestamp_epoch": "1583962127.442587000" }, { "kind": "unclassified_tcp", "dst_ip": "72.21.91.66", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-f27ccc1ce770e675d9046fc5", "src_port": 49784, "tcp_stream": 241, "udp_stream": null, "frame_number": 14456, "timestamp_epoch": "1583962127.512765000" }, { "kind": "unclassified_tcp", "dst_ip": "23.209.74.120", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-2bb24b98db61e07718137742", "src_port": 49782, "tcp_stream": 239, "udp_stream": null, "frame_number": 14458, "timestamp_epoch": "1583962127.612772000" }, { "kind": "unclassified_tcp", "dst_ip": "23.209.74.120", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-15a271a41c4da3fa55121881", "src_port": 49754, "tcp_stream": 211, "udp_stream": null, "frame_number": 14459, "timestamp_epoch": "1583962127.612829000" }, { "kind": "unclassified_tcp", "dst_ip": "72.21.91.66", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-6bd17c88f14ba78166ee94a6", "src_port": 49780, "tcp_stream": 237, "udp_stream": null, "frame_number": 14462, "timestamp_epoch": "1583962127.698956000" }, { "kind": "unclassified_tcp", "dst_ip": "104.244.42.8", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-043d0885b34f13965e5c4fc8", "src_port": 49786, "tcp_stream": 243, "udp_stream": null, "frame_number": 14464, "timestamp_epoch": "1583962128.412969000" }, { "kind": "unclassified_tcp", "dst_ip": "23.206.208.173", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-c21318117c2dabf0efa240a1", "src_port": 49790, "tcp_stream": 247, "udp_stream": null, "frame_number": 14466, "timestamp_epoch": "1583962129.334603000" }, { "kind": "unclassified_tcp", "dst_ip": "23.206.208.173", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-76b8fd5b26b4006efba10fa7", "src_port": 49791, "tcp_stream": 248, "udp_stream": null, "frame_number": 14468, "timestamp_epoch": "1583962129.574670000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.194.42", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-10cb5c1ae94a32e0c2f99b6f", "src_port": 49749, "tcp_stream": 206, "udp_stream": null, "frame_number": 14470, "timestamp_epoch": "1583962139.869716000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.194.42", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-4d282a9b6645b24a32eb467c", "src_port": 49748, "tcp_stream": 205, "udp_stream": null, "frame_number": 14471, "timestamp_epoch": "1583962139.871737000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.194.131", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-51d2d05e61485b5cd38af6c2", "src_port": 49758, "tcp_stream": 215, "udp_stream": null, "frame_number": 14473, "timestamp_epoch": "1583962141.200562000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.194.131", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-038f1bd244d43194d87c6d20", "src_port": 49765, "tcp_stream": 222, "udp_stream": null, "frame_number": 14474, "timestamp_epoch": "1583962141.228534000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.194.131", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-5c67f0374cfb77803c8d0e21", "src_port": 49763, "tcp_stream": 220, "udp_stream": null, "frame_number": 14475, "timestamp_epoch": "1583962141.228610000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.194.131", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-57dc1cf1b90a5ef1ab5ddfe9", "src_port": 49767, "tcp_stream": 224, "udp_stream": null, "frame_number": 14476, "timestamp_epoch": "1583962141.243532000" }, { "kind": "unclassified_tcp", "dst_ip": "10.3.11.218", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.3", "dst_port": 49730, "event_id": "evt-57448db80802b324000ef738", "src_port": 445, "tcp_stream": 83, "udp_stream": null, "frame_number": 14533, "timestamp_epoch": "1583962158.832316000" }, { "kind": "unclassified_tcp", "dst_ip": "52.9.108.55", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-38b7107cc80dce0d44f86058", "src_port": 49760, "tcp_stream": 217, "udp_stream": null, "frame_number": 14535, "timestamp_epoch": "1583962159.029147000" }, { "kind": "unclassified_tcp", "dst_ip": "23.209.74.120", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-cbfa23de2e2f20a0643358cd", "src_port": 49753, "tcp_stream": 210, "udp_stream": null, "frame_number": 14547, "timestamp_epoch": "1583962166.201136000" }, { "kind": "unclassified_tcp", "dst_ip": "72.246.84.150", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-bf7bf74ff15e66785f8dff84", "src_port": 49759, "tcp_stream": 216, "udp_stream": null, "frame_number": 14549, "timestamp_epoch": "1583962170.044869000" }, { "kind": "unclassified_tcp", "dst_ip": "104.26.9.32", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-cba05ce291a72796c1e5cc05", "src_port": 49756, "tcp_stream": 213, "udp_stream": null, "frame_number": 14551, "timestamp_epoch": "1583962170.277906000" }, { "kind": "unclassified_tcp", "dst_ip": "23.211.18.27", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-64ebd0493d194281b71c3b95", "src_port": 49750, "tcp_stream": 207, "udp_stream": null, "frame_number": 14553, "timestamp_epoch": "1583962171.616432000" }, { "kind": "unclassified_tcp", "dst_ip": "23.211.18.27", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-dee68217f4307e1150302b90", "src_port": 49774, "tcp_stream": 231, "udp_stream": null, "frame_number": 14555, "timestamp_epoch": "1583962171.718446000" }, { "kind": "unclassified_tcp", "dst_ip": "23.209.74.120", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-f846fea3c15a2a47da2e2d02", "src_port": 49781, "tcp_stream": 238, "udp_stream": null, "frame_number": 14557, "timestamp_epoch": "1583962172.428740000" }, { "kind": "unclassified_tcp", "dst_ip": "151.101.50.208", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-5760d5a9c5670b41527fa1f6", "src_port": 49777, "tcp_stream": 234, "udp_stream": null, "frame_number": 14559, "timestamp_epoch": "1583962172.443710000" }, { "kind": "unclassified_tcp", "dst_ip": "72.21.91.66", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-61133f023909a92bc4f8de08", "src_port": 49784, "tcp_stream": 241, "udp_stream": null, "frame_number": 14561, "timestamp_epoch": "1583962172.513594000" }, { "kind": "unclassified_tcp", "dst_ip": "23.209.74.120", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-ae6585451462f58c55d38268", "src_port": 49782, "tcp_stream": 239, "udp_stream": null, "frame_number": 14563, "timestamp_epoch": "1583962172.613876000" }, { "kind": "unclassified_tcp", "dst_ip": "23.209.74.120", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-bc22b2a5580d744c35779e76", "src_port": 49754, "tcp_stream": 211, "udp_stream": null, "frame_number": 14564, "timestamp_epoch": "1583962172.613921000" }, { "kind": "unclassified_tcp", "dst_ip": "72.21.91.66", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-ddc2ac04f77d1c9e8698f139", "src_port": 49780, "tcp_stream": 237, "udp_stream": null, "frame_number": 14567, "timestamp_epoch": "1583962172.714415000" }, { "kind": "unclassified_tcp", "dst_ip": "104.244.42.8", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-a95fc60092ef1ae6c44d8c5f", "src_port": 49786, "tcp_stream": 243, "udp_stream": null, "frame_number": 14569, "timestamp_epoch": "1583962173.414587000" }, { "kind": "unclassified_tcp", "dst_ip": "23.206.208.173", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-ffd2fbd377bab269169a6416", "src_port": 49790, "tcp_stream": 247, "udp_stream": null, "frame_number": 14571, "timestamp_epoch": "1583962174.336227000" }, { "kind": "unclassified_tcp", "dst_ip": "23.206.208.173", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-cce1d60b695c27012ba16d6f", "src_port": 49791, "tcp_stream": 248, "udp_stream": null, "frame_number": 14573, "timestamp_epoch": "1583962174.576434000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.194.42", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-fd86c5aaf87940119eb7d76c", "src_port": 49749, "tcp_stream": 206, "udp_stream": null, "frame_number": 14575, "timestamp_epoch": "1583962184.872282000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.194.42", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-f6282c3236f4f58b2a25d7b5", "src_port": 49748, "tcp_stream": 205, "udp_stream": null, "frame_number": 14577, "timestamp_epoch": "1583962184.874187000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.194.131", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-02841b9d91bb5796c795b8a5", "src_port": 49758, "tcp_stream": 215, "udp_stream": null, "frame_number": 14579, "timestamp_epoch": "1583962186.201481000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.194.131", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-04e83f85a30bfecf6d37decb", "src_port": 49765, "tcp_stream": 222, "udp_stream": null, "frame_number": 14581, "timestamp_epoch": "1583962186.229529000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.194.131", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-ff66372d7c1823adaf40adf4", "src_port": 49763, "tcp_stream": 220, "udp_stream": null, "frame_number": 14582, "timestamp_epoch": "1583962186.229636000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.194.131", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-84516b386846ef7875cd29b6", "src_port": 49767, "tcp_stream": 224, "udp_stream": null, "frame_number": 14585, "timestamp_epoch": "1583962186.244534000" }, { "kind": "unclassified_tcp", "dst_ip": "10.3.11.3", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.194", "dst_port": 445, "event_id": "evt-b483ac6d4fee277b57c54e97", "src_port": 49707, "tcp_stream": 106, "udp_stream": null, "frame_number": 14587, "timestamp_epoch": "1583962191.273346000" }, { "kind": "unclassified_tcp", "dst_ip": "52.9.108.55", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-43da009ece6cd038583a6495", "src_port": 49760, "tcp_stream": 217, "udp_stream": null, "frame_number": 14597, "timestamp_epoch": "1583962204.030660000" }, { "kind": "unclassified_tcp", "dst_ip": "10.3.11.119", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.3", "dst_port": 49733, "event_id": "evt-7b075a1eabbea2014b56ed3d", "src_port": 445, "tcp_stream": 182, "udp_stream": null, "frame_number": 14600, "timestamp_epoch": "1583962205.693164000" }, { "kind": "unclassified_tcp", "dst_ip": "23.209.74.120", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-efef2d3da587eb6d93ad5ceb", "src_port": 49753, "tcp_stream": 210, "udp_stream": null, "frame_number": 14604, "timestamp_epoch": "1583962211.202488000" }, { "kind": "unclassified_tcp", "dst_ip": "72.246.84.150", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-c3fe6cd89e031c2e975af5d3", "src_port": 49759, "tcp_stream": 216, "udp_stream": null, "frame_number": 14610, "timestamp_epoch": "1583962215.045596000" }, { "kind": "unclassified_tcp", "dst_ip": "104.26.9.32", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-0854644e078f285a76b4116a", "src_port": 49756, "tcp_stream": 213, "udp_stream": null, "frame_number": 14612, "timestamp_epoch": "1583962215.279828000" }, { "kind": "unclassified_tcp", "dst_ip": "23.211.18.27", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-c4bce8f7e06702694beb14b7", "src_port": 49750, "tcp_stream": 207, "udp_stream": null, "frame_number": 14616, "timestamp_epoch": "1583962216.618490000" }, { "kind": "unclassified_tcp", "dst_ip": "23.211.18.27", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-269e68a4842914638de8f63b", "src_port": 49774, "tcp_stream": 231, "udp_stream": null, "frame_number": 14618, "timestamp_epoch": "1583962216.720421000" }, { "kind": "unclassified_tcp", "dst_ip": "23.209.74.120", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-9d14eb48ae499b84211ea626", "src_port": 49781, "tcp_stream": 238, "udp_stream": null, "frame_number": 14621, "timestamp_epoch": "1583962217.430065000" }, { "kind": "unclassified_tcp", "dst_ip": "151.101.50.208", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-f275f0036ddce9974fcd4e3c", "src_port": 49777, "tcp_stream": 234, "udp_stream": null, "frame_number": 14623, "timestamp_epoch": "1583962217.446039000" }, { "kind": "unclassified_tcp", "dst_ip": "72.21.91.66", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-8a636e674d09a2ab7db5cbb7", "src_port": 49784, "tcp_stream": 241, "udp_stream": null, "frame_number": 14625, "timestamp_epoch": "1583962217.514757000" }, { "kind": "unclassified_tcp", "dst_ip": "23.209.74.120", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-3992ca413574445f245c839b", "src_port": 49782, "tcp_stream": 239, "udp_stream": null, "frame_number": 14627, "timestamp_epoch": "1583962217.616385000" }, { "kind": "unclassified_tcp", "dst_ip": "23.209.74.120", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-d98ecaa79380cfbbb8ccdd59", "src_port": 49754, "tcp_stream": 211, "udp_stream": null, "frame_number": 14628, "timestamp_epoch": "1583962217.616427000" }, { "kind": "unclassified_tcp", "dst_ip": "72.21.91.66", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-a7f3425d520556783df33a12", "src_port": 49780, "tcp_stream": 237, "udp_stream": null, "frame_number": 14631, "timestamp_epoch": "1583962217.716478000" }, { "kind": "unclassified_tcp", "dst_ip": "104.244.42.8", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-97651a48258cad3d3ec843bf", "src_port": 49786, "tcp_stream": 243, "udp_stream": null, "frame_number": 14647, "timestamp_epoch": "1583962218.415535000" }, { "kind": "unclassified_tcp", "dst_ip": "23.206.208.173", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-a898e79312b9eea33d463c33", "src_port": 49790, "tcp_stream": 247, "udp_stream": null, "frame_number": 14651, "timestamp_epoch": "1583962219.337689000" }, { "kind": "unclassified_tcp", "dst_ip": "23.206.208.173", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-6081d4ca96730264b04be7d2", "src_port": 49791, "tcp_stream": 248, "udp_stream": null, "frame_number": 14654, "timestamp_epoch": "1583962219.577490000" }, { "kind": "unclassified_tcp", "dst_ip": "10.3.11.3", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.194", "dst_port": 445, "event_id": "evt-5b2eaf7a9e8c84b1311af199", "src_port": 49707, "tcp_stream": 106, "udp_stream": null, "frame_number": 14656, "timestamp_epoch": "1583962221.289643000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.194.42", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-5860ad7d4c720bf555ca6a86", "src_port": 49749, "tcp_stream": 206, "udp_stream": null, "frame_number": 14662, "timestamp_epoch": "1583962229.873560000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.194.42", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-a805ef69bc96e94022f9ef71", "src_port": 49748, "tcp_stream": 205, "udp_stream": null, "frame_number": 14664, "timestamp_epoch": "1583962229.875484000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.194.131", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-0c463cdc185548dd67c65e96", "src_port": 49758, "tcp_stream": 215, "udp_stream": null, "frame_number": 14666, "timestamp_epoch": "1583962231.203092000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.194.131", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-3a2766ee2827563d0d101de6", "src_port": 49765, "tcp_stream": 222, "udp_stream": null, "frame_number": 14668, "timestamp_epoch": "1583962231.231083000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.194.131", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-751e7999cfd54d83dee8d049", "src_port": 49763, "tcp_stream": 220, "udp_stream": null, "frame_number": 14669, "timestamp_epoch": "1583962231.231137000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.194.131", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-ebf6f00b0a865c4f6068f416", "src_port": 49767, "tcp_stream": 224, "udp_stream": null, "frame_number": 14672, "timestamp_epoch": "1583962231.246084000" }, { "kind": "unclassified_tcp", "dst_ip": "23.209.74.120", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-ddd93e60f3572c4ed7537cd7", "src_port": 49753, "tcp_stream": 210, "udp_stream": null, "frame_number": 14688, "timestamp_epoch": "1583962256.203902000" }, { "kind": "unclassified_tcp", "dst_ip": "72.246.84.150", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-aea82b424c8cabafc9a04a3d", "src_port": 49759, "tcp_stream": 216, "udp_stream": null, "frame_number": 14690, "timestamp_epoch": "1583962260.047022000" }, { "kind": "unclassified_tcp", "dst_ip": "23.211.18.27", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-00b9fe2b181e90d662bbaebc", "src_port": 49750, "tcp_stream": 207, "udp_stream": null, "frame_number": 14694, "timestamp_epoch": "1583962261.619825000" }, { "kind": "unclassified_tcp", "dst_ip": "23.211.18.27", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-00783a8012e3aa1f9e31ff47", "src_port": 49774, "tcp_stream": 231, "udp_stream": null, "frame_number": 14696, "timestamp_epoch": "1583962261.722990000" }, { "kind": "unclassified_tcp", "dst_ip": "23.209.74.120", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-d990ea03c9c3b7d40bae3449", "src_port": 49781, "tcp_stream": 238, "udp_stream": null, "frame_number": 14698, "timestamp_epoch": "1583962262.431000000" }, { "kind": "unclassified_tcp", "dst_ip": "151.101.50.208", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-89f58144d7f234a495fb8ed9", "src_port": 49777, "tcp_stream": 234, "udp_stream": null, "frame_number": 14700, "timestamp_epoch": "1583962262.447963000" }, { "kind": "unclassified_tcp", "dst_ip": "72.21.91.66", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-daf117be8e30dc196a32925c", "src_port": 49784, "tcp_stream": 241, "udp_stream": null, "frame_number": 14702, "timestamp_epoch": "1583962262.516898000" }, { "kind": "unclassified_tcp", "dst_ip": "23.209.74.120", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-8371e06d81e97b1355fda0ea", "src_port": 49782, "tcp_stream": 239, "udp_stream": null, "frame_number": 14704, "timestamp_epoch": "1583962262.617971000" }, { "kind": "unclassified_tcp", "dst_ip": "23.209.74.120", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-0f44fbb53042abdf8b264243", "src_port": 49754, "tcp_stream": 211, "udp_stream": null, "frame_number": 14705, "timestamp_epoch": "1583962262.618037000" }, { "kind": "unclassified_tcp", "dst_ip": "72.21.91.66", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-8fc7bf2c13f10e04f2731af1", "src_port": 49780, "tcp_stream": 237, "udp_stream": null, "frame_number": 14708, "timestamp_epoch": "1583962262.718429000" }, { "kind": "unclassified_tcp", "dst_ip": "52.9.108.55", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-f5a609f38493a966eb167db8", "src_port": 49760, "tcp_stream": 217, "udp_stream": null, "frame_number": 14710, "timestamp_epoch": "1583962262.961346000" }, { "kind": "unclassified_tcp", "dst_ip": "104.244.42.8", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-7f3a793cbeaf16625b94d06d", "src_port": 49786, "tcp_stream": 243, "udp_stream": null, "frame_number": 14711, "timestamp_epoch": "1583962263.417362000" }, { "kind": "unclassified_tcp", "dst_ip": "23.206.208.173", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-64e97c3848df948eaf90d30a", "src_port": 49790, "tcp_stream": 247, "udp_stream": null, "frame_number": 14713, "timestamp_epoch": "1583962264.340122000" }, { "kind": "unclassified_tcp", "dst_ip": "23.206.208.173", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-ba4e95cc30b54a7fd8ecad0c", "src_port": 49791, "tcp_stream": 248, "udp_stream": null, "frame_number": 14715, "timestamp_epoch": "1583962264.579801000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.194.42", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-05396d6b6c83e407afa55684", "src_port": 49749, "tcp_stream": 206, "udp_stream": null, "frame_number": 14720, "timestamp_epoch": "1583962274.874696000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.194.42", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-335c231e8b56d37eda5d6b52", "src_port": 49748, "tcp_stream": 205, "udp_stream": null, "frame_number": 14722, "timestamp_epoch": "1583962274.876629000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.194.131", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-99386b35dcf61902b26778a8", "src_port": 49758, "tcp_stream": 215, "udp_stream": null, "frame_number": 14726, "timestamp_epoch": "1583962276.204603000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.194.131", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-da2eaeee68e5c7f561ad51ba", "src_port": 49765, "tcp_stream": 222, "udp_stream": null, "frame_number": 14728, "timestamp_epoch": "1583962276.233521000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.194.131", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-f1c5ab7409551f3e99d00acd", "src_port": 49763, "tcp_stream": 220, "udp_stream": null, "frame_number": 14729, "timestamp_epoch": "1583962276.233600000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.194.131", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-3b2c51e27f98d4266586d97f", "src_port": 49767, "tcp_stream": 224, "udp_stream": null, "frame_number": 14732, "timestamp_epoch": "1583962276.247582000" }, { "kind": "unclassified_tcp", "dst_ip": "10.3.11.218", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.3", "dst_port": 49730, "event_id": "evt-1b5267cd1b03b1e3d61e7d17", "src_port": 445, "tcp_stream": 83, "udp_stream": null, "frame_number": 14734, "timestamp_epoch": "1583962278.850891000" }, { "kind": "unclassified_tcp", "dst_ip": "10.3.11.194", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.3", "dst_port": 49707, "event_id": "evt-40ef77961078f0678290a68c", "src_port": 445, "tcp_stream": 106, "udp_stream": null, "frame_number": 14736, "timestamp_epoch": "1583962281.319523000" }, { "kind": "unclassified_tcp", "dst_ip": "23.209.74.120", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-8c599928bace71dd97d052bf", "src_port": 49753, "tcp_stream": 210, "udp_stream": null, "frame_number": 14802, "timestamp_epoch": "1583962301.205200000" }, { "kind": "unclassified_tcp", "dst_ip": "72.246.84.150", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-0b550182b56ae832be0ca603", "src_port": 49759, "tcp_stream": 216, "udp_stream": null, "frame_number": 14806, "timestamp_epoch": "1583962305.048676000" }, { "kind": "unclassified_tcp", "dst_ip": "23.211.18.27", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-61b03c92aa35ab74670d825f", "src_port": 49750, "tcp_stream": 207, "udp_stream": null, "frame_number": 14808, "timestamp_epoch": "1583962306.621433000" }, { "kind": "unclassified_tcp", "dst_ip": "23.209.74.120", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-6134a71cf4ac4eec7bf08d74", "src_port": 49781, "tcp_stream": 238, "udp_stream": null, "frame_number": 14810, "timestamp_epoch": "1583962307.431858000" }, { "kind": "unclassified_tcp", "dst_ip": "151.101.50.208", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-da6e48cd8c8ce704cce750ed", "src_port": 49777, "tcp_stream": 234, "udp_stream": null, "frame_number": 14812, "timestamp_epoch": "1583962307.448791000" }, { "kind": "unclassified_tcp", "dst_ip": "72.21.91.66", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-5a58b236333a82f65795f09d", "src_port": 49784, "tcp_stream": 241, "udp_stream": null, "frame_number": 14814, "timestamp_epoch": "1583962307.518551000" }, { "kind": "unclassified_tcp", "dst_ip": "23.209.74.120", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-71ae6302f10f02ab41dafd34", "src_port": 49782, "tcp_stream": 239, "udp_stream": null, "frame_number": 14816, "timestamp_epoch": "1583962307.618682000" }, { "kind": "unclassified_tcp", "dst_ip": "23.209.74.120", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-f6eef14a0f0ae10401cd1b00", "src_port": 49754, "tcp_stream": 211, "udp_stream": null, "frame_number": 14818, "timestamp_epoch": "1583962307.619669000" }, { "kind": "unclassified_tcp", "dst_ip": "72.21.91.66", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-a71e0e03147066bc139aee52", "src_port": 49780, "tcp_stream": 237, "udp_stream": null, "frame_number": 14820, "timestamp_epoch": "1583962307.719735000" }, { "kind": "unclassified_tcp", "dst_ip": "52.9.108.55", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-d15984741ddf55a6d64ada2c", "src_port": 49760, "tcp_stream": 217, "udp_stream": null, "frame_number": 14822, "timestamp_epoch": "1583962307.961854000" }, { "kind": "unclassified_tcp", "dst_ip": "104.244.42.8", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-f7bc34ddf2055af7abd549b1", "src_port": 49786, "tcp_stream": 243, "udp_stream": null, "frame_number": 14824, "timestamp_epoch": "1583962308.419332000" }, { "kind": "unclassified_tcp", "dst_ip": "23.206.208.173", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-903996cb9493ac929a56891d", "src_port": 49790, "tcp_stream": 247, "udp_stream": null, "frame_number": 14826, "timestamp_epoch": "1583962309.342322000" }, { "kind": "unclassified_tcp", "dst_ip": "23.206.208.173", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-01dd8c6d9601bfc5fc708cf2", "src_port": 49791, "tcp_stream": 248, "udp_stream": null, "frame_number": 14828, "timestamp_epoch": "1583962309.581476000" }, { "kind": "unclassified_tcp", "dst_ip": "23.211.18.27", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-b95998bffb312b2a238d87e7", "src_port": 49774, "tcp_stream": 231, "udp_stream": null, "frame_number": 14832, "timestamp_epoch": "1583962313.637439000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.194.42", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-dab40cf25da0e13b9865be6c", "src_port": 49749, "tcp_stream": 206, "udp_stream": null, "frame_number": 14914, "timestamp_epoch": "1583962319.876310000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.194.42", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-1e70bf9829e6e071170f37d5", "src_port": 49748, "tcp_stream": 205, "udp_stream": null, "frame_number": 14916, "timestamp_epoch": "1583962319.879196000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.194.131", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-b3483a6a3b6c568248cdb58b", "src_port": 49758, "tcp_stream": 215, "udp_stream": null, "frame_number": 14998, "timestamp_epoch": "1583962321.216796000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.194.131", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-47fe79c2e8ab1e9d7f6b2283", "src_port": 49765, "tcp_stream": 222, "udp_stream": null, "frame_number": 15000, "timestamp_epoch": "1583962321.235503000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.194.131", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-4473cdb2dc531b154fda9f5a", "src_port": 49763, "tcp_stream": 220, "udp_stream": null, "frame_number": 15001, "timestamp_epoch": "1583962321.235552000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.194.131", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-2574b5d12ac7ae9662eaa1d1", "src_port": 49767, "tcp_stream": 224, "udp_stream": null, "frame_number": 15004, "timestamp_epoch": "1583962321.250481000" }, { "kind": "unclassified_tcp", "dst_ip": "10.3.11.119", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.3", "dst_port": 49733, "event_id": "evt-b32c1b648e8dba40b957c7f5", "src_port": 445, "tcp_stream": 182, "udp_stream": null, "frame_number": 15086, "timestamp_epoch": "1583962325.711687000" }, { "kind": "unclassified_tcp", "dst_ip": "23.209.74.120", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-718f7de4fe0beda94aabcffd", "src_port": 49753, "tcp_stream": 210, "udp_stream": null, "frame_number": 15128, "timestamp_epoch": "1583962346.206677000" }, { "kind": "unclassified_tcp", "dst_ip": "72.246.84.150", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-39d6e3b2bd273e85d443e58d", "src_port": 49759, "tcp_stream": 216, "udp_stream": null, "frame_number": 15130, "timestamp_epoch": "1583962350.050373000" }, { "kind": "unclassified_tcp", "dst_ip": "23.211.18.27", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-bc7e65c41ed1ce6935f2c3ed", "src_port": 49750, "tcp_stream": 207, "udp_stream": null, "frame_number": 15132, "timestamp_epoch": "1583962351.623727000" }, { "kind": "unclassified_tcp", "dst_ip": "23.209.74.120", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-637850cb84bf5629d92b942d", "src_port": 49781, "tcp_stream": 238, "udp_stream": null, "frame_number": 15163, "timestamp_epoch": "1583962352.433877000" }, { "kind": "unclassified_tcp", "dst_ip": "151.101.50.208", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-30d9d7ee5cf6845bd548e340", "src_port": 49777, "tcp_stream": 234, "udp_stream": null, "frame_number": 15165, "timestamp_epoch": "1583962352.450883000" }, { "kind": "unclassified_tcp", "dst_ip": "72.21.91.66", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-eef1c8bfd27b5809af5ea160", "src_port": 49784, "tcp_stream": 241, "udp_stream": null, "frame_number": 15167, "timestamp_epoch": "1583962352.519829000" }, { "kind": "unclassified_tcp", "dst_ip": "23.209.74.120", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-5d062c52223e4b4a9f8baf41", "src_port": 49782, "tcp_stream": 239, "udp_stream": null, "frame_number": 15169, "timestamp_epoch": "1583962352.620895000" }, { "kind": "unclassified_tcp", "dst_ip": "23.209.74.120", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-952229abfdd442cb434b45c5", "src_port": 49754, "tcp_stream": 211, "udp_stream": null, "frame_number": 15170, "timestamp_epoch": "1583962352.620945000" }, { "kind": "unclassified_tcp", "dst_ip": "72.21.91.66", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-f4fd0313edf24993bafc1d90", "src_port": 49780, "tcp_stream": 237, "udp_stream": null, "frame_number": 15173, "timestamp_epoch": "1583962352.721892000" }, { "kind": "unclassified_tcp", "dst_ip": "52.9.108.55", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-f2a2a59906dc9a2a67e14d76", "src_port": 49760, "tcp_stream": 217, "udp_stream": null, "frame_number": 15175, "timestamp_epoch": "1583962352.963896000" }, { "kind": "unclassified_tcp", "dst_ip": "104.244.42.8", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-128bc52e0bdeea4a86ae12ad", "src_port": 49786, "tcp_stream": 243, "udp_stream": null, "frame_number": 15177, "timestamp_epoch": "1583962353.420655000" }, { "kind": "unclassified_tcp", "dst_ip": "23.206.208.173", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-d15f9cd65d25f5892b625864", "src_port": 49790, "tcp_stream": 247, "udp_stream": null, "frame_number": 15179, "timestamp_epoch": "1583962354.343602000" }, { "kind": "unclassified_tcp", "dst_ip": "23.206.208.173", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-f4745c23993e56a633ac1f33", "src_port": 49791, "tcp_stream": 248, "udp_stream": null, "frame_number": 15181, "timestamp_epoch": "1583962354.583679000" }, { "kind": "unclassified_tcp", "dst_ip": "23.211.18.27", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-2adfc4f5192ffea2428092e2", "src_port": 49774, "tcp_stream": 231, "udp_stream": null, "frame_number": 15196, "timestamp_epoch": "1583962358.638670000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.194.42", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-68c7786b65504daa3f7f28c7", "src_port": 49749, "tcp_stream": 206, "udp_stream": null, "frame_number": 15363, "timestamp_epoch": "1583962364.877530000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.194.42", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-327a6996c044a1df4f988739", "src_port": 49748, "tcp_stream": 205, "udp_stream": null, "frame_number": 15365, "timestamp_epoch": "1583962364.880441000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.194.131", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-9b07af6dec3e39eb24300e1e", "src_port": 49758, "tcp_stream": 215, "udp_stream": null, "frame_number": 15367, "timestamp_epoch": "1583962366.219438000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.194.131", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-ac195a470242da82b8457f9f", "src_port": 49765, "tcp_stream": 222, "udp_stream": null, "frame_number": 15369, "timestamp_epoch": "1583962366.237346000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.194.131", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-d349364230e0c226d9bd7f7f", "src_port": 49763, "tcp_stream": 220, "udp_stream": null, "frame_number": 15371, "timestamp_epoch": "1583962366.237418000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.194.131", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-8d1d6dd36d2c24def3ace60b", "src_port": 49767, "tcp_stream": 224, "udp_stream": null, "frame_number": 15373, "timestamp_epoch": "1583962366.252359000" }, { "kind": "unclassified_tcp", "dst_ip": "10.3.11.3", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.218", "dst_port": 445, "event_id": "evt-0b858a78f433bc87b35ba843", "src_port": 49730, "tcp_stream": 83, "udp_stream": null, "frame_number": 15548, "timestamp_epoch": "1583962385.223651000" }, { "kind": "unclassified_tcp", "dst_ip": "23.209.74.120", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-65d0cae6f595f2267470a183", "src_port": 49753, "tcp_stream": 210, "udp_stream": null, "frame_number": 15862, "timestamp_epoch": "1583962391.209092000" }, { "kind": "unclassified_tcp", "dst_ip": "151.101.50.208", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-ab654e0e1c1df1724c8addba", "src_port": 49777, "tcp_stream": 234, "udp_stream": null, "frame_number": 15874, "timestamp_epoch": "1583962397.452214000" }, { "kind": "unclassified_tcp", "dst_ip": "72.21.91.66", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-7276e9ac446561ed028ee7e0", "src_port": 49784, "tcp_stream": 241, "udp_stream": null, "frame_number": 15876, "timestamp_epoch": "1583962397.521144000" }, { "kind": "unclassified_tcp", "dst_ip": "72.21.91.66", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-48ab2939038ae78d1980ffca", "src_port": 49780, "tcp_stream": 237, "udp_stream": null, "frame_number": 15878, "timestamp_epoch": "1583962397.723554000" }, { "kind": "unclassified_tcp", "dst_ip": "52.9.108.55", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-e00142d23d4cb30f9a5e8965", "src_port": 49760, "tcp_stream": 217, "udp_stream": null, "frame_number": 15880, "timestamp_epoch": "1583962397.965228000" }, { "kind": "unclassified_tcp", "dst_ip": "104.244.42.8", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-b816115219d7a2a6487d1d16", "src_port": 49786, "tcp_stream": 243, "udp_stream": null, "frame_number": 15882, "timestamp_epoch": "1583962398.422495000" }, { "kind": "unclassified_tcp", "dst_ip": "72.246.84.150", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-34a537d125bd8738550a05f2", "src_port": 49759, "tcp_stream": 216, "udp_stream": null, "frame_number": 15893, "timestamp_epoch": "1583962400.047106000" }, { "kind": "unclassified_tcp", "dst_ip": "23.211.18.27", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-c6ee178f19903ed0c92892d7", "src_port": 49750, "tcp_stream": 207, "udp_stream": null, "frame_number": 15894, "timestamp_epoch": "1583962401.625056000" }, { "kind": "unclassified_tcp", "dst_ip": "23.209.74.120", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-52afe5c0a0f5bdbe33f48014", "src_port": 49754, "tcp_stream": 211, "udp_stream": null, "frame_number": 15896, "timestamp_epoch": "1583962402.345701000" }, { "kind": "unclassified_tcp", "dst_ip": "23.209.74.120", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-c65d65dbb1809615d516449a", "src_port": 49781, "tcp_stream": 238, "udp_stream": null, "frame_number": 15897, "timestamp_epoch": "1583962402.403105000" }, { "kind": "unclassified_tcp", "dst_ip": "23.209.74.120", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-7a73bc0e9ab1ae7fa0213c06", "src_port": 49782, "tcp_stream": 239, "udp_stream": null, "frame_number": 15898, "timestamp_epoch": "1583962402.475558000" }, { "kind": "unclassified_tcp", "dst_ip": "23.211.18.27", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-62d5ac2f5577593e4b7c37cf", "src_port": 49774, "tcp_stream": 231, "udp_stream": null, "frame_number": 15899, "timestamp_epoch": "1583962403.639964000" }, { "kind": "unclassified_tcp", "dst_ip": "23.206.208.173", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-25c1f7594dd30c11632cb920", "src_port": 49790, "tcp_stream": 247, "udp_stream": null, "frame_number": 15901, "timestamp_epoch": "1583962404.367432000" }, { "kind": "unclassified_tcp", "dst_ip": "23.206.208.173", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-a3f58b054bd852efc3d935a5", "src_port": 49791, "tcp_stream": 248, "udp_stream": null, "frame_number": 15902, "timestamp_epoch": "1583962404.609360000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.194.42", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-55d9d75124b62ab48a0abdf3", "src_port": 49749, "tcp_stream": 206, "udp_stream": null, "frame_number": 15905, "timestamp_epoch": "1583962409.879021000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.194.42", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-1105109aad2793bb710d6b19", "src_port": 49748, "tcp_stream": 205, "udp_stream": null, "frame_number": 15907, "timestamp_epoch": "1583962409.881998000" }, { "kind": "unclassified_tcp", "dst_ip": "10.3.11.3", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.194", "dst_port": 445, "event_id": "evt-5484d7611abd488258223903", "src_port": 49707, "tcp_stream": 106, "udp_stream": null, "frame_number": 15909, "timestamp_epoch": "1583962410.918329000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.194.131", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-6c5159bf3947d61b27d7913f", "src_port": 49758, "tcp_stream": 215, "udp_stream": null, "frame_number": 15911, "timestamp_epoch": "1583962411.221589000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.194.131", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-6a3257360ee90ce15c2eb1c8", "src_port": 49765, "tcp_stream": 222, "udp_stream": null, "frame_number": 15913, "timestamp_epoch": "1583962411.238689000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.194.131", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-75f29b6b7a96a6eee4db3c0a", "src_port": 49763, "tcp_stream": 220, "udp_stream": null, "frame_number": 15914, "timestamp_epoch": "1583962411.238768000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.194.131", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 80, "event_id": "evt-827f7bd3beb180afa835c94a", "src_port": 49767, "tcp_stream": 224, "udp_stream": null, "frame_number": 15917, "timestamp_epoch": "1583962411.253673000" }, { "kind": "unclassified_tcp", "dst_ip": "10.3.11.3", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.218", "dst_port": 445, "event_id": "evt-67878486cb1ffc38ca61706a", "src_port": 49730, "tcp_stream": 83, "udp_stream": null, "frame_number": 16052, "timestamp_epoch": "1583962419.319552000" }, { "kind": "unclassified_tcp", "dst_ip": "10.3.11.3", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.194", "dst_port": 445, "event_id": "evt-9e4ca2b645434d1a2e485d7f", "src_port": 49707, "tcp_stream": 106, "udp_stream": null, "frame_number": 16246, "timestamp_epoch": "1583962440.950242000" }, { "kind": "unclassified_tcp", "dst_ip": "10.3.11.3", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.218", "dst_port": 445, "event_id": "evt-3ff91d894e8ec7291ddf2ca3", "src_port": 49730, "tcp_stream": 83, "udp_stream": null, "frame_number": 16277, "timestamp_epoch": "1583962449.334515000" }, { "kind": "unclassified_tcp", "dst_ip": "10.3.11.3", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 445, "event_id": "evt-8831602746a7158917553e92", "src_port": 49733, "tcp_stream": 182, "udp_stream": null, "frame_number": 16309, "timestamp_epoch": "1583962467.121692000" }, { "kind": "unclassified_tcp", "dst_ip": "10.3.11.3", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 445, "event_id": "evt-1a3bddae8f88d51a03ec54f0", "src_port": 49733, "tcp_stream": 182, "udp_stream": null, "frame_number": 16312, "timestamp_epoch": "1583962497.123549000" }, { "kind": "unclassified_tcp", "dst_ip": "10.3.11.194", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.3", "dst_port": 49707, "event_id": "evt-f0a71ed3b0c685bc63db7485", "src_port": 445, "tcp_stream": 106, "udp_stream": null, "frame_number": 16315, "timestamp_epoch": "1583962500.980759000" }, { "kind": "unclassified_tcp", "dst_ip": "54.153.98.238", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-c656c86953bc31c14827a763", "src_port": 49815, "tcp_stream": 413, "udp_stream": null, "frame_number": 16317, "timestamp_epoch": "1583962503.205536000" }, { "kind": "unclassified_tcp", "dst_ip": "10.3.11.218", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.3", "dst_port": 49730, "event_id": "evt-9d7640f450c5f47192683f92", "src_port": 445, "tcp_stream": 83, "udp_stream": null, "frame_number": 16318, "timestamp_epoch": "1583962509.418069000" }, { "kind": "unclassified_tcp", "dst_ip": "54.153.98.238", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-200d837bae46569118588be9", "src_port": 49815, "tcp_stream": 413, "udp_stream": null, "frame_number": 16516, "timestamp_epoch": "1583962548.207567000" }, { "kind": "unclassified_tcp", "dst_ip": "10.3.11.119", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.3", "dst_port": 49733, "event_id": "evt-7942df2939157366b5236769", "src_port": 445, "tcp_stream": 182, "udp_stream": null, "frame_number": 17536, "timestamp_epoch": "1583962557.168888000" }, { "kind": "unclassified_tcp", "dst_ip": "54.153.98.238", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-a159e7205503c355c4bc8342", "src_port": 49815, "tcp_stream": 413, "udp_stream": null, "frame_number": 18355, "timestamp_epoch": "1583962593.209363000" }, { "kind": "unclassified_tcp", "dst_ip": "10.3.11.194", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.3", "dst_port": 49707, "event_id": "evt-dddab03ffdd83e799e83056f", "src_port": 445, "tcp_stream": 106, "udp_stream": null, "frame_number": 20669, "timestamp_epoch": "1583962620.983515000" }, { "kind": "unclassified_tcp", "dst_ip": "10.3.11.218", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.3", "dst_port": 49730, "event_id": "evt-2e88942bdbbe0983a1b9aded", "src_port": 445, "tcp_stream": 83, "udp_stream": null, "frame_number": 20738, "timestamp_epoch": "1583962629.421120000" }, { "kind": "unclassified_tcp", "dst_ip": "54.153.98.238", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 443, "event_id": "evt-a5b18f243777b204babb76ee", "src_port": 49815, "tcp_stream": 413, "udp_stream": null, "frame_number": 21083, "timestamp_epoch": "1583962638.210810000" }, { "kind": "unclassified_tcp", "dst_ip": "10.3.11.119", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.3", "dst_port": 49733, "event_id": "evt-50dd4ec753585770307fb796", "src_port": 445, "tcp_stream": 182, "udp_stream": null, "frame_number": 26689, "timestamp_epoch": "1583962677.184099000" }, { "kind": "unclassified_tcp", "dst_ip": "10.3.11.194", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.3", "dst_port": 49707, "event_id": "evt-6f0dabe7333879a87cc23b80", "src_port": 445, "tcp_stream": 106, "udp_stream": null, "frame_number": 27384, "timestamp_epoch": "1583962740.986488000" }, { "kind": "unclassified_tcp", "dst_ip": "10.3.11.218", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.3", "dst_port": 49730, "event_id": "evt-23784b99cdecfa2682935247", "src_port": 445, "tcp_stream": 83, "udp_stream": null, "frame_number": 27398, "timestamp_epoch": "1583962749.424050000" }, { "kind": "unclassified_tcp", "dst_ip": "10.3.11.119", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.3", "dst_port": 49733, "event_id": "evt-e2c688737a0386b6e4ac21fa", "src_port": 445, "tcp_stream": 182, "udp_stream": null, "frame_number": 27418, "timestamp_epoch": "1583962797.190604000" }, { "kind": "unclassified_tcp", "dst_ip": "10.3.11.194", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.3", "dst_port": 49707, "event_id": "evt-5d647af3bd4146a3bcc7f1ce", "src_port": 445, "tcp_stream": 106, "udp_stream": null, "frame_number": 27474, "timestamp_epoch": "1583962861.005476000" }, { "kind": "unclassified_tcp", "dst_ip": "10.3.11.218", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.3", "dst_port": 49730, "event_id": "evt-66ca9cc6e9a9e20124c7593e", "src_port": 445, "tcp_stream": 83, "udp_stream": null, "frame_number": 27505, "timestamp_epoch": "1583962869.428131000" }, { "kind": "unclassified_tcp", "dst_ip": "10.3.11.119", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.3", "dst_port": 49733, "event_id": "evt-661f2ecdf4adb89b838d6af0", "src_port": 445, "tcp_stream": 182, "udp_stream": null, "frame_number": 27563, "timestamp_epoch": "1583962917.194842000" }, { "kind": "unclassified_tcp", "dst_ip": "10.3.11.194", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.3", "dst_port": 49707, "event_id": "evt-1af8483b0f91c73def2a0812", "src_port": 445, "tcp_stream": 106, "udp_stream": null, "frame_number": 27695, "timestamp_epoch": "1583962981.024137000" }, { "kind": "unclassified_tcp", "dst_ip": "10.3.11.3", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.218", "dst_port": 445, "event_id": "evt-6ff9a4cb4d46b853b4467e07", "src_port": 49730, "tcp_stream": 83, "udp_stream": null, "frame_number": 27708, "timestamp_epoch": "1583962985.458578000" }, { "kind": "unclassified_tcp", "dst_ip": "10.3.11.3", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.194", "dst_port": 445, "event_id": "evt-1ca5d1f090dc568c22e20aa6", "src_port": 49707, "tcp_stream": 106, "udp_stream": null, "frame_number": 27751, "timestamp_epoch": "1583963011.292175000" }, { "kind": "unclassified_tcp", "dst_ip": "10.3.11.3", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.218", "dst_port": 445, "event_id": "evt-959f3546b38614268465a550", "src_port": 49730, "tcp_stream": 83, "udp_stream": null, "frame_number": 27764, "timestamp_epoch": "1583963015.474921000" }, { "kind": "unclassified_tcp", "dst_ip": "10.3.11.3", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.194", "dst_port": 445, "event_id": "evt-cb6c6cb9faaff86de1b11a30", "src_port": 49707, "tcp_stream": 106, "udp_stream": null, "frame_number": 28615, "timestamp_epoch": "1583963041.292811000" }, { "kind": "unclassified_tcp", "dst_ip": "10.3.11.3", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 445, "event_id": "evt-147ccbc373fc1cf2f9d553c6", "src_port": 49733, "tcp_stream": 182, "udp_stream": null, "frame_number": 28619, "timestamp_epoch": "1583963042.617974000" }, { "kind": "unclassified_tcp", "dst_ip": "10.3.11.3", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.119", "dst_port": 445, "event_id": "evt-f433ae759c9d6d9c00b97a5e", "src_port": 49733, "tcp_stream": 182, "udp_stream": null, "frame_number": 28870, "timestamp_epoch": "1583963072.633513000" }, { "kind": "unclassified_tcp", "dst_ip": "10.3.11.218", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.3", "dst_port": 49730, "event_id": "evt-20d2ce779f8948ba9b12fc1d", "src_port": 445, "tcp_stream": 83, "udp_stream": null, "frame_number": 29104, "timestamp_epoch": "1583963075.510957000" }, { "kind": "unclassified_tcp", "dst_ip": "10.3.11.194", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.3", "dst_port": 49707, "event_id": "evt-4107dcccab35277943fdc933", "src_port": 445, "tcp_stream": 106, "udp_stream": null, "frame_number": 29276, "timestamp_epoch": "1583963101.339410000" }, { "kind": "unclassified_tcp", "dst_ip": "10.3.11.119", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.3", "dst_port": 49733, "event_id": "evt-eb4c8a5432f9c005e20c829f", "src_port": 445, "tcp_stream": 182, "udp_stream": null, "frame_number": 29427, "timestamp_epoch": "1583963132.668456000" }, { "kind": "unclassified_tcp", "dst_ip": "10.3.11.194", "fields": { "tcp.payload": "54533554" }, "src_ip": "198.23.252.135", "dst_port": 50140, "event_id": "evt-1fc77b26a5fabdaf9200194d", "src_port": 443, "tcp_stream": 601, "udp_stream": null, "frame_number": 29445, "timestamp_epoch": "1583963141.342480000" }, { "kind": "unclassified_tcp", "dst_ip": "198.23.252.135", "fields": { "tcp.payload": "54533554" }, "src_ip": "10.3.11.194", "dst_port": 443, "event_id": "evt-9371c5a63e90165ca578cb79", "src_port": 50140, "tcp_stream": 601, "udp_stream": null, "frame_number": 29446, "timestamp_epoch": "1583963141.342674000" }, { "kind": "unclassified_tcp", "dst_ip": "10.3.11.218", "fields": { "tcp.payload": "00" }, "src_ip": "10.3.11.3", "dst_port": 49730, "event_id": "evt-2c9c8088a0759eecf32085f7", "src_port": 445, "tcp_stream": 83, "udp_stream": null, "frame_number": 29743, "timestamp_epoch": "1583963195.528827000" } ], "directory_service": [ { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-45e1a98a3e7b997562c44bbe", "src_port": null, "tcp_stream": 3, "udp_stream": null, "frame_number": 48, "timestamp_epoch": "1583961755.355025000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-e2521aa2b464cedd3ee64b8e", "src_port": null, "tcp_stream": 3, "udp_stream": null, "frame_number": 50, "timestamp_epoch": "1583961755.355378000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-b769a4ac75eba36aa725bdfe", "src_port": null, "tcp_stream": 3, "udp_stream": null, "frame_number": 89, "timestamp_epoch": "1583961755.490610000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-b626cb3905947b4d9bae4230", "src_port": null, "tcp_stream": 3, "udp_stream": null, "frame_number": 91, "timestamp_epoch": "1583961755.491373000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": {}, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-53b40e036b0b8a4ed1fb755b", "src_port": null, "tcp_stream": 3, "udp_stream": null, "frame_number": 92, "timestamp_epoch": "1583961755.493339000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": {}, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-fc67aa9847174f3fce8f9711", "src_port": null, "tcp_stream": 3, "udp_stream": null, "frame_number": 93, "timestamp_epoch": "1583961755.493592000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": {}, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-8a84731b0c1ff14327d2e4c1", "src_port": null, "tcp_stream": 3, "udp_stream": null, "frame_number": 94, "timestamp_epoch": "1583961755.494519000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": {}, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-1aa446c19e8b330b03d4db66", "src_port": null, "tcp_stream": 3, "udp_stream": null, "frame_number": 95, "timestamp_epoch": "1583961755.494836000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-a4f50d7e56110c8032bf18ca", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 124, "timestamp_epoch": "1583961755.535517000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-59d95fee0b8f2f320b6587e0", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 125, "timestamp_epoch": "1583961755.535854000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-43ca90e68c29ce9ca4c1a12a", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 126, "timestamp_epoch": "1583961755.536095000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-d1f949ed06b9594f26fe5d63", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 127, "timestamp_epoch": "1583961755.536740000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-95026ed56c007f080e8a094c", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 128, "timestamp_epoch": "1583961755.537196000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-85bc24e6bd9509885c3a25e4", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 129, "timestamp_epoch": "1583961755.537426000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-eafaf0a72c2af289f059f2a3", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 142, "timestamp_epoch": "1583961755.541707000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-fa27e98a4196c4d155fef6ef", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 143, "timestamp_epoch": "1583961755.541992000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "drsuapi.opnum": "30" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-b194d13231a0e27d0f044cad", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 144, "timestamp_epoch": "1583961755.543857000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "drsuapi.opnum": "30" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-5a9730d76a13bfd6955e3801", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 145, "timestamp_epoch": "1583961755.544340000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-982f74a94ed59777dcbef862", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 146, "timestamp_epoch": "1583961755.545942000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-32b7d7a1eccdc3fc839b6b2e", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 147, "timestamp_epoch": "1583961755.546289000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": {}, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-2142a3182f7d5c4fce636887", "src_port": null, "tcp_stream": 3, "udp_stream": null, "frame_number": 160, "timestamp_epoch": "1583961755.635399000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": {}, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-2638a4bdaef2f2215c475d86", "src_port": null, "tcp_stream": 3, "udp_stream": null, "frame_number": 162, "timestamp_epoch": "1583961755.635713000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-3493033a5daf64b83445db91", "src_port": null, "tcp_stream": 18, "udp_stream": null, "frame_number": 255, "timestamp_epoch": "1583961755.860435000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-d5d1a68e9f59954ed1b21ff0", "src_port": null, "tcp_stream": 18, "udp_stream": null, "frame_number": 257, "timestamp_epoch": "1583961755.861278000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-e489c372ec865928589b05bb", "src_port": null, "tcp_stream": 18, "udp_stream": null, "frame_number": 258, "timestamp_epoch": "1583961755.865606000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": {}, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-35c79439d3f958d08c22461f", "src_port": null, "tcp_stream": 3, "udp_stream": null, "frame_number": 264, "timestamp_epoch": "1583961755.886463000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": {}, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-55334251e66a5ce5e766ce8c", "src_port": null, "tcp_stream": 3, "udp_stream": null, "frame_number": 267, "timestamp_epoch": "1583961755.886974000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": {}, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-bea254105dec964b47dad3a5", "src_port": null, "tcp_stream": 3, "udp_stream": null, "frame_number": 283, "timestamp_epoch": "1583961755.994156000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": {}, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-32636d1d080572768ebf7ca7", "src_port": null, "tcp_stream": 3, "udp_stream": null, "frame_number": 286, "timestamp_epoch": "1583961755.994716000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": {}, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-a3ade4f3fbb57005bc9b2d69", "src_port": null, "tcp_stream": 3, "udp_stream": null, "frame_number": 292, "timestamp_epoch": "1583961755.996217000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": {}, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-870102ef39a6732a81e13099", "src_port": null, "tcp_stream": 3, "udp_stream": null, "frame_number": 294, "timestamp_epoch": "1583961755.996551000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": {}, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-80655fa3a3259bc6413e893c", "src_port": null, "tcp_stream": 3, "udp_stream": null, "frame_number": 295, "timestamp_epoch": "1583961755.996846000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": {}, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-cec04d3bedf5103bdb63c83c", "src_port": null, "tcp_stream": 3, "udp_stream": null, "frame_number": 296, "timestamp_epoch": "1583961755.997189000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": {}, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-4c04d3fda125edc72ed51c29", "src_port": null, "tcp_stream": 3, "udp_stream": null, "frame_number": 297, "timestamp_epoch": "1583961755.997389000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-4fd2fe6f32932d633410b67d", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 309, "timestamp_epoch": "1583961756.107768000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-23350f6ae5d46ef907e2140a", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 310, "timestamp_epoch": "1583961756.107962000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-68e55c3c1497c03bddd75753", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 311, "timestamp_epoch": "1583961756.108175000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-099b66bb70d8f1cd4e35dbbe", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 312, "timestamp_epoch": "1583961756.108474000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-a4e809651f582a40e84c365f", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 313, "timestamp_epoch": "1583961756.108621000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-c43d0f88fb715ace951746bd", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 314, "timestamp_epoch": "1583961756.108928000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-d0c8f70a7d17fa6b044d28aa", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 315, "timestamp_epoch": "1583961756.109524000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-c7e50e7e5dfaee674415b3dc", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 316, "timestamp_epoch": "1583961756.109657000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-300b9792f31469897d7c62ed", "src_port": null, "tcp_stream": 22, "udp_stream": null, "frame_number": 326, "timestamp_epoch": "1583961756.517808000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-8b09a9e5b936a496b990835b", "src_port": null, "tcp_stream": 22, "udp_stream": null, "frame_number": 328, "timestamp_epoch": "1583961756.518251000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-c5fdf0029389eafc9e51878e", "src_port": null, "tcp_stream": 22, "udp_stream": null, "frame_number": 331, "timestamp_epoch": "1583961756.521469000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-7d32ad7d799496ec980ececa", "src_port": null, "tcp_stream": 22, "udp_stream": null, "frame_number": 333, "timestamp_epoch": "1583961756.522379000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "1", "ldap.baseObject": "DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-f254a34ba0e59dbe380fdf5b", "src_port": null, "tcp_stream": 22, "udp_stream": null, "frame_number": 347, "timestamp_epoch": "1583961756.587955000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "ldap.protocolOp": "4,19,19,19,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-6a295f9355814514b986f0cc", "src_port": null, "tcp_stream": 22, "udp_stream": null, "frame_number": 348, "timestamp_epoch": "1583961756.588481000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-73cb9bbf6709e49cee59a9ef", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 353, "timestamp_epoch": "1583961756.594953000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-0296a028dbe271af3b115166", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 355, "timestamp_epoch": "1583961756.596262000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-79be2a9f22c80728e3e306c9", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 356, "timestamp_epoch": "1583961756.596931000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-a35583ce50af8ed4590ec4f5", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 357, "timestamp_epoch": "1583961756.597265000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-5096838969679913c391b114", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 358, "timestamp_epoch": "1583961756.597790000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-fcb4800e76c65d462b251538", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 359, "timestamp_epoch": "1583961756.598050000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "0", "ldap.baseObject": "cn=policies,cn=system,DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-069360be3c399968e43fce31", "src_port": null, "tcp_stream": 22, "udp_stream": null, "frame_number": 360, "timestamp_epoch": "1583961756.598941000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-58d9a653be97fedd13872477", "src_port": null, "tcp_stream": 22, "udp_stream": null, "frame_number": 361, "timestamp_epoch": "1583961756.599661000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-5a65eb1d897efe63a93602bf", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 506, "timestamp_epoch": "1583961756.943006000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-715694eab254a0ba21d3ebdd", "src_port": null, "tcp_stream": 22, "udp_stream": null, "frame_number": 511, "timestamp_epoch": "1583961756.981858000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-f8e53d56f9d0ae41d96e8812", "src_port": null, "tcp_stream": 29, "udp_stream": null, "frame_number": 570, "timestamp_epoch": "1583961758.487165000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-db632bcfe73d187d8ed7d9f4", "src_port": null, "tcp_stream": 29, "udp_stream": null, "frame_number": 571, "timestamp_epoch": "1583961758.487408000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-530c9a635807624ff0592218", "src_port": null, "tcp_stream": 29, "udp_stream": null, "frame_number": 572, "timestamp_epoch": "1583961758.487858000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-057a7647642dc4c70b9e601a", "src_port": null, "tcp_stream": 29, "udp_stream": null, "frame_number": 573, "timestamp_epoch": "1583961758.488224000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-1fd6c02864c166e598ed3c6f", "src_port": null, "tcp_stream": 29, "udp_stream": null, "frame_number": 574, "timestamp_epoch": "1583961758.488429000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-5852ceed9bc771cc269cecdb", "src_port": null, "tcp_stream": 29, "udp_stream": null, "frame_number": 575, "timestamp_epoch": "1583961758.488595000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-2d6fe9aae64319a8d1b64c87", "src_port": null, "tcp_stream": 29, "udp_stream": null, "frame_number": 578, "timestamp_epoch": "1583961758.489905000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-759131d11c15639e376fcab8", "src_port": null, "tcp_stream": 29, "udp_stream": null, "frame_number": 579, "timestamp_epoch": "1583961758.490133000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-6be4ae9f704bc1526fb801ce", "src_port": null, "tcp_stream": 29, "udp_stream": null, "frame_number": 580, "timestamp_epoch": "1583961758.490346000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-f1decd588146c9e48ebbbf78", "src_port": null, "tcp_stream": 29, "udp_stream": null, "frame_number": 581, "timestamp_epoch": "1583961758.490690000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-c434cef670a9316dd03492ed", "src_port": null, "tcp_stream": 29, "udp_stream": null, "frame_number": 582, "timestamp_epoch": "1583961758.490900000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-12a0aaafe93261b25853587f", "src_port": null, "tcp_stream": 29, "udp_stream": null, "frame_number": 583, "timestamp_epoch": "1583961758.491084000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-5873659adeb464c84908568a", "src_port": null, "tcp_stream": 30, "udp_stream": null, "frame_number": 596, "timestamp_epoch": "1583961758.612172000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-dba3816e6db3fa0787989a04", "src_port": null, "tcp_stream": 30, "udp_stream": null, "frame_number": 598, "timestamp_epoch": "1583961758.612583000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-519a44faea50846c1285ee7a", "src_port": null, "tcp_stream": 30, "udp_stream": null, "frame_number": 601, "timestamp_epoch": "1583961758.614413000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-21a21cfcd6c64e297e4c4e5c", "src_port": null, "tcp_stream": 30, "udp_stream": null, "frame_number": 603, "timestamp_epoch": "1583961758.615249000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=LAPTOP-I9ZPI04,CN=Computers,DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-26b08aa81e9e892d0187caa5", "src_port": null, "tcp_stream": 30, "udp_stream": null, "frame_number": 606, "timestamp_epoch": "1583961758.616522000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-8284ced624fef5ccbfd0f57c", "src_port": null, "tcp_stream": 30, "udp_stream": null, "frame_number": 607, "timestamp_epoch": "1583961758.616821000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=LAPTOP-I9ZPI04,CN=Computers,DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-02ea76496addd607e408035a", "src_port": null, "tcp_stream": 30, "udp_stream": null, "frame_number": 608, "timestamp_epoch": "1583961758.617896000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-3fce61c52102e814ed2643cf", "src_port": null, "tcp_stream": 30, "udp_stream": null, "frame_number": 609, "timestamp_epoch": "1583961758.618173000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=LAPTOP-I9ZPI04,CN=Computers,DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-d2d9343aab1028d390a10f75", "src_port": null, "tcp_stream": 30, "udp_stream": null, "frame_number": 610, "timestamp_epoch": "1583961758.622990000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-698ae7a237658e8d91df9581", "src_port": null, "tcp_stream": 30, "udp_stream": null, "frame_number": 611, "timestamp_epoch": "1583961758.623346000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-b9698149aa028ca54060a699", "src_port": null, "tcp_stream": 32, "udp_stream": null, "frame_number": 616, "timestamp_epoch": "1583961758.626812000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-f57abcdfd3a8d3e757b8049b", "src_port": null, "tcp_stream": 32, "udp_stream": null, "frame_number": 618, "timestamp_epoch": "1583961758.627969000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-bb98431c6f1ddc0f6c6f84e9", "src_port": null, "tcp_stream": 32, "udp_stream": null, "frame_number": 619, "timestamp_epoch": "1583961758.629314000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-5966a5eee75dea48a1cad879", "src_port": null, "tcp_stream": 32, "udp_stream": null, "frame_number": 622, "timestamp_epoch": "1583961758.629746000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=62a0ff2e-97b9-4513-943f-0d221bd30080,CN=Device Registration Configuration,CN=services,CN=Configuration,DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-56a923dca076e0d427e9d747", "src_port": null, "tcp_stream": 32, "udp_stream": null, "frame_number": 624, "timestamp_epoch": "1583961758.631713000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-06a8c6f9424b5a451a9ac1a8", "src_port": null, "tcp_stream": 32, "udp_stream": null, "frame_number": 625, "timestamp_epoch": "1583961758.632083000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-d2fbaef68099f109c167eaf8", "src_port": null, "tcp_stream": 32, "udp_stream": null, "frame_number": 626, "timestamp_epoch": "1583961758.633625000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-31ba3928a43e1df1586378b1", "src_port": null, "tcp_stream": 30, "udp_stream": null, "frame_number": 630, "timestamp_epoch": "1583961758.637371000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-aa83ef0861ca362621a72fca", "src_port": null, "tcp_stream": 45, "udp_stream": null, "frame_number": 942, "timestamp_epoch": "1583961764.276575000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-c64bc0b06bab2e387a8301c5", "src_port": null, "tcp_stream": 45, "udp_stream": null, "frame_number": 944, "timestamp_epoch": "1583961764.276910000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-43f3071a16143e293528f068", "src_port": null, "tcp_stream": 45, "udp_stream": null, "frame_number": 947, "timestamp_epoch": "1583961764.279535000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-89d620eeef6ffd1905b4b46f", "src_port": null, "tcp_stream": 45, "udp_stream": null, "frame_number": 949, "timestamp_epoch": "1583961764.280459000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-6b0a1c4e5a4b1d33c3846011", "src_port": null, "tcp_stream": 45, "udp_stream": null, "frame_number": 950, "timestamp_epoch": "1583961764.282618000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-b6e7803603615a65fbc039f0", "src_port": null, "tcp_stream": 45, "udp_stream": null, "frame_number": 951, "timestamp_epoch": "1583961764.282876000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-d71af6be76d464a984afe575", "src_port": null, "tcp_stream": 45, "udp_stream": null, "frame_number": 952, "timestamp_epoch": "1583961764.283309000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-5efe2050443e4b03e944c1a6", "src_port": null, "tcp_stream": 45, "udp_stream": null, "frame_number": 953, "timestamp_epoch": "1583961764.283535000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=NTDS Settings,CN=MONDOGREEK-DC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-9349de892c1ba9ed39966e6d", "src_port": null, "tcp_stream": 45, "udp_stream": null, "frame_number": 954, "timestamp_epoch": "1583961764.283838000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-23930f63a7dc661ef6414280", "src_port": null, "tcp_stream": 45, "udp_stream": null, "frame_number": 955, "timestamp_epoch": "1583961764.284198000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "3", "ldap.baseObject": "CN=Public Key Services,CN=Services,CN=Configuration,DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-0f7025dcfa4243a7f04c3ec8", "src_port": null, "tcp_stream": 45, "udp_stream": null, "frame_number": 956, "timestamp_epoch": "1583961764.284586000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-47032c087c6a2c7d376d3dc6", "src_port": null, "tcp_stream": 45, "udp_stream": null, "frame_number": 957, "timestamp_epoch": "1583961764.284881000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=OID,CN=Public Key Services,CN=Services,CN=Configuration,DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-7f74f20328a896fb928034de", "src_port": null, "tcp_stream": 45, "udp_stream": null, "frame_number": 958, "timestamp_epoch": "1583961764.285230000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-fb0f2cfac5d2985c93bc2c40", "src_port": null, "tcp_stream": 45, "udp_stream": null, "frame_number": 959, "timestamp_epoch": "1583961764.285457000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-83a5c8be8f40fef0b53c61fb", "src_port": null, "tcp_stream": 46, "udp_stream": null, "frame_number": 964, "timestamp_epoch": "1583961764.307177000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-3f3eea84c62b7a45c3ae3361", "src_port": null, "tcp_stream": 46, "udp_stream": null, "frame_number": 967, "timestamp_epoch": "1583961764.308415000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-05ce80fc02f0b0816d0ff322", "src_port": null, "tcp_stream": 46, "udp_stream": null, "frame_number": 968, "timestamp_epoch": "1583961764.309701000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-bd425a61c9a08fb4b9b79f95", "src_port": null, "tcp_stream": 46, "udp_stream": null, "frame_number": 969, "timestamp_epoch": "1583961764.310050000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "3", "ldap.baseObject": "CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-89aaa6b61bfe9d2b78202879", "src_port": null, "tcp_stream": 46, "udp_stream": null, "frame_number": 1000, "timestamp_epoch": "1583961764.319460000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-2e1b3a05701fc4aeef63254f", "src_port": null, "tcp_stream": 46, "udp_stream": null, "frame_number": 1001, "timestamp_epoch": "1583961764.319967000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-004b2beda793b5ddaea2de9a", "src_port": null, "tcp_stream": 46, "udp_stream": null, "frame_number": 1002, "timestamp_epoch": "1583961764.321385000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-58b29c7cf1b6d6730fba3054", "src_port": null, "tcp_stream": 45, "udp_stream": null, "frame_number": 1006, "timestamp_epoch": "1583961764.322377000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-ee6328b6c671b334620ad288", "src_port": null, "tcp_stream": 52, "udp_stream": null, "frame_number": 1075, "timestamp_epoch": "1583961779.869860000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-640059fa616bb2e254e0d25e", "src_port": null, "tcp_stream": 52, "udp_stream": null, "frame_number": 1077, "timestamp_epoch": "1583961779.870174000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-4414afdf2db847941999233a", "src_port": null, "tcp_stream": 52, "udp_stream": null, "frame_number": 1171, "timestamp_epoch": "1583961781.230479000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-b0005d9f6b978ce12b18bee2", "src_port": null, "tcp_stream": 52, "udp_stream": null, "frame_number": 1177, "timestamp_epoch": "1583961781.231691000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-be9c0fccfa8d1242c3931b74", "src_port": null, "tcp_stream": 52, "udp_stream": null, "frame_number": 1178, "timestamp_epoch": "1583961781.238565000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-80cdf0d35fd667d5bfaa3c95", "src_port": null, "tcp_stream": 58, "udp_stream": null, "frame_number": 1216, "timestamp_epoch": "1583961781.254112000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-9c16be9ab7d401b54d280034", "src_port": null, "tcp_stream": 58, "udp_stream": null, "frame_number": 1217, "timestamp_epoch": "1583961781.254593000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-87286ffb24ac81b93a5b2b63", "src_port": null, "tcp_stream": 58, "udp_stream": null, "frame_number": 1218, "timestamp_epoch": "1583961781.255289000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-5e4762a33bb2c3f19b6b70cd", "src_port": null, "tcp_stream": 58, "udp_stream": null, "frame_number": 1219, "timestamp_epoch": "1583961781.255819000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-d37cb1eceee872a29b7459e4", "src_port": null, "tcp_stream": 58, "udp_stream": null, "frame_number": 1220, "timestamp_epoch": "1583961781.256098000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-e639561233f9bed165c12977", "src_port": null, "tcp_stream": 58, "udp_stream": null, "frame_number": 1221, "timestamp_epoch": "1583961781.256347000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-a637150397419f8ea18fa3ba", "src_port": null, "tcp_stream": 58, "udp_stream": null, "frame_number": 1230, "timestamp_epoch": "1583961781.259186000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-61363312db23f6386786e8ff", "src_port": null, "tcp_stream": 58, "udp_stream": null, "frame_number": 1231, "timestamp_epoch": "1583961781.259377000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "drsuapi.opnum": "30" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-619d51ac7678f4191feeaf7e", "src_port": null, "tcp_stream": 58, "udp_stream": null, "frame_number": 1232, "timestamp_epoch": "1583961781.260341000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "drsuapi.opnum": "30" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-4b8c2d6536a23b74d3833789", "src_port": null, "tcp_stream": 58, "udp_stream": null, "frame_number": 1233, "timestamp_epoch": "1583961781.260689000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-b3ef28ca89a78e3cb9e3edff", "src_port": null, "tcp_stream": 58, "udp_stream": null, "frame_number": 1234, "timestamp_epoch": "1583961781.261522000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-dfa633d7ccc6b047ba329784", "src_port": null, "tcp_stream": 58, "udp_stream": null, "frame_number": 1235, "timestamp_epoch": "1583961781.261809000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-475b3280d27d5bc1a207ee2b", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 1239, "timestamp_epoch": "1583961781.263514000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-92b40225afa8494fb1505551", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 1241, "timestamp_epoch": "1583961781.263928000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-d76a655a4a710a38959ea35c", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 1244, "timestamp_epoch": "1583961781.265476000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-5ae8e6600ca1d1a861045762", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 1246, "timestamp_epoch": "1583961781.266459000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": {}, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-63517ef5d29915321ebe04f8", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 1247, "timestamp_epoch": "1583961781.268509000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": {}, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-49a033e6eebac6ddc45b22b7", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 1248, "timestamp_epoch": "1583961781.268779000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": {}, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-6e6b6c9be744aabffeee681b", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 1249, "timestamp_epoch": "1583961781.269493000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": {}, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-b10a0dcaf9698f53d3929852", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 1250, "timestamp_epoch": "1583961781.269931000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": {}, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-6f04f65796a8235129de1932", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 1266, "timestamp_epoch": "1583961781.396733000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": {}, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-3e43abd5585819dcb4542c27", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 1268, "timestamp_epoch": "1583961781.397131000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": {}, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-e2ee4118e5ed2e42b921f996", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 1329, "timestamp_epoch": "1583961781.591831000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": {}, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-3bccb79d7d2c2fbdd7aae61e", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 1331, "timestamp_epoch": "1583961781.592162000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": {}, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-554237fb27fb631409d33669", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 1342, "timestamp_epoch": "1583961781.701691000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": {}, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-722663e5f5fa3101a725eea1", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 1344, "timestamp_epoch": "1583961781.702159000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": {}, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-734433fd221d45591c904b82", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 1351, "timestamp_epoch": "1583961781.704324000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": {}, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-dfa5c780e4c319f010ba789f", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 1352, "timestamp_epoch": "1583961781.704596000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": {}, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-94fffc1cff5fefb53ca02cd4", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 1353, "timestamp_epoch": "1583961781.704798000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": {}, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-5e6a6694b7d496a58d55e0ef", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 1354, "timestamp_epoch": "1583961781.705226000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": {}, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-af00a35cd281d8aba212f9e6", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 1355, "timestamp_epoch": "1583961781.706374000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-20fb42aff66417d6536b0b8e", "src_port": null, "tcp_stream": 58, "udp_stream": null, "frame_number": 1367, "timestamp_epoch": "1583961781.757583000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-8eb578181e507845dbf5f9e1", "src_port": null, "tcp_stream": 58, "udp_stream": null, "frame_number": 1368, "timestamp_epoch": "1583961781.757746000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-182115f790498f8f5d3b20ae", "src_port": null, "tcp_stream": 58, "udp_stream": null, "frame_number": 1369, "timestamp_epoch": "1583961781.757923000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-0cc634c9c4afd02b3af9a557", "src_port": null, "tcp_stream": 58, "udp_stream": null, "frame_number": 1370, "timestamp_epoch": "1583961781.758187000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-f5b965ec434a685c1b14bdd6", "src_port": null, "tcp_stream": 58, "udp_stream": null, "frame_number": 1371, "timestamp_epoch": "1583961781.758370000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-66b16f283e2274e0d10266e2", "src_port": null, "tcp_stream": 58, "udp_stream": null, "frame_number": 1372, "timestamp_epoch": "1583961781.758580000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-72298b2a9790bbc95e9b92ad", "src_port": null, "tcp_stream": 58, "udp_stream": null, "frame_number": 1373, "timestamp_epoch": "1583961781.758822000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-51f9790721342b29eb0f9d8e", "src_port": null, "tcp_stream": 58, "udp_stream": null, "frame_number": 1374, "timestamp_epoch": "1583961781.758944000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-95ba39e1e89a196de17a31cb", "src_port": null, "tcp_stream": 71, "udp_stream": null, "frame_number": 1384, "timestamp_epoch": "1583961782.229016000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-a4f98417f3750aee2785aced", "src_port": null, "tcp_stream": 71, "udp_stream": null, "frame_number": 1386, "timestamp_epoch": "1583961782.229427000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-360a4f7e794fe501922c5fe4", "src_port": null, "tcp_stream": 71, "udp_stream": null, "frame_number": 1389, "timestamp_epoch": "1583961782.231459000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-f6eec09b93dc8074d6246d41", "src_port": null, "tcp_stream": 71, "udp_stream": null, "frame_number": 1391, "timestamp_epoch": "1583961782.232292000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "1", "ldap.baseObject": "DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-bba427513e9087fe82a9dfc1", "src_port": null, "tcp_stream": 71, "udp_stream": null, "frame_number": 1413, "timestamp_epoch": "1583961782.261397000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "4,19,19,19,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-46554585ab31eb6e0648db11", "src_port": null, "tcp_stream": 71, "udp_stream": null, "frame_number": 1414, "timestamp_epoch": "1583961782.261723000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-4c509267783a59d7a7a725ff", "src_port": null, "tcp_stream": 73, "udp_stream": null, "frame_number": 1419, "timestamp_epoch": "1583961782.266315000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-3f4aea9227f347e7867c4ad5", "src_port": null, "tcp_stream": 73, "udp_stream": null, "frame_number": 1421, "timestamp_epoch": "1583961782.267321000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-7a3b9d90c99a138ca593e489", "src_port": null, "tcp_stream": 73, "udp_stream": null, "frame_number": 1422, "timestamp_epoch": "1583961782.268552000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-34b118725dff91f93094c8f2", "src_port": null, "tcp_stream": 73, "udp_stream": null, "frame_number": 1423, "timestamp_epoch": "1583961782.268871000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-db22e59d3f21a82e53c29ebc", "src_port": null, "tcp_stream": 73, "udp_stream": null, "frame_number": 1424, "timestamp_epoch": "1583961782.269216000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-3e8980da0922b6a463708981", "src_port": null, "tcp_stream": 73, "udp_stream": null, "frame_number": 1425, "timestamp_epoch": "1583961782.269480000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "0", "ldap.baseObject": "cn=policies,cn=system,DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-b1e831aac646914ebfe3a17b", "src_port": null, "tcp_stream": 71, "udp_stream": null, "frame_number": 1426, "timestamp_epoch": "1583961782.270302000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-8123963e6240a504157df8d3", "src_port": null, "tcp_stream": 71, "udp_stream": null, "frame_number": 1427, "timestamp_epoch": "1583961782.270753000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-771b0a551d7821a323f886b8", "src_port": null, "tcp_stream": 73, "udp_stream": null, "frame_number": 1571, "timestamp_epoch": "1583961782.504700000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-6ded5906be34bd0188b3503c", "src_port": null, "tcp_stream": 71, "udp_stream": null, "frame_number": 1575, "timestamp_epoch": "1583961782.520520000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-4d7c8575d358a5d29c7b3aba", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 1641, "timestamp_epoch": "1583961783.484661000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-4d8e1fd577e462c97ef14ac9", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 1642, "timestamp_epoch": "1583961783.484902000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-6fa3b0d5768e4efa2cd7810a", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 1643, "timestamp_epoch": "1583961783.485902000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-09d3dbef852545044dec3424", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 1644, "timestamp_epoch": "1583961783.486617000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-75d06dc49d1da93fa40cc003", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 1645, "timestamp_epoch": "1583961783.487003000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-959d382d660ac2ddb2d505f6", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 1646, "timestamp_epoch": "1583961783.487532000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-1ab288d62920b6dfd52b2c3a", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 1647, "timestamp_epoch": "1583961783.487978000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-e73f51c4baf2e765b2b3931f", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 1648, "timestamp_epoch": "1583961783.488212000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "samr.opnum": "64" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-ccd3b8308b26b83914b805f5", "src_port": null, "tcp_stream": 81, "udp_stream": null, "frame_number": 1683, "timestamp_epoch": "1583961783.543910000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "samr.opnum": "64" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-2be8c050c4542dfe4d72d9fb", "src_port": null, "tcp_stream": 81, "udp_stream": null, "frame_number": 1684, "timestamp_epoch": "1583961783.544429000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "samr.opnum": "6" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-b2929c5345a0496ebbbf5631", "src_port": null, "tcp_stream": 81, "udp_stream": null, "frame_number": 1685, "timestamp_epoch": "1583961783.545049000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "samr.opnum": "6" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-fffa11377155fe382108c322", "src_port": null, "tcp_stream": 81, "udp_stream": null, "frame_number": 1686, "timestamp_epoch": "1583961783.545446000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "samr.opnum": "5" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-0233640d818d3d009634647f", "src_port": null, "tcp_stream": 81, "udp_stream": null, "frame_number": 1687, "timestamp_epoch": "1583961783.545711000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "samr.opnum": "5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-c7e44c05783bb308b09c26dc", "src_port": null, "tcp_stream": 81, "udp_stream": null, "frame_number": 1688, "timestamp_epoch": "1583961783.546172000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "samr.opnum": "7" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-3362f4a4ca2484c6b0f429f1", "src_port": null, "tcp_stream": 81, "udp_stream": null, "frame_number": 1689, "timestamp_epoch": "1583961783.546555000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "samr.opnum": "7" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-85dec6fddadfeb6fd63f4e54", "src_port": null, "tcp_stream": 81, "udp_stream": null, "frame_number": 1690, "timestamp_epoch": "1583961783.547033000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "samr.opnum": "7" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-c95ec6a1f17140068033d507", "src_port": null, "tcp_stream": 81, "udp_stream": null, "frame_number": 1691, "timestamp_epoch": "1583961783.547874000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "samr.opnum": "7" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-15d8745d40393ecbe3bd21bf", "src_port": null, "tcp_stream": 81, "udp_stream": null, "frame_number": 1692, "timestamp_epoch": "1583961783.548561000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "samr.opnum": "17" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-053e88c21efc45da14b52730", "src_port": null, "tcp_stream": 81, "udp_stream": null, "frame_number": 1693, "timestamp_epoch": "1583961783.548844000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "samr.opnum": "17" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-c3e4589136628d5c04c3a8d9", "src_port": null, "tcp_stream": 81, "udp_stream": null, "frame_number": 1694, "timestamp_epoch": "1583961783.549391000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "samr.opnum": "34" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-2a0f7458c4cd065db9a9b780", "src_port": null, "tcp_stream": 81, "udp_stream": null, "frame_number": 1695, "timestamp_epoch": "1583961783.550201000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "samr.opnum": "34" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-d348f6d885da3f676f4d36b3", "src_port": null, "tcp_stream": 81, "udp_stream": null, "frame_number": 1696, "timestamp_epoch": "1583961783.551086000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "samr.opnum": "36" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-61ef6d54684048386bc35a1b", "src_port": null, "tcp_stream": 81, "udp_stream": null, "frame_number": 1697, "timestamp_epoch": "1583961783.551380000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "samr.opnum": "36", "samr.samr_UserInfo21.full_name": "Dominga McDowell", "samr.samr_UserInfo21.account_name": "dominga.mcdowell" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-d9eb13fce753bb4c9eea743c", "src_port": null, "tcp_stream": 81, "udp_stream": null, "frame_number": 1698, "timestamp_epoch": "1583961783.552100000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "samr.opnum": "3" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-a08676daa28a67155c67eff0", "src_port": null, "tcp_stream": 81, "udp_stream": null, "frame_number": 1699, "timestamp_epoch": "1583961783.552725000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "samr.opnum": "3" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-10b2210145b2b3c36d6be3f1", "src_port": null, "tcp_stream": 81, "udp_stream": null, "frame_number": 1700, "timestamp_epoch": "1583961783.553452000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "samr.opnum": "39" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-5954c1cabf8a0648413121c3", "src_port": null, "tcp_stream": 81, "udp_stream": null, "frame_number": 1701, "timestamp_epoch": "1583961783.554327000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "samr.opnum": "39" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-4d3b7499bd0e515ad08129d7", "src_port": null, "tcp_stream": 81, "udp_stream": null, "frame_number": 1702, "timestamp_epoch": "1583961783.555084000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "samr.opnum": "16" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-224645020c351d06c3c36f65", "src_port": null, "tcp_stream": 81, "udp_stream": null, "frame_number": 1703, "timestamp_epoch": "1583961783.555640000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "samr.opnum": "16" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-a9728c237ea4eb8d6429dd76", "src_port": null, "tcp_stream": 81, "udp_stream": null, "frame_number": 1704, "timestamp_epoch": "1583961783.556146000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "samr.opnum": "1" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-6a41107e771834f6e2b7f9ab", "src_port": null, "tcp_stream": 81, "udp_stream": null, "frame_number": 1705, "timestamp_epoch": "1583961783.562945000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "samr.opnum": "1" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-74e80b00c2c10696b39fe580", "src_port": null, "tcp_stream": 81, "udp_stream": null, "frame_number": 1706, "timestamp_epoch": "1583961783.563520000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "samr.opnum": "1" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-0ed25a95915714394e0c85d1", "src_port": null, "tcp_stream": 81, "udp_stream": null, "frame_number": 1707, "timestamp_epoch": "1583961783.564153000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "samr.opnum": "1" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-222ed26f055bc7f88dbb3f27", "src_port": null, "tcp_stream": 81, "udp_stream": null, "frame_number": 1708, "timestamp_epoch": "1583961783.564640000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "samr.opnum": "1" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-88edd39bd929d9a93fed643a", "src_port": null, "tcp_stream": 81, "udp_stream": null, "frame_number": 1709, "timestamp_epoch": "1583961783.565899000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "samr.opnum": "1" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-fa5b0151d1bb6e6e8ab8e1d1", "src_port": null, "tcp_stream": 81, "udp_stream": null, "frame_number": 1710, "timestamp_epoch": "1583961783.566360000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "samr.opnum": "1" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-7a7cddbf74faebf4b607a932", "src_port": null, "tcp_stream": 81, "udp_stream": null, "frame_number": 1711, "timestamp_epoch": "1583961783.572530000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "samr.opnum": "1" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-33f31c45331d2ec1257cf4fd", "src_port": null, "tcp_stream": 81, "udp_stream": null, "frame_number": 1712, "timestamp_epoch": "1583961783.573165000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-1f276e23ce726544054ac08b", "src_port": null, "tcp_stream": 86, "udp_stream": null, "frame_number": 1765, "timestamp_epoch": "1583961783.845560000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-b071d4b25c8918d6c51b5477", "src_port": null, "tcp_stream": 86, "udp_stream": null, "frame_number": 1767, "timestamp_epoch": "1583961783.846852000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "1", "ldap.baseObject": "DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-f01af989d760dc781900a224", "src_port": null, "tcp_stream": 86, "udp_stream": null, "frame_number": 1768, "timestamp_epoch": "1583961783.851358000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "ldap.protocolOp": "4,19,19,19,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-e884aee78885c93017799647", "src_port": null, "tcp_stream": 86, "udp_stream": null, "frame_number": 1769, "timestamp_epoch": "1583961783.851844000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-c0674e890279614655cbc4d2", "src_port": null, "tcp_stream": 87, "udp_stream": null, "frame_number": 1774, "timestamp_epoch": "1583961783.867213000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-960b6c0d69ffed6ffd6c4fb1", "src_port": null, "tcp_stream": 87, "udp_stream": null, "frame_number": 1776, "timestamp_epoch": "1583961783.868270000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-ef97681fcd6e21ad01a6f9dd", "src_port": null, "tcp_stream": 87, "udp_stream": null, "frame_number": 1778, "timestamp_epoch": "1583961783.869260000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-0977e88575861082a822ac77", "src_port": null, "tcp_stream": 87, "udp_stream": null, "frame_number": 1779, "timestamp_epoch": "1583961783.869607000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-b474747d5cac5eb688724c66", "src_port": null, "tcp_stream": 87, "udp_stream": null, "frame_number": 1780, "timestamp_epoch": "1583961783.870075000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-efd7b22c854234e3a8b2f6ef", "src_port": null, "tcp_stream": 87, "udp_stream": null, "frame_number": 1781, "timestamp_epoch": "1583961783.870489000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "0", "ldap.baseObject": "cn=policies,cn=system,DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-25a0ac019d681a347f98f6e8", "src_port": null, "tcp_stream": 86, "udp_stream": null, "frame_number": 1782, "timestamp_epoch": "1583961783.870826000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-50759968bea79e440959889b", "src_port": null, "tcp_stream": 86, "udp_stream": null, "frame_number": 1783, "timestamp_epoch": "1583961783.871249000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-57d7874d61a0fb30e53661f2", "src_port": null, "tcp_stream": 87, "udp_stream": null, "frame_number": 1793, "timestamp_epoch": "1583961784.208010000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-867e9b3b55471c3b370fb2dd", "src_port": null, "tcp_stream": 86, "udp_stream": null, "frame_number": 1797, "timestamp_epoch": "1583961784.215634000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-2d645536a998c22c75e8338e", "src_port": null, "tcp_stream": 95, "udp_stream": null, "frame_number": 1955, "timestamp_epoch": "1583961789.906473000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-40fa5f614c97db08df5de541", "src_port": null, "tcp_stream": 95, "udp_stream": null, "frame_number": 1957, "timestamp_epoch": "1583961789.906888000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-72fbfb23c6923a83d2816db8", "src_port": null, "tcp_stream": 95, "udp_stream": null, "frame_number": 1960, "timestamp_epoch": "1583961789.909925000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-1978c7b718b4533484c6f07c", "src_port": null, "tcp_stream": 95, "udp_stream": null, "frame_number": 1962, "timestamp_epoch": "1583961789.910946000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-3f727ad9ec0e64e06a1ffa3e", "src_port": null, "tcp_stream": 95, "udp_stream": null, "frame_number": 1965, "timestamp_epoch": "1583961789.914383000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-41704596184965940e64b776", "src_port": null, "tcp_stream": 95, "udp_stream": null, "frame_number": 1966, "timestamp_epoch": "1583961789.914801000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-183c99a192f11b55d03583e9", "src_port": null, "tcp_stream": 95, "udp_stream": null, "frame_number": 1967, "timestamp_epoch": "1583961789.915255000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-31fad81ff9986b9316eead76", "src_port": null, "tcp_stream": 95, "udp_stream": null, "frame_number": 1968, "timestamp_epoch": "1583961789.915534000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=NTDS Settings,CN=MONDOGREEK-DC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-dc5bd3c9d37af19b9bd62718", "src_port": null, "tcp_stream": 95, "udp_stream": null, "frame_number": 1969, "timestamp_epoch": "1583961789.915793000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-750fa3c101637d1420519745", "src_port": null, "tcp_stream": 95, "udp_stream": null, "frame_number": 1970, "timestamp_epoch": "1583961789.916132000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "3", "ldap.baseObject": "CN=Public Key Services,CN=Services,CN=Configuration,DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-82fa265039c48878b1467ef1", "src_port": null, "tcp_stream": 95, "udp_stream": null, "frame_number": 1971, "timestamp_epoch": "1583961789.916598000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-2ce8ec0e11b47a4798c401ac", "src_port": null, "tcp_stream": 95, "udp_stream": null, "frame_number": 1972, "timestamp_epoch": "1583961789.917026000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=OID,CN=Public Key Services,CN=Services,CN=Configuration,DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-a02e19a0e1f15199c4a4e124", "src_port": null, "tcp_stream": 95, "udp_stream": null, "frame_number": 1973, "timestamp_epoch": "1583961789.917408000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-eea41dbaaf983483f1dadfac", "src_port": null, "tcp_stream": 95, "udp_stream": null, "frame_number": 1974, "timestamp_epoch": "1583961789.917679000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-6ca6c44b4679e278e47941d4", "src_port": null, "tcp_stream": 95, "udp_stream": null, "frame_number": 2006, "timestamp_epoch": "1583961789.949556000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-aaab38a3a6099e1bfbf7719b", "src_port": null, "tcp_stream": 58, "udp_stream": null, "frame_number": 2122, "timestamp_epoch": "1583961800.968358000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-a11a4492b2faa3857b066f7f", "src_port": null, "tcp_stream": 58, "udp_stream": null, "frame_number": 2123, "timestamp_epoch": "1583961800.968736000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-f81fbfda61931147382550b1", "src_port": null, "tcp_stream": 58, "udp_stream": null, "frame_number": 2124, "timestamp_epoch": "1583961800.969081000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-67c32af4ed2bdab5adcb3cf5", "src_port": null, "tcp_stream": 58, "udp_stream": null, "frame_number": 2125, "timestamp_epoch": "1583961800.969473000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-bc293a661b90c3e81526e9f0", "src_port": null, "tcp_stream": 58, "udp_stream": null, "frame_number": 2126, "timestamp_epoch": "1583961800.969972000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-eadfa46bae8f5688cd48e4dc", "src_port": null, "tcp_stream": 58, "udp_stream": null, "frame_number": 2127, "timestamp_epoch": "1583961800.970252000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-8802c0522e9b6f8d664e8118", "src_port": null, "tcp_stream": 58, "udp_stream": null, "frame_number": 2128, "timestamp_epoch": "1583961800.970788000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-e072ba3c3c34637d0235c7ad", "src_port": null, "tcp_stream": 58, "udp_stream": null, "frame_number": 2130, "timestamp_epoch": "1583961800.970945000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "samr.opnum": "64" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-e4057bb29bfaa86d186e8754", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2167, "timestamp_epoch": "1583961801.016998000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "samr.opnum": "64" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-0f7a96020d9e01e06b89a300", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2168, "timestamp_epoch": "1583961801.017613000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "samr.opnum": "6" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-1cb8ec476bbe2a95714fb019", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2169, "timestamp_epoch": "1583961801.017867000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "samr.opnum": "6" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-e5f420acd9423eb7a12b9a11", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2170, "timestamp_epoch": "1583961801.018252000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "samr.opnum": "5" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-904bf239e6bcfb10b13c7ca0", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2171, "timestamp_epoch": "1583961801.018566000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "samr.opnum": "5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-9713f8a94c2b01f2a6c88ee5", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2172, "timestamp_epoch": "1583961801.018989000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "samr.opnum": "7" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-11061aadd0060efc9cfebe02", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2173, "timestamp_epoch": "1583961801.019419000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "samr.opnum": "7" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-6e595deedf472929d881a3ba", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2174, "timestamp_epoch": "1583961801.019828000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "samr.opnum": "7" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-1148737f6c1b37393530ba14", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2175, "timestamp_epoch": "1583961801.020054000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "samr.opnum": "7" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-674550c87ec68cbde83c44cd", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2176, "timestamp_epoch": "1583961801.020459000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "samr.opnum": "17" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-03cc280423a27f05d20c7a29", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2177, "timestamp_epoch": "1583961801.020634000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "samr.opnum": "17" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-8aa27c99092c36ba46420c9a", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2178, "timestamp_epoch": "1583961801.021192000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "samr.opnum": "34" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-beb50017dcd89c1b75e8a18c", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2179, "timestamp_epoch": "1583961801.021406000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "samr.opnum": "34" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-0f68e619a431ce5d3eb1f71a", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2180, "timestamp_epoch": "1583961801.022083000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "samr.opnum": "36" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-88b2d025cd1ff9a485af6fe1", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2181, "timestamp_epoch": "1583961801.022294000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "samr.opnum": "36", "samr.samr_UserInfo21.full_name": "Otis Witherspoon", "samr.samr_UserInfo21.account_name": "otis.witherspoon" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-6bfd17107d383895371aaa9f", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2182, "timestamp_epoch": "1583961801.022721000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "samr.opnum": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-01ab0e2b9656c7785ca21a30", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2183, "timestamp_epoch": "1583961801.022946000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "samr.opnum": "3" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-d3aed40e7eefb08e08e886e1", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2184, "timestamp_epoch": "1583961801.023523000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "samr.opnum": "39" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-6249e873d6a5a3b7e3a04b91", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2185, "timestamp_epoch": "1583961801.023789000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "samr.opnum": "39" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-3d69f13ccb30d4ee414aa219", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2186, "timestamp_epoch": "1583961801.024248000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "samr.opnum": "16" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-fd1f1b60a272da4ed1a96967", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2187, "timestamp_epoch": "1583961801.024530000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "samr.opnum": "16" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-ab609b44b72f96ad1287c0cb", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2188, "timestamp_epoch": "1583961801.024886000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "samr.opnum": "1" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-fa5b70549660c52e384963b0", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2189, "timestamp_epoch": "1583961801.025244000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "samr.opnum": "1" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-d8ec9bde78cad2ba44c24d9b", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2190, "timestamp_epoch": "1583961801.025678000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "samr.opnum": "1" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-0c1b3f4af978118417e0e0b7", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2191, "timestamp_epoch": "1583961801.025958000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "samr.opnum": "1" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-bc5d02958e2403c7c6407398", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2192, "timestamp_epoch": "1583961801.026402000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "samr.opnum": "1" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-e1107eef85966ad510919a53", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2193, "timestamp_epoch": "1583961801.026642000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "samr.opnum": "1" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-43fce3e25056fe5e1648a2c8", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2194, "timestamp_epoch": "1583961801.026991000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "samr.opnum": "1" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-bfca3c57896375004a25a5a7", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2195, "timestamp_epoch": "1583961801.027216000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "samr.opnum": "1" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-431d4c5a3ba40f16317f43dd", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2196, "timestamp_epoch": "1583961801.027543000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-bbafdc159d75cdb8aa8edc56", "src_port": null, "tcp_stream": 109, "udp_stream": null, "frame_number": 2248, "timestamp_epoch": "1583961801.304771000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-e52d4e6e6c72d376486785d5", "src_port": null, "tcp_stream": 109, "udp_stream": null, "frame_number": 2250, "timestamp_epoch": "1583961801.305753000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "1", "ldap.baseObject": "DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-55179074e2d7022d430ac76f", "src_port": null, "tcp_stream": 109, "udp_stream": null, "frame_number": 2252, "timestamp_epoch": "1583961801.312482000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "4,19,19,19,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-48b2044cb7d4aef6fdc082c1", "src_port": null, "tcp_stream": 109, "udp_stream": null, "frame_number": 2253, "timestamp_epoch": "1583961801.313025000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-ed51d2151ee57c96e8095cd9", "src_port": null, "tcp_stream": 110, "udp_stream": null, "frame_number": 2260, "timestamp_epoch": "1583961801.332921000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-99f4858932f9d151dec0c13c", "src_port": null, "tcp_stream": 110, "udp_stream": null, "frame_number": 2262, "timestamp_epoch": "1583961801.333878000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-571943efa50c90466141cc43", "src_port": null, "tcp_stream": 110, "udp_stream": null, "frame_number": 2263, "timestamp_epoch": "1583961801.334876000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-807890d90ab7b7c04710b708", "src_port": null, "tcp_stream": 110, "udp_stream": null, "frame_number": 2264, "timestamp_epoch": "1583961801.335202000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-60a4a65a0fbc8e60d8726217", "src_port": null, "tcp_stream": 110, "udp_stream": null, "frame_number": 2265, "timestamp_epoch": "1583961801.335506000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-8886e27b3e8360499b9ba3e5", "src_port": null, "tcp_stream": 110, "udp_stream": null, "frame_number": 2266, "timestamp_epoch": "1583961801.335809000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "0", "ldap.baseObject": "cn=policies,cn=system,DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-505941f858973cd1662a8e19", "src_port": null, "tcp_stream": 109, "udp_stream": null, "frame_number": 2267, "timestamp_epoch": "1583961801.336235000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-0d2d8868760d53028df8b49a", "src_port": null, "tcp_stream": 109, "udp_stream": null, "frame_number": 2268, "timestamp_epoch": "1583961801.336667000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-c4cdf51766e71702b1a5ba9e", "src_port": null, "tcp_stream": 110, "udp_stream": null, "frame_number": 2272, "timestamp_epoch": "1583961801.664944000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-e010e4c23882d8e111f6eae2", "src_port": null, "tcp_stream": 109, "udp_stream": null, "frame_number": 2276, "timestamp_epoch": "1583961801.684911000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-25e938061b1b2973ea06acd7", "src_port": null, "tcp_stream": 119, "udp_stream": null, "frame_number": 2493, "timestamp_epoch": "1583961811.057983000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-2c0aa0e80577a0f11b7da5e6", "src_port": null, "tcp_stream": 119, "udp_stream": null, "frame_number": 2495, "timestamp_epoch": "1583961811.058430000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-901d74a6331f05891bb2b2e6", "src_port": null, "tcp_stream": 122, "udp_stream": null, "frame_number": 2565, "timestamp_epoch": "1583961813.030234000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-368c249cc7635a7735bec465", "src_port": null, "tcp_stream": 122, "udp_stream": null, "frame_number": 2567, "timestamp_epoch": "1583961813.030611000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-93ec494905b64c1b5a40139b", "src_port": null, "tcp_stream": 122, "udp_stream": null, "frame_number": 2627, "timestamp_epoch": "1583961813.157646000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-4ee0fccab0304c30eb0ec09e", "src_port": null, "tcp_stream": 122, "udp_stream": null, "frame_number": 2631, "timestamp_epoch": "1583961813.158489000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-e8fef45eacf7e8307c5dc3d6", "src_port": null, "tcp_stream": 119, "udp_stream": null, "frame_number": 2643, "timestamp_epoch": "1583961813.160499000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": {}, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-386a55d931e6d5e3d9201f66", "src_port": null, "tcp_stream": 122, "udp_stream": null, "frame_number": 2646, "timestamp_epoch": "1583961813.161171000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-70ac585ca8bb8aab015018d9", "src_port": null, "tcp_stream": 119, "udp_stream": null, "frame_number": 2647, "timestamp_epoch": "1583961813.161220000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": {}, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-537f9a676e064a1465909c33", "src_port": null, "tcp_stream": 122, "udp_stream": null, "frame_number": 2648, "timestamp_epoch": "1583961813.161534000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": {}, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-096b34b149de09ef5168fb57", "src_port": null, "tcp_stream": 122, "udp_stream": null, "frame_number": 2651, "timestamp_epoch": "1583961813.162526000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-20b86a6f412554610ddc2c46", "src_port": null, "tcp_stream": 129, "udp_stream": null, "frame_number": 2652, "timestamp_epoch": "1583961813.162563000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-611d147f2fdbc821f565798a", "src_port": null, "tcp_stream": 129, "udp_stream": null, "frame_number": 2653, "timestamp_epoch": "1583961813.162867000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": {}, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-dcc52db5fa3e7bafcf426d70", "src_port": null, "tcp_stream": 122, "udp_stream": null, "frame_number": 2654, "timestamp_epoch": "1583961813.163004000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-a7a6a9d145414f1c2148d5a2", "src_port": null, "tcp_stream": 129, "udp_stream": null, "frame_number": 2655, "timestamp_epoch": "1583961813.163158000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-252a6430dcd30dd3d733fa71", "src_port": null, "tcp_stream": 129, "udp_stream": null, "frame_number": 2656, "timestamp_epoch": "1583961813.163511000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-e5a698d29d5960c5217f09a3", "src_port": null, "tcp_stream": 129, "udp_stream": null, "frame_number": 2657, "timestamp_epoch": "1583961813.163961000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-bdfabe773b8f7c6892e76b44", "src_port": null, "tcp_stream": 129, "udp_stream": null, "frame_number": 2658, "timestamp_epoch": "1583961813.164133000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-b6af78567b4372d739888080", "src_port": null, "tcp_stream": 119, "udp_stream": null, "frame_number": 2662, "timestamp_epoch": "1583961813.164702000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-ff32dbd2c152f467acd191ca", "src_port": null, "tcp_stream": 129, "udp_stream": null, "frame_number": 2673, "timestamp_epoch": "1583961813.168884000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-8c7af47e47d86407af24a6e0", "src_port": null, "tcp_stream": 129, "udp_stream": null, "frame_number": 2674, "timestamp_epoch": "1583961813.169145000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "drsuapi.opnum": "30" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-45423b50afa5d055ad6c3da1", "src_port": null, "tcp_stream": 129, "udp_stream": null, "frame_number": 2675, "timestamp_epoch": "1583961813.170723000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "drsuapi.opnum": "30" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-3f754294736025e8e0e9efbf", "src_port": null, "tcp_stream": 129, "udp_stream": null, "frame_number": 2676, "timestamp_epoch": "1583961813.171160000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-5242dbee9b217baaa843fdf4", "src_port": null, "tcp_stream": 129, "udp_stream": null, "frame_number": 2677, "timestamp_epoch": "1583961813.173551000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-b5b8b197590c30ef2b584626", "src_port": null, "tcp_stream": 129, "udp_stream": null, "frame_number": 2678, "timestamp_epoch": "1583961813.173775000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": {}, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-638d77d8fddd4c08bf4ba5a9", "src_port": null, "tcp_stream": 122, "udp_stream": null, "frame_number": 2691, "timestamp_epoch": "1583961813.295695000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": {}, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-1301021506f0aec2100c39a3", "src_port": null, "tcp_stream": 122, "udp_stream": null, "frame_number": 2693, "timestamp_epoch": "1583961813.296019000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": {}, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-1f8b108825bdd0cae7f8b312", "src_port": null, "tcp_stream": 122, "udp_stream": null, "frame_number": 2743, "timestamp_epoch": "1583961813.449891000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": {}, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-fe94a984adbad3717b2d5c08", "src_port": null, "tcp_stream": 122, "udp_stream": null, "frame_number": 2746, "timestamp_epoch": "1583961813.450245000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": {}, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-362228cbbe0d8ce401237164", "src_port": null, "tcp_stream": 122, "udp_stream": null, "frame_number": 2761, "timestamp_epoch": "1583961813.559524000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": {}, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-e2fa9d755d46bfdf8b296c37", "src_port": null, "tcp_stream": 122, "udp_stream": null, "frame_number": 2763, "timestamp_epoch": "1583961813.559848000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": {}, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-f3c29744de01b333bb1cd77c", "src_port": null, "tcp_stream": 122, "udp_stream": null, "frame_number": 2769, "timestamp_epoch": "1583961813.561868000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": {}, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-e2271271972d5a00bf1d1e6e", "src_port": null, "tcp_stream": 122, "udp_stream": null, "frame_number": 2771, "timestamp_epoch": "1583961813.562271000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": {}, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-639172a72d0a6cd12065e160", "src_port": null, "tcp_stream": 122, "udp_stream": null, "frame_number": 2773, "timestamp_epoch": "1583961813.562936000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": {}, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-3106706e597ac241ea0feccf", "src_port": null, "tcp_stream": 122, "udp_stream": null, "frame_number": 2775, "timestamp_epoch": "1583961813.563383000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": {}, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-b4fd83103c3cb61a1f8d3a42", "src_port": null, "tcp_stream": 122, "udp_stream": null, "frame_number": 2776, "timestamp_epoch": "1583961813.563581000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-c1e19493ab161ef6a9006916", "src_port": null, "tcp_stream": 129, "udp_stream": null, "frame_number": 2790, "timestamp_epoch": "1583961813.619689000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-475896bfc309a51d1caf6ca2", "src_port": null, "tcp_stream": 129, "udp_stream": null, "frame_number": 2791, "timestamp_epoch": "1583961813.619975000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-6f9a33339bb979aa0718ae1e", "src_port": null, "tcp_stream": 129, "udp_stream": null, "frame_number": 2792, "timestamp_epoch": "1583961813.620366000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-47dff4849866cc6af7a32165", "src_port": null, "tcp_stream": 129, "udp_stream": null, "frame_number": 2793, "timestamp_epoch": "1583961813.620895000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-a79cdea577ddb49a8091815b", "src_port": null, "tcp_stream": 129, "udp_stream": null, "frame_number": 2794, "timestamp_epoch": "1583961813.621101000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-03844f029b5b126adbee9b84", "src_port": null, "tcp_stream": 129, "udp_stream": null, "frame_number": 2795, "timestamp_epoch": "1583961813.621421000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-7932658b284b39e80f318e3b", "src_port": null, "tcp_stream": 129, "udp_stream": null, "frame_number": 2796, "timestamp_epoch": "1583961813.621706000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-95e08ac482853aedcb64a0cd", "src_port": null, "tcp_stream": 129, "udp_stream": null, "frame_number": 2797, "timestamp_epoch": "1583961813.621879000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-2f3f8517dbd38c924e50e117", "src_port": null, "tcp_stream": 137, "udp_stream": null, "frame_number": 2815, "timestamp_epoch": "1583961814.055614000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-2ed2f025ab71ec9284a82e8b", "src_port": null, "tcp_stream": 137, "udp_stream": null, "frame_number": 2817, "timestamp_epoch": "1583961814.055981000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-a819eb4883b41d33c731123b", "src_port": null, "tcp_stream": 137, "udp_stream": null, "frame_number": 2820, "timestamp_epoch": "1583961814.058784000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-a00bc4890bad6b96738fc85a", "src_port": null, "tcp_stream": 137, "udp_stream": null, "frame_number": 2822, "timestamp_epoch": "1583961814.059565000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "1", "ldap.baseObject": "DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-880a396ed44410144064b04c", "src_port": null, "tcp_stream": 137, "udp_stream": null, "frame_number": 2836, "timestamp_epoch": "1583961814.115833000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "ldap.protocolOp": "4,19,19,19,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-9c1ffbb38c93f75df3a2ed99", "src_port": null, "tcp_stream": 137, "udp_stream": null, "frame_number": 2837, "timestamp_epoch": "1583961814.116310000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-c837fc96ec21af2bbd7e98a5", "src_port": null, "tcp_stream": 139, "udp_stream": null, "frame_number": 2842, "timestamp_epoch": "1583961814.133631000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-80f147b58bf56ff598243552", "src_port": null, "tcp_stream": 139, "udp_stream": null, "frame_number": 2844, "timestamp_epoch": "1583961814.135186000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-1fdd7b0d0d018c10b9f37c6e", "src_port": null, "tcp_stream": 139, "udp_stream": null, "frame_number": 2845, "timestamp_epoch": "1583961814.135851000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-6fc4eaedd531ab8ff2addd4c", "src_port": null, "tcp_stream": 139, "udp_stream": null, "frame_number": 2846, "timestamp_epoch": "1583961814.136075000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-cff1af4f8b60373376dc9910", "src_port": null, "tcp_stream": 139, "udp_stream": null, "frame_number": 2847, "timestamp_epoch": "1583961814.136308000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-249929d3c6eb5b11c89afc7d", "src_port": null, "tcp_stream": 139, "udp_stream": null, "frame_number": 2849, "timestamp_epoch": "1583961814.136635000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "0", "ldap.baseObject": "cn=policies,cn=system,DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-83f5821f85369a1815fc8398", "src_port": null, "tcp_stream": 137, "udp_stream": null, "frame_number": 2850, "timestamp_epoch": "1583961814.137537000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-bf04cf1a6475b17355d30cf4", "src_port": null, "tcp_stream": 137, "udp_stream": null, "frame_number": 2851, "timestamp_epoch": "1583961814.137990000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-d1d10f7b37f2a5c6a79721b3", "src_port": null, "tcp_stream": 139, "udp_stream": null, "frame_number": 2994, "timestamp_epoch": "1583961814.440305000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-474fc41bd09f4338cda33e9a", "src_port": null, "tcp_stream": 137, "udp_stream": null, "frame_number": 2998, "timestamp_epoch": "1583961814.449018000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-2acd3e6d0c3ec34b7c705c50", "src_port": null, "tcp_stream": 144, "udp_stream": null, "frame_number": 3049, "timestamp_epoch": "1583961815.810997000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-42e546f99b51294abeb09bcd", "src_port": null, "tcp_stream": 144, "udp_stream": null, "frame_number": 3050, "timestamp_epoch": "1583961815.811385000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-d91f63447f6e29f415861c4f", "src_port": null, "tcp_stream": 144, "udp_stream": null, "frame_number": 3051, "timestamp_epoch": "1583961815.811926000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-ecf3ce0321a0692144144933", "src_port": null, "tcp_stream": 144, "udp_stream": null, "frame_number": 3052, "timestamp_epoch": "1583961815.812380000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-fabbe990703cf6c90d7d4702", "src_port": null, "tcp_stream": 144, "udp_stream": null, "frame_number": 3053, "timestamp_epoch": "1583961815.812679000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-8ded45105282fca91bbfdfc8", "src_port": null, "tcp_stream": 144, "udp_stream": null, "frame_number": 3054, "timestamp_epoch": "1583961815.812854000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-554af66e97b7248f9a1be0f0", "src_port": null, "tcp_stream": 144, "udp_stream": null, "frame_number": 3057, "timestamp_epoch": "1583961815.814446000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-6b34a3677d89a1facc4c9bae", "src_port": null, "tcp_stream": 144, "udp_stream": null, "frame_number": 3058, "timestamp_epoch": "1583961815.814657000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-01cc4c7f06cabefd12969546", "src_port": null, "tcp_stream": 144, "udp_stream": null, "frame_number": 3059, "timestamp_epoch": "1583961815.814959000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-95a6ec72693f578c1fe9c7b7", "src_port": null, "tcp_stream": 144, "udp_stream": null, "frame_number": 3060, "timestamp_epoch": "1583961815.815287000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-7ee9e4ef369022e8958c6670", "src_port": null, "tcp_stream": 144, "udp_stream": null, "frame_number": 3061, "timestamp_epoch": "1583961815.815497000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-3f4a13275f5f8e60c9a9451f", "src_port": null, "tcp_stream": 144, "udp_stream": null, "frame_number": 3062, "timestamp_epoch": "1583961815.815673000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-ac66eb217209862cf6ca5b15", "src_port": null, "tcp_stream": 145, "udp_stream": null, "frame_number": 3072, "timestamp_epoch": "1583961815.919472000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-2dc1939a5d61127f9609cd57", "src_port": null, "tcp_stream": 145, "udp_stream": null, "frame_number": 3074, "timestamp_epoch": "1583961815.919756000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-51ec94b3fce369ef2f1130e7", "src_port": null, "tcp_stream": 145, "udp_stream": null, "frame_number": 3077, "timestamp_epoch": "1583961815.921016000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-02fbf8431d283916fa3ff302", "src_port": null, "tcp_stream": 145, "udp_stream": null, "frame_number": 3079, "timestamp_epoch": "1583961815.921730000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=LAPTOP-SQSA42O,CN=Computers,DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-06dafa10a5c5b157b88b2a78", "src_port": null, "tcp_stream": 145, "udp_stream": null, "frame_number": 3080, "timestamp_epoch": "1583961815.922270000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-2d3ec5f92a907f727e9212a2", "src_port": null, "tcp_stream": 145, "udp_stream": null, "frame_number": 3081, "timestamp_epoch": "1583961815.922632000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=LAPTOP-SQSA42O,CN=Computers,DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-e6a15a4653e0d376bd9d4556", "src_port": null, "tcp_stream": 145, "udp_stream": null, "frame_number": 3082, "timestamp_epoch": "1583961815.923132000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-6928a46bf4bbf38d595ee651", "src_port": null, "tcp_stream": 145, "udp_stream": null, "frame_number": 3083, "timestamp_epoch": "1583961815.923319000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=LAPTOP-SQSA42O,CN=Computers,DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-41a33d6affe6115d3772de02", "src_port": null, "tcp_stream": 145, "udp_stream": null, "frame_number": 3084, "timestamp_epoch": "1583961815.923482000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-9ec7a860cf0183547b555350", "src_port": null, "tcp_stream": 145, "udp_stream": null, "frame_number": 3085, "timestamp_epoch": "1583961815.923663000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-b88e053e9991adcf7606bb35", "src_port": null, "tcp_stream": 146, "udp_stream": null, "frame_number": 3090, "timestamp_epoch": "1583961815.926463000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-544f4393b29d7f88bbcf3365", "src_port": null, "tcp_stream": 146, "udp_stream": null, "frame_number": 3092, "timestamp_epoch": "1583961815.927260000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-7dc5317361889155f7dbd497", "src_port": null, "tcp_stream": 146, "udp_stream": null, "frame_number": 3093, "timestamp_epoch": "1583961815.927753000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-64c2ebd6b882531648fdd319", "src_port": null, "tcp_stream": 146, "udp_stream": null, "frame_number": 3096, "timestamp_epoch": "1583961815.928075000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=62a0ff2e-97b9-4513-943f-0d221bd30080,CN=Device Registration Configuration,CN=services,CN=Configuration,DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-3e754ef8843c76b3ff08a2a3", "src_port": null, "tcp_stream": 146, "udp_stream": null, "frame_number": 3098, "timestamp_epoch": "1583961815.928713000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-e6d45b5f5e9031a1347f9bc1", "src_port": null, "tcp_stream": 146, "udp_stream": null, "frame_number": 3099, "timestamp_epoch": "1583961815.928975000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-f0b128837bc047916238d212", "src_port": null, "tcp_stream": 146, "udp_stream": null, "frame_number": 3100, "timestamp_epoch": "1583961815.929335000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-0bd26d477a05f41f96549b06", "src_port": null, "tcp_stream": 145, "udp_stream": null, "frame_number": 3104, "timestamp_epoch": "1583961815.929954000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-ca3dc1041b68e527ce159cc1", "src_port": null, "tcp_stream": 169, "udp_stream": null, "frame_number": 3622, "timestamp_epoch": "1583961821.346293000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-50ca1997c1542c74396539c5", "src_port": null, "tcp_stream": 169, "udp_stream": null, "frame_number": 3624, "timestamp_epoch": "1583961821.346640000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-03a29b31d18f147c03f36bda", "src_port": null, "tcp_stream": 169, "udp_stream": null, "frame_number": 3627, "timestamp_epoch": "1583961821.348431000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-6c9dd37c56ce8a7f7299c222", "src_port": null, "tcp_stream": 169, "udp_stream": null, "frame_number": 3629, "timestamp_epoch": "1583961821.349230000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-f9125fca338ce45d6223dcf2", "src_port": null, "tcp_stream": 169, "udp_stream": null, "frame_number": 3630, "timestamp_epoch": "1583961821.351313000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-fa5cfe5c8490959d39059ff4", "src_port": null, "tcp_stream": 169, "udp_stream": null, "frame_number": 3631, "timestamp_epoch": "1583961821.351534000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-7d3b2c81f71f9168eddb7533", "src_port": null, "tcp_stream": 169, "udp_stream": null, "frame_number": 3632, "timestamp_epoch": "1583961821.351940000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-1ad3b5326db421912d611693", "src_port": null, "tcp_stream": 169, "udp_stream": null, "frame_number": 3633, "timestamp_epoch": "1583961821.352191000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=NTDS Settings,CN=MONDOGREEK-DC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-346781abba71d73f2908d5ab", "src_port": null, "tcp_stream": 169, "udp_stream": null, "frame_number": 3634, "timestamp_epoch": "1583961821.352520000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-694889a0e577d0c0e3346d75", "src_port": null, "tcp_stream": 169, "udp_stream": null, "frame_number": 3635, "timestamp_epoch": "1583961821.352841000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "3", "ldap.baseObject": "CN=Public Key Services,CN=Services,CN=Configuration,DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-f00f47eeac80bcb79b793923", "src_port": null, "tcp_stream": 169, "udp_stream": null, "frame_number": 3636, "timestamp_epoch": "1583961821.353128000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-b5e8c5d108a2e273b999b447", "src_port": null, "tcp_stream": 169, "udp_stream": null, "frame_number": 3637, "timestamp_epoch": "1583961821.353508000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=OID,CN=Public Key Services,CN=Services,CN=Configuration,DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-360d1fc9ed660f99966fd447", "src_port": null, "tcp_stream": 169, "udp_stream": null, "frame_number": 3638, "timestamp_epoch": "1583961821.353868000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-41329c1877fc8d84048264d1", "src_port": null, "tcp_stream": 169, "udp_stream": null, "frame_number": 3639, "timestamp_epoch": "1583961821.354194000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-8a7c5b742bbb86099496a7b5", "src_port": null, "tcp_stream": 170, "udp_stream": null, "frame_number": 3644, "timestamp_epoch": "1583961821.368228000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-91368866eb7e35ff8134cdd9", "src_port": null, "tcp_stream": 170, "udp_stream": null, "frame_number": 3646, "timestamp_epoch": "1583961821.369171000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-8aa0f9b6cf7525f5bdce5ef9", "src_port": null, "tcp_stream": 170, "udp_stream": null, "frame_number": 3647, "timestamp_epoch": "1583961821.370365000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-caca8102996ee47610d28aa0", "src_port": null, "tcp_stream": 170, "udp_stream": null, "frame_number": 3648, "timestamp_epoch": "1583961821.370778000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "3", "ldap.baseObject": "CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-4aad8ff7f78fb960b019f377", "src_port": null, "tcp_stream": 170, "udp_stream": null, "frame_number": 3679, "timestamp_epoch": "1583961821.379684000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-a4c674f23b46d5c1dd61e597", "src_port": null, "tcp_stream": 170, "udp_stream": null, "frame_number": 3680, "timestamp_epoch": "1583961821.380283000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-652892f1db6875ffc29faea4", "src_port": null, "tcp_stream": 170, "udp_stream": null, "frame_number": 3681, "timestamp_epoch": "1583961821.381273000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-20343b554cfb74ac7c5ec12e", "src_port": null, "tcp_stream": 169, "udp_stream": null, "frame_number": 3685, "timestamp_epoch": "1583961821.382035000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-8ad385c8f578e311aac8a763", "src_port": null, "tcp_stream": 129, "udp_stream": null, "frame_number": 3821, "timestamp_epoch": "1583961831.474895000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-6f5b8ec2e1b3575df1f62d15", "src_port": null, "tcp_stream": 129, "udp_stream": null, "frame_number": 3822, "timestamp_epoch": "1583961831.475169000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-e32187f6845a6cf158f591b7", "src_port": null, "tcp_stream": 129, "udp_stream": null, "frame_number": 3823, "timestamp_epoch": "1583961831.475410000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-b07fc512489517fca6475447", "src_port": null, "tcp_stream": 129, "udp_stream": null, "frame_number": 3824, "timestamp_epoch": "1583961831.475820000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-5e92449c89f5ed3d84ca1f10", "src_port": null, "tcp_stream": 129, "udp_stream": null, "frame_number": 3826, "timestamp_epoch": "1583961831.476180000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-fcfbb71eeb2065f48934bf92", "src_port": null, "tcp_stream": 129, "udp_stream": null, "frame_number": 3828, "timestamp_epoch": "1583961831.476593000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-93c55ee7699e4d308949920a", "src_port": null, "tcp_stream": 129, "udp_stream": null, "frame_number": 3829, "timestamp_epoch": "1583961831.476842000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-d548e2ac59a760405bd1cfff", "src_port": null, "tcp_stream": 129, "udp_stream": null, "frame_number": 3830, "timestamp_epoch": "1583961831.477041000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "samr.opnum": "64" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-c0eb02f38222284a2527c027", "src_port": null, "tcp_stream": 180, "udp_stream": null, "frame_number": 3866, "timestamp_epoch": "1583961831.539577000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "samr.opnum": "64" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-c864de2b6dd6d4ffcb839423", "src_port": null, "tcp_stream": 180, "udp_stream": null, "frame_number": 3867, "timestamp_epoch": "1583961831.540079000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "samr.opnum": "6" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-9fb0cfdb38ac0245e9c0de0a", "src_port": null, "tcp_stream": 180, "udp_stream": null, "frame_number": 3868, "timestamp_epoch": "1583961831.540299000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "samr.opnum": "6" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-5ca2cc825b17fcc9265fffb7", "src_port": null, "tcp_stream": 180, "udp_stream": null, "frame_number": 3869, "timestamp_epoch": "1583961831.540622000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "samr.opnum": "5" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-95d09523fd751184c012b25a", "src_port": null, "tcp_stream": 180, "udp_stream": null, "frame_number": 3870, "timestamp_epoch": "1583961831.543416000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "samr.opnum": "5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-683865214d0a23ef878930d0", "src_port": null, "tcp_stream": 180, "udp_stream": null, "frame_number": 3871, "timestamp_epoch": "1583961831.543813000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "samr.opnum": "7" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-6f12e6d45d2fbf56d558c077", "src_port": null, "tcp_stream": 180, "udp_stream": null, "frame_number": 3872, "timestamp_epoch": "1583961831.544195000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "samr.opnum": "7" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-0b585b40f80d7bb3902d728a", "src_port": null, "tcp_stream": 180, "udp_stream": null, "frame_number": 3873, "timestamp_epoch": "1583961831.544604000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "samr.opnum": "7" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-201298e6635f084bf7714fcc", "src_port": null, "tcp_stream": 180, "udp_stream": null, "frame_number": 3874, "timestamp_epoch": "1583961831.544846000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "samr.opnum": "7" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-597702316f2d61b63d289907", "src_port": null, "tcp_stream": 180, "udp_stream": null, "frame_number": 3875, "timestamp_epoch": "1583961831.545406000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "samr.opnum": "17" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-c58c616e53ed5ec038b2eeee", "src_port": null, "tcp_stream": 180, "udp_stream": null, "frame_number": 3876, "timestamp_epoch": "1583961831.545688000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "samr.opnum": "17" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-b8f05b1313079ecacba4f698", "src_port": null, "tcp_stream": 180, "udp_stream": null, "frame_number": 3877, "timestamp_epoch": "1583961831.546356000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "samr.opnum": "34" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-085b74bbe947fd10f6e56ab6", "src_port": null, "tcp_stream": 180, "udp_stream": null, "frame_number": 3878, "timestamp_epoch": "1583961831.546939000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "samr.opnum": "34" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-ef18e4a3ec381498adc5b6f6", "src_port": null, "tcp_stream": 180, "udp_stream": null, "frame_number": 3879, "timestamp_epoch": "1583961831.547559000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "samr.opnum": "36" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-e17f38e52629ca7f11442a85", "src_port": null, "tcp_stream": 180, "udp_stream": null, "frame_number": 3880, "timestamp_epoch": "1583961831.547995000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "samr.opnum": "36", "samr.samr_UserInfo21.full_name": "Dorian Neff", "samr.samr_UserInfo21.account_name": "dorian.neff" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-81113e3cdc7ceeb8d4402d98", "src_port": null, "tcp_stream": 180, "udp_stream": null, "frame_number": 3881, "timestamp_epoch": "1583961831.548512000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "samr.opnum": "3" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-6df1b559a50a7cfaf3b07d73", "src_port": null, "tcp_stream": 180, "udp_stream": null, "frame_number": 3882, "timestamp_epoch": "1583961831.548772000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "samr.opnum": "3" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-fda8388be1c3af3caf7afd3a", "src_port": null, "tcp_stream": 180, "udp_stream": null, "frame_number": 3883, "timestamp_epoch": "1583961831.549303000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "samr.opnum": "39" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-e00be87038dc28a7f130328a", "src_port": null, "tcp_stream": 180, "udp_stream": null, "frame_number": 3884, "timestamp_epoch": "1583961831.549532000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "samr.opnum": "39" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-b277ceb62f7f12742cde1730", "src_port": null, "tcp_stream": 180, "udp_stream": null, "frame_number": 3885, "timestamp_epoch": "1583961831.549976000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "samr.opnum": "16" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-5dbe15132d9cbfbd8ee97896", "src_port": null, "tcp_stream": 180, "udp_stream": null, "frame_number": 3886, "timestamp_epoch": "1583961831.550231000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "samr.opnum": "16" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-729f7fe7e50fbf634a6afe5f", "src_port": null, "tcp_stream": 180, "udp_stream": null, "frame_number": 3887, "timestamp_epoch": "1583961831.550646000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "samr.opnum": "1" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-b0797d23dd23c2cfbc08186e", "src_port": null, "tcp_stream": 180, "udp_stream": null, "frame_number": 3888, "timestamp_epoch": "1583961831.550999000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "samr.opnum": "1" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-676014ddcedc6225dba8622c", "src_port": null, "tcp_stream": 180, "udp_stream": null, "frame_number": 3889, "timestamp_epoch": "1583961831.551314000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "samr.opnum": "1" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-fbc78e0e6d5fc3984d86dd7b", "src_port": null, "tcp_stream": 180, "udp_stream": null, "frame_number": 3890, "timestamp_epoch": "1583961831.551821000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "samr.opnum": "1" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-95cd45b25ed4537b1c9ba563", "src_port": null, "tcp_stream": 180, "udp_stream": null, "frame_number": 3891, "timestamp_epoch": "1583961831.552217000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "samr.opnum": "1" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-e608ae5b14f93d2a3da20876", "src_port": null, "tcp_stream": 180, "udp_stream": null, "frame_number": 3892, "timestamp_epoch": "1583961831.552412000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "samr.opnum": "1" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-5faff56118e7f20dcd2f49df", "src_port": null, "tcp_stream": 180, "udp_stream": null, "frame_number": 3893, "timestamp_epoch": "1583961831.552745000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "samr.opnum": "1" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-27fbf05b01756350979e8ae9", "src_port": null, "tcp_stream": 180, "udp_stream": null, "frame_number": 3894, "timestamp_epoch": "1583961831.552964000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "samr.opnum": "1" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-8b2c15317e41ea7619329a02", "src_port": null, "tcp_stream": 180, "udp_stream": null, "frame_number": 3895, "timestamp_epoch": "1583961831.553399000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-8e5654a6bbefe1e240a34418", "src_port": null, "tcp_stream": 185, "udp_stream": null, "frame_number": 3948, "timestamp_epoch": "1583961831.834781000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-3db9d987b8cc0f3037790e61", "src_port": null, "tcp_stream": 185, "udp_stream": null, "frame_number": 3950, "timestamp_epoch": "1583961831.835650000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "1", "ldap.baseObject": "DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-e23a18cd87a75cb41c8a77ca", "src_port": null, "tcp_stream": 185, "udp_stream": null, "frame_number": 3951, "timestamp_epoch": "1583961831.841415000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "ldap.protocolOp": "4,19,19,19,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-03a4f98f227173ecc61bd782", "src_port": null, "tcp_stream": 185, "udp_stream": null, "frame_number": 3952, "timestamp_epoch": "1583961831.841895000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-b1217ab81272741ffedef091", "src_port": null, "tcp_stream": 186, "udp_stream": null, "frame_number": 3957, "timestamp_epoch": "1583961831.845532000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-230eb7c056070ec1e53c99f9", "src_port": null, "tcp_stream": 186, "udp_stream": null, "frame_number": 3959, "timestamp_epoch": "1583961831.846467000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-e9f9f0b898f895ae01d93dd6", "src_port": null, "tcp_stream": 186, "udp_stream": null, "frame_number": 3960, "timestamp_epoch": "1583961831.846903000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-939a3216be6757f1ac71d02e", "src_port": null, "tcp_stream": 186, "udp_stream": null, "frame_number": 3961, "timestamp_epoch": "1583961831.847117000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-e73fb5b02f2c3c4c7f25acd2", "src_port": null, "tcp_stream": 186, "udp_stream": null, "frame_number": 3962, "timestamp_epoch": "1583961831.847368000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-d5296732d2be6d57303fca45", "src_port": null, "tcp_stream": 186, "udp_stream": null, "frame_number": 3963, "timestamp_epoch": "1583961831.847613000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "0", "ldap.baseObject": "cn=policies,cn=system,DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-bfccb1aad4d2fef6c437cfbf", "src_port": null, "tcp_stream": 185, "udp_stream": null, "frame_number": 3964, "timestamp_epoch": "1583961831.848536000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-03cd74344f777f2576a8c13f", "src_port": null, "tcp_stream": 185, "udp_stream": null, "frame_number": 3965, "timestamp_epoch": "1583961831.848955000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-c3e0c881fc5a7c2a0283e0a0", "src_port": null, "tcp_stream": 186, "udp_stream": null, "frame_number": 3971, "timestamp_epoch": "1583961832.169381000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-b3e39b41711f754b2551cfc1", "src_port": null, "tcp_stream": 185, "udp_stream": null, "frame_number": 3973, "timestamp_epoch": "1583961832.196399000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-28a2d0ff2f20390dfe091752", "src_port": null, "tcp_stream": 194, "udp_stream": null, "frame_number": 4193, "timestamp_epoch": "1583961844.416717000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-be3e657305794b125b6d5816", "src_port": null, "tcp_stream": 194, "udp_stream": null, "frame_number": 4194, "timestamp_epoch": "1583961844.417123000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-bb365ee6369d2cbdc7d23252", "src_port": null, "tcp_stream": 194, "udp_stream": null, "frame_number": 4195, "timestamp_epoch": "1583961844.417694000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-2bea0789009c9b19307b7252", "src_port": null, "tcp_stream": 194, "udp_stream": null, "frame_number": 4196, "timestamp_epoch": "1583961844.418233000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-40215f52f8136cb616ee1112", "src_port": null, "tcp_stream": 194, "udp_stream": null, "frame_number": 4197, "timestamp_epoch": "1583961844.418646000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-9bf029789782570b88452bb8", "src_port": null, "tcp_stream": 194, "udp_stream": null, "frame_number": 4198, "timestamp_epoch": "1583961844.418921000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-98aa02e3ed218ffa80a6b018", "src_port": null, "tcp_stream": 194, "udp_stream": null, "frame_number": 4201, "timestamp_epoch": "1583961844.420285000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-27020e328c6b28ff4985c30a", "src_port": null, "tcp_stream": 194, "udp_stream": null, "frame_number": 4202, "timestamp_epoch": "1583961844.420494000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-b67b1cfbc8318b1d7792f69d", "src_port": null, "tcp_stream": 194, "udp_stream": null, "frame_number": 4203, "timestamp_epoch": "1583961844.420973000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-e9fe91fc472f07d550d3af2d", "src_port": null, "tcp_stream": 194, "udp_stream": null, "frame_number": 4204, "timestamp_epoch": "1583961844.421326000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-1f3319f7137a41a522c1bcfd", "src_port": null, "tcp_stream": 194, "udp_stream": null, "frame_number": 4205, "timestamp_epoch": "1583961844.421515000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-b0b482d978c20f310cb3ec43", "src_port": null, "tcp_stream": 194, "udp_stream": null, "frame_number": 4206, "timestamp_epoch": "1583961844.421661000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-3c0aaf70431e54b1b593fa0a", "src_port": null, "tcp_stream": 195, "udp_stream": null, "frame_number": 4210, "timestamp_epoch": "1583961844.423709000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-adb907153da519c77f152b99", "src_port": null, "tcp_stream": 195, "udp_stream": null, "frame_number": 4212, "timestamp_epoch": "1583961844.424153000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-5682709373efbf26e68c69e4", "src_port": null, "tcp_stream": 195, "udp_stream": null, "frame_number": 4215, "timestamp_epoch": "1583961844.425286000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-af6786c68a100a45001ee319", "src_port": null, "tcp_stream": 195, "udp_stream": null, "frame_number": 4217, "timestamp_epoch": "1583961844.426089000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=LAPTOP-I9ZPI04,CN=Computers,DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-c855bb43232d13fa6455c9bb", "src_port": null, "tcp_stream": 195, "udp_stream": null, "frame_number": 4218, "timestamp_epoch": "1583961844.426516000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-e6fac4e493109195c507be94", "src_port": null, "tcp_stream": 195, "udp_stream": null, "frame_number": 4219, "timestamp_epoch": "1583961844.426852000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=LAPTOP-I9ZPI04,CN=Computers,DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-7f272ef403ea9d90caa3290a", "src_port": null, "tcp_stream": 195, "udp_stream": null, "frame_number": 4220, "timestamp_epoch": "1583961844.429266000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-a1342f9f1c9a2a3d6fccb2b5", "src_port": null, "tcp_stream": 195, "udp_stream": null, "frame_number": 4221, "timestamp_epoch": "1583961844.429563000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=LAPTOP-I9ZPI04,CN=Computers,DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-99320593f9375c219e36c6f2", "src_port": null, "tcp_stream": 195, "udp_stream": null, "frame_number": 4222, "timestamp_epoch": "1583961844.429899000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-91b5ef0a13a8b36020cd3327", "src_port": null, "tcp_stream": 195, "udp_stream": null, "frame_number": 4223, "timestamp_epoch": "1583961844.430249000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-0e15f4088d86514bc54f68be", "src_port": null, "tcp_stream": 196, "udp_stream": null, "frame_number": 4228, "timestamp_epoch": "1583961844.433816000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-071030db41b1825b1f04f1ef", "src_port": null, "tcp_stream": 196, "udp_stream": null, "frame_number": 4230, "timestamp_epoch": "1583961844.434551000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-0079260c0c6cfca0c4829e1c", "src_port": null, "tcp_stream": 196, "udp_stream": null, "frame_number": 4231, "timestamp_epoch": "1583961844.435291000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-17a4453554259c10fe9979b1", "src_port": null, "tcp_stream": 196, "udp_stream": null, "frame_number": 4234, "timestamp_epoch": "1583961844.435638000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=62a0ff2e-97b9-4513-943f-0d221bd30080,CN=Device Registration Configuration,CN=services,CN=Configuration,DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-6871e1935615c2ae3176180a", "src_port": null, "tcp_stream": 196, "udp_stream": null, "frame_number": 4236, "timestamp_epoch": "1583961844.436425000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-89a5ae8de549d2c1cdf03d03", "src_port": null, "tcp_stream": 196, "udp_stream": null, "frame_number": 4237, "timestamp_epoch": "1583961844.436723000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-6f6c66d8371c1f1711898d14", "src_port": null, "tcp_stream": 196, "udp_stream": null, "frame_number": 4238, "timestamp_epoch": "1583961844.436967000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-d945646c405c0e00f8b7ff00", "src_port": null, "tcp_stream": 195, "udp_stream": null, "frame_number": 4242, "timestamp_epoch": "1583961844.437351000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-fabf866b8b3a45e23555903a", "src_port": null, "tcp_stream": 252, "udp_stream": null, "frame_number": 8082, "timestamp_epoch": "1583961870.372726000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-6066a80851f9a115dbcc25d1", "src_port": null, "tcp_stream": 252, "udp_stream": null, "frame_number": 8083, "timestamp_epoch": "1583961870.373035000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-c87d118a58486ec310737009", "src_port": null, "tcp_stream": 252, "udp_stream": null, "frame_number": 8084, "timestamp_epoch": "1583961870.373270000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-465e34db681eb0f8116fa335", "src_port": null, "tcp_stream": 252, "udp_stream": null, "frame_number": 8085, "timestamp_epoch": "1583961870.373867000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-8334384fea3013f5cab8f5bc", "src_port": null, "tcp_stream": 252, "udp_stream": null, "frame_number": 8086, "timestamp_epoch": "1583961870.374795000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-5a0c291b1de9497e66950e00", "src_port": null, "tcp_stream": 252, "udp_stream": null, "frame_number": 8087, "timestamp_epoch": "1583961870.375101000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-466071cb4df42f8e2e259acf", "src_port": null, "tcp_stream": 252, "udp_stream": null, "frame_number": 8090, "timestamp_epoch": "1583961870.377360000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-41737d636ad0385d6e755ede", "src_port": null, "tcp_stream": 252, "udp_stream": null, "frame_number": 8091, "timestamp_epoch": "1583961870.377608000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-9753c9af4b04a64dec56aeab", "src_port": null, "tcp_stream": 252, "udp_stream": null, "frame_number": 8092, "timestamp_epoch": "1583961870.377811000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-a94b5bd179760b7c5cb37ce4", "src_port": null, "tcp_stream": 252, "udp_stream": null, "frame_number": 8093, "timestamp_epoch": "1583961870.378222000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-5b5f6a596fa8dac32931cb2c", "src_port": null, "tcp_stream": 252, "udp_stream": null, "frame_number": 8094, "timestamp_epoch": "1583961870.378445000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-c40b9267a9bfd4d0a838a031", "src_port": null, "tcp_stream": 252, "udp_stream": null, "frame_number": 8095, "timestamp_epoch": "1583961870.378643000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-964c5bd3a5cb07aa3f1c02fc", "src_port": null, "tcp_stream": 253, "udp_stream": null, "frame_number": 8099, "timestamp_epoch": "1583961870.382479000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-bb3a5bc90a45488fd503050f", "src_port": null, "tcp_stream": 253, "udp_stream": null, "frame_number": 8101, "timestamp_epoch": "1583961870.382896000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-7ca82f46b38e3ea276dcd9a7", "src_port": null, "tcp_stream": 253, "udp_stream": null, "frame_number": 8104, "timestamp_epoch": "1583961870.385349000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-7544828a94552bcb47b18532", "src_port": null, "tcp_stream": 253, "udp_stream": null, "frame_number": 8106, "timestamp_epoch": "1583961870.386372000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=LAPTOP-7XMV2SN,CN=Computers,DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-77fa27e14ecfd0588fcceb10", "src_port": null, "tcp_stream": 253, "udp_stream": null, "frame_number": 8107, "timestamp_epoch": "1583961870.387213000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-90f5c2f8401fe6ba5d8a563f", "src_port": null, "tcp_stream": 253, "udp_stream": null, "frame_number": 8108, "timestamp_epoch": "1583961870.387808000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=LAPTOP-7XMV2SN,CN=Computers,DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-43162b18ce3067f3f969dc00", "src_port": null, "tcp_stream": 253, "udp_stream": null, "frame_number": 8109, "timestamp_epoch": "1583961870.388261000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-4baaa66340ce349f24ff7464", "src_port": null, "tcp_stream": 253, "udp_stream": null, "frame_number": 8110, "timestamp_epoch": "1583961870.388572000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=LAPTOP-7XMV2SN,CN=Computers,DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-6df8a95b428ec40efd11f84a", "src_port": null, "tcp_stream": 253, "udp_stream": null, "frame_number": 8111, "timestamp_epoch": "1583961870.388851000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-c24c61f70d0b6b0bc7240201", "src_port": null, "tcp_stream": 253, "udp_stream": null, "frame_number": 8112, "timestamp_epoch": "1583961870.389176000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-c3a8de9c7888d9186758295d", "src_port": null, "tcp_stream": 254, "udp_stream": null, "frame_number": 8117, "timestamp_epoch": "1583961870.395969000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-2d4b63b10c83030e522399ae", "src_port": null, "tcp_stream": 254, "udp_stream": null, "frame_number": 8119, "timestamp_epoch": "1583961870.397293000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-b3f4ef5ce1ab4e8d2633c422", "src_port": null, "tcp_stream": 254, "udp_stream": null, "frame_number": 8120, "timestamp_epoch": "1583961870.398074000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-8fd966bd0b37a802de626e0f", "src_port": null, "tcp_stream": 254, "udp_stream": null, "frame_number": 8123, "timestamp_epoch": "1583961870.398442000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=62a0ff2e-97b9-4513-943f-0d221bd30080,CN=Device Registration Configuration,CN=services,CN=Configuration,DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-cfeea3a6139b6e375147af6e", "src_port": null, "tcp_stream": 254, "udp_stream": null, "frame_number": 8125, "timestamp_epoch": "1583961870.399053000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-1b59dce2d96392ec4c99205a", "src_port": null, "tcp_stream": 254, "udp_stream": null, "frame_number": 8126, "timestamp_epoch": "1583961870.399308000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-a2bb81951a03e634c504709d", "src_port": null, "tcp_stream": 254, "udp_stream": null, "frame_number": 8127, "timestamp_epoch": "1583961870.399611000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-7c3ee9aebe51613e09c1acf7", "src_port": null, "tcp_stream": 253, "udp_stream": null, "frame_number": 8129, "timestamp_epoch": "1583961870.400009000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-be16fd0970493f635ccbd719", "src_port": null, "tcp_stream": 256, "udp_stream": null, "frame_number": 8270, "timestamp_epoch": "1583961872.519985000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-661e940d9da966edebe8db54", "src_port": null, "tcp_stream": 256, "udp_stream": null, "frame_number": 8275, "timestamp_epoch": "1583961872.520588000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-de9b1ff5b5f3e35b70b64eb9", "src_port": null, "tcp_stream": 256, "udp_stream": null, "frame_number": 8290, "timestamp_epoch": "1583961872.527613000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-c863915c213ecd65d9020e46", "src_port": null, "tcp_stream": 256, "udp_stream": null, "frame_number": 8295, "timestamp_epoch": "1583961872.528719000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-7c74075cdb7e57a7fa7e59b3", "src_port": null, "tcp_stream": 256, "udp_stream": null, "frame_number": 8306, "timestamp_epoch": "1583961872.543878000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-f590f4e68dd8a87bd9ef2c8e", "src_port": null, "tcp_stream": 256, "udp_stream": null, "frame_number": 8307, "timestamp_epoch": "1583961872.544564000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-b3882e0968763432d474c913", "src_port": null, "tcp_stream": 256, "udp_stream": null, "frame_number": 8308, "timestamp_epoch": "1583961872.551421000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-b02c4114804ebbaeb37ec41f", "src_port": null, "tcp_stream": 264, "udp_stream": null, "frame_number": 9758, "timestamp_epoch": "1583961892.421132000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-a14acc58a9a5567ff5fdbc29", "src_port": null, "tcp_stream": 264, "udp_stream": null, "frame_number": 9759, "timestamp_epoch": "1583961892.421650000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-83da61a1059f77b569a17a99", "src_port": null, "tcp_stream": 264, "udp_stream": null, "frame_number": 9760, "timestamp_epoch": "1583961892.422611000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-c41dd7c2ed34abc8aba9fa5a", "src_port": null, "tcp_stream": 264, "udp_stream": null, "frame_number": 9761, "timestamp_epoch": "1583961892.423110000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-0b56a5b835b000b07ca7dba3", "src_port": null, "tcp_stream": 264, "udp_stream": null, "frame_number": 9762, "timestamp_epoch": "1583961892.423479000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-531676f67c7b082451c307bb", "src_port": null, "tcp_stream": 264, "udp_stream": null, "frame_number": 9763, "timestamp_epoch": "1583961892.423686000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-8fe3c3011d1d1bf81bb7a10e", "src_port": null, "tcp_stream": 264, "udp_stream": null, "frame_number": 9766, "timestamp_epoch": "1583961892.425775000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-798d681c7c53322b445c94e3", "src_port": null, "tcp_stream": 264, "udp_stream": null, "frame_number": 9767, "timestamp_epoch": "1583961892.426157000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-1a3961d4ec1051921221381a", "src_port": null, "tcp_stream": 264, "udp_stream": null, "frame_number": 9768, "timestamp_epoch": "1583961892.426539000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-e56e9574b77593d6dc6d71f1", "src_port": null, "tcp_stream": 264, "udp_stream": null, "frame_number": 9769, "timestamp_epoch": "1583961892.426999000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-9b5b51bf6d0d2d90ade2363a", "src_port": null, "tcp_stream": 264, "udp_stream": null, "frame_number": 9770, "timestamp_epoch": "1583961892.427460000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-75743406f96a2b8534101c19", "src_port": null, "tcp_stream": 264, "udp_stream": null, "frame_number": 9771, "timestamp_epoch": "1583961892.427739000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-fda0989e23a0e1207ad037fb", "src_port": null, "tcp_stream": 265, "udp_stream": null, "frame_number": 9775, "timestamp_epoch": "1583961892.431463000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-7a60e4c3431d0ca7fa2d7e06", "src_port": null, "tcp_stream": 265, "udp_stream": null, "frame_number": 9777, "timestamp_epoch": "1583961892.431876000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-adf62d5d5f317eb124c34eea", "src_port": null, "tcp_stream": 265, "udp_stream": null, "frame_number": 9780, "timestamp_epoch": "1583961892.434751000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-57fa7a78b17c94ad9ad9761b", "src_port": null, "tcp_stream": 265, "udp_stream": null, "frame_number": 9782, "timestamp_epoch": "1583961892.435791000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=LAPTOP-SQSA42O,CN=Computers,DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-8220569e5269c62658e29790", "src_port": null, "tcp_stream": 265, "udp_stream": null, "frame_number": 9783, "timestamp_epoch": "1583961892.436700000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-2e9c796718cf3a38f5ea690f", "src_port": null, "tcp_stream": 265, "udp_stream": null, "frame_number": 9784, "timestamp_epoch": "1583961892.437425000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=LAPTOP-SQSA42O,CN=Computers,DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-ffb1d84f33dffa010ef366f1", "src_port": null, "tcp_stream": 265, "udp_stream": null, "frame_number": 9785, "timestamp_epoch": "1583961892.438029000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-246912db99f48c30dff0edf7", "src_port": null, "tcp_stream": 265, "udp_stream": null, "frame_number": 9786, "timestamp_epoch": "1583961892.438452000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=LAPTOP-SQSA42O,CN=Computers,DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-52137a765186959b1f9ebac2", "src_port": null, "tcp_stream": 265, "udp_stream": null, "frame_number": 9787, "timestamp_epoch": "1583961892.439016000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-4a867d146aedd4455cc9944b", "src_port": null, "tcp_stream": 265, "udp_stream": null, "frame_number": 9788, "timestamp_epoch": "1583961892.439360000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-c5a2b33964e457465fbc4a93", "src_port": null, "tcp_stream": 266, "udp_stream": null, "frame_number": 9793, "timestamp_epoch": "1583961892.443657000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-ab11f09a24dbc985bd466b64", "src_port": null, "tcp_stream": 266, "udp_stream": null, "frame_number": 9795, "timestamp_epoch": "1583961892.444997000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-a7bec7308fa0624c7627d826", "src_port": null, "tcp_stream": 266, "udp_stream": null, "frame_number": 9796, "timestamp_epoch": "1583961892.445698000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-f719c8ff01bee3044278a85f", "src_port": null, "tcp_stream": 266, "udp_stream": null, "frame_number": 9799, "timestamp_epoch": "1583961892.446155000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=62a0ff2e-97b9-4513-943f-0d221bd30080,CN=Device Registration Configuration,CN=services,CN=Configuration,DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-7f6d9cd0788834929b4b9b31", "src_port": null, "tcp_stream": 266, "udp_stream": null, "frame_number": 9801, "timestamp_epoch": "1583961892.446682000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-9a939ba1eb392d5f9778f540", "src_port": null, "tcp_stream": 266, "udp_stream": null, "frame_number": 9802, "timestamp_epoch": "1583961892.447053000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-139612c42b34c41aaf20a914", "src_port": null, "tcp_stream": 266, "udp_stream": null, "frame_number": 9803, "timestamp_epoch": "1583961892.447393000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-06cf22664ef59402502ba78d", "src_port": null, "tcp_stream": 265, "udp_stream": null, "frame_number": 9805, "timestamp_epoch": "1583961892.447885000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-db535c7f02458316a55cec2f", "src_port": null, "tcp_stream": 362, "udp_stream": null, "frame_number": 14156, "timestamp_epoch": "1583962055.690792000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-653a0177c5198e4f5f133a2c", "src_port": null, "tcp_stream": 362, "udp_stream": null, "frame_number": 14157, "timestamp_epoch": "1583962055.691210000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-3902a37a569e21278d19209f", "src_port": null, "tcp_stream": 362, "udp_stream": null, "frame_number": 14158, "timestamp_epoch": "1583962055.691678000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-c1555257b57d759b3add0c2b", "src_port": null, "tcp_stream": 362, "udp_stream": null, "frame_number": 14159, "timestamp_epoch": "1583962055.692021000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-9aad71aa6c3dbeaf1861d503", "src_port": null, "tcp_stream": 362, "udp_stream": null, "frame_number": 14160, "timestamp_epoch": "1583962055.692268000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-be0094b92c4b20acdcec345c", "src_port": null, "tcp_stream": 362, "udp_stream": null, "frame_number": 14161, "timestamp_epoch": "1583962055.692441000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-521310c0215770da4ee7e543", "src_port": null, "tcp_stream": 362, "udp_stream": null, "frame_number": 14164, "timestamp_epoch": "1583962055.693947000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-4c900d2717e4fd4bc259ea0d", "src_port": null, "tcp_stream": 362, "udp_stream": null, "frame_number": 14165, "timestamp_epoch": "1583962055.694161000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-3519c181ca53f1f2ca47fcb5", "src_port": null, "tcp_stream": 362, "udp_stream": null, "frame_number": 14166, "timestamp_epoch": "1583962055.694403000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-1aa54115850fe35eeb2643cd", "src_port": null, "tcp_stream": 362, "udp_stream": null, "frame_number": 14167, "timestamp_epoch": "1583962055.694740000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-fe2f07a80ab1dda6509f933c", "src_port": null, "tcp_stream": 362, "udp_stream": null, "frame_number": 14168, "timestamp_epoch": "1583962055.694949000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-62f675b7a6e7ef8de8efe8eb", "src_port": null, "tcp_stream": 362, "udp_stream": null, "frame_number": 14169, "timestamp_epoch": "1583962055.695115000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-119d405015ccbdc843ae3800", "src_port": null, "tcp_stream": 363, "udp_stream": null, "frame_number": 14173, "timestamp_epoch": "1583962055.697608000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-45c4e88f85b4a32b8d8236ea", "src_port": null, "tcp_stream": 363, "udp_stream": null, "frame_number": 14175, "timestamp_epoch": "1583962055.697951000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-aab85d38b6c6a692eb85c623", "src_port": null, "tcp_stream": 363, "udp_stream": null, "frame_number": 14178, "timestamp_epoch": "1583962055.699463000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-15b00796d91e89a435a08e33", "src_port": null, "tcp_stream": 363, "udp_stream": null, "frame_number": 14180, "timestamp_epoch": "1583962055.700477000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=LAPTOP-I9ZPI04,CN=Computers,DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-4d5042364ad371b277501605", "src_port": null, "tcp_stream": 363, "udp_stream": null, "frame_number": 14181, "timestamp_epoch": "1583962055.701231000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-4b12cdc8c45034fdfd14c4a0", "src_port": null, "tcp_stream": 363, "udp_stream": null, "frame_number": 14182, "timestamp_epoch": "1583962055.701601000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=LAPTOP-I9ZPI04,CN=Computers,DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-fd715236bfb69777046e8447", "src_port": null, "tcp_stream": 363, "udp_stream": null, "frame_number": 14183, "timestamp_epoch": "1583962055.702016000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-8938bddcd79f224b7561c85c", "src_port": null, "tcp_stream": 363, "udp_stream": null, "frame_number": 14184, "timestamp_epoch": "1583962055.702296000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=LAPTOP-I9ZPI04,CN=Computers,DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-6c6e95d79a7fd958b9b93227", "src_port": null, "tcp_stream": 363, "udp_stream": null, "frame_number": 14185, "timestamp_epoch": "1583962055.702590000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-230f5d6366f91eb0c0262a0c", "src_port": null, "tcp_stream": 363, "udp_stream": null, "frame_number": 14186, "timestamp_epoch": "1583962055.702882000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-8bc8cfaceff766140e84ae9a", "src_port": null, "tcp_stream": 364, "udp_stream": null, "frame_number": 14191, "timestamp_epoch": "1583962055.706933000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-14143f4419b57323fe8dfc57", "src_port": null, "tcp_stream": 364, "udp_stream": null, "frame_number": 14193, "timestamp_epoch": "1583962055.707826000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-311fbdf4b5fd061ba6e31975", "src_port": null, "tcp_stream": 364, "udp_stream": null, "frame_number": 14194, "timestamp_epoch": "1583962055.708515000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-c2082dd48ded51b85472e553", "src_port": null, "tcp_stream": 364, "udp_stream": null, "frame_number": 14197, "timestamp_epoch": "1583962055.708911000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=62a0ff2e-97b9-4513-943f-0d221bd30080,CN=Device Registration Configuration,CN=services,CN=Configuration,DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-3e6fc2cce67554ca035c8d73", "src_port": null, "tcp_stream": 364, "udp_stream": null, "frame_number": 14199, "timestamp_epoch": "1583962055.709276000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-ce582ff7f62d1c264222ea1d", "src_port": null, "tcp_stream": 364, "udp_stream": null, "frame_number": 14200, "timestamp_epoch": "1583962055.709553000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-9315a7d5acfaab001df3aabf", "src_port": null, "tcp_stream": 364, "udp_stream": null, "frame_number": 14201, "timestamp_epoch": "1583962055.709840000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-93da27201655674d768ba362", "src_port": null, "tcp_stream": 363, "udp_stream": null, "frame_number": 14205, "timestamp_epoch": "1583962055.710352000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-4144ded931867d730ec90069", "src_port": null, "tcp_stream": 368, "udp_stream": null, "frame_number": 14362, "timestamp_epoch": "1583962113.814107000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-b5c61b546562e6ab850f154c", "src_port": null, "tcp_stream": 368, "udp_stream": null, "frame_number": 14363, "timestamp_epoch": "1583962113.814360000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-28b7fd7f6d3c0837ad4a1508", "src_port": null, "tcp_stream": 368, "udp_stream": null, "frame_number": 14364, "timestamp_epoch": "1583962113.814709000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-ebe6e3a2eb4e45004936ee84", "src_port": null, "tcp_stream": 368, "udp_stream": null, "frame_number": 14365, "timestamp_epoch": "1583962113.814997000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-0f7d7e5040bf04688e0503b7", "src_port": null, "tcp_stream": 368, "udp_stream": null, "frame_number": 14366, "timestamp_epoch": "1583962113.815215000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-5f1cb3b4bbe0576c0f285450", "src_port": null, "tcp_stream": 368, "udp_stream": null, "frame_number": 14367, "timestamp_epoch": "1583962113.815359000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-3dcfce5e7c87a405bab1d2e0", "src_port": null, "tcp_stream": 368, "udp_stream": null, "frame_number": 14370, "timestamp_epoch": "1583962113.817104000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-e2eda27c956e758719e50251", "src_port": null, "tcp_stream": 368, "udp_stream": null, "frame_number": 14371, "timestamp_epoch": "1583962113.817359000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-2fa5cced60425e79656fea8f", "src_port": null, "tcp_stream": 368, "udp_stream": null, "frame_number": 14372, "timestamp_epoch": "1583962113.817650000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-bbcf449342630c1f202f3f4c", "src_port": null, "tcp_stream": 368, "udp_stream": null, "frame_number": 14373, "timestamp_epoch": "1583962113.817936000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-e33df040922b2531eb986bdb", "src_port": null, "tcp_stream": 368, "udp_stream": null, "frame_number": 14374, "timestamp_epoch": "1583962113.818170000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-39b0236ce2b4daf4f8e01678", "src_port": null, "tcp_stream": 368, "udp_stream": null, "frame_number": 14375, "timestamp_epoch": "1583962113.818335000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-155eae9803572ff9a3bcbed9", "src_port": null, "tcp_stream": 369, "udp_stream": null, "frame_number": 14379, "timestamp_epoch": "1583962113.820662000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-8b5d5b824f17166c4ba5fa6b", "src_port": null, "tcp_stream": 369, "udp_stream": null, "frame_number": 14381, "timestamp_epoch": "1583962113.820995000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-84be4aa0cbff7f356f5595e0", "src_port": null, "tcp_stream": 369, "udp_stream": null, "frame_number": 14384, "timestamp_epoch": "1583962113.822029000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-3e829a856370f8e1a79722fa", "src_port": null, "tcp_stream": 369, "udp_stream": null, "frame_number": 14386, "timestamp_epoch": "1583962113.822829000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=LAPTOP-SQSA42O,CN=Computers,DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-43ef0689927a1d0eba244f4a", "src_port": null, "tcp_stream": 369, "udp_stream": null, "frame_number": 14387, "timestamp_epoch": "1583962113.823356000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-c125665936cc288a85808a52", "src_port": null, "tcp_stream": 369, "udp_stream": null, "frame_number": 14388, "timestamp_epoch": "1583962113.823619000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=LAPTOP-SQSA42O,CN=Computers,DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-09ffd861e0d278a501192130", "src_port": null, "tcp_stream": 369, "udp_stream": null, "frame_number": 14389, "timestamp_epoch": "1583962113.823921000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-5811f6ad1dd2a1fbbffdcc28", "src_port": null, "tcp_stream": 369, "udp_stream": null, "frame_number": 14390, "timestamp_epoch": "1583962113.824116000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=LAPTOP-SQSA42O,CN=Computers,DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-085a055aeca51d3cf512cbef", "src_port": null, "tcp_stream": 369, "udp_stream": null, "frame_number": 14391, "timestamp_epoch": "1583962113.824435000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-7ef6659064b5f1dc70843bc4", "src_port": null, "tcp_stream": 369, "udp_stream": null, "frame_number": 14392, "timestamp_epoch": "1583962113.824650000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-577aa78ccf2a6a39ea4fe82d", "src_port": null, "tcp_stream": 370, "udp_stream": null, "frame_number": 14397, "timestamp_epoch": "1583962113.827952000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-c0703348dc656c321f161fa0", "src_port": null, "tcp_stream": 370, "udp_stream": null, "frame_number": 14399, "timestamp_epoch": "1583962113.828884000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-6f1fcaa080e6c4eab27bd954", "src_port": null, "tcp_stream": 370, "udp_stream": null, "frame_number": 14400, "timestamp_epoch": "1583962113.829454000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-9706b7cdc619ee178416d4d9", "src_port": null, "tcp_stream": 370, "udp_stream": null, "frame_number": 14403, "timestamp_epoch": "1583962113.829823000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=62a0ff2e-97b9-4513-943f-0d221bd30080,CN=Device Registration Configuration,CN=services,CN=Configuration,DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-2b95abfb642377edd10d63fc", "src_port": null, "tcp_stream": 370, "udp_stream": null, "frame_number": 14405, "timestamp_epoch": "1583962113.830464000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-092c523b6d5c449f04824b13", "src_port": null, "tcp_stream": 370, "udp_stream": null, "frame_number": 14406, "timestamp_epoch": "1583962113.830735000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-321fe54627c81d5226214eff", "src_port": null, "tcp_stream": 370, "udp_stream": null, "frame_number": 14407, "timestamp_epoch": "1583962113.831229000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-055b6ca5fc0b96ad4a76a2d1", "src_port": null, "tcp_stream": 369, "udp_stream": null, "frame_number": 14411, "timestamp_epoch": "1583962113.831928000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-d99fba8515129698fd06280e", "src_port": null, "tcp_stream": 404, "udp_stream": null, "frame_number": 15673, "timestamp_epoch": "1583962386.801974000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-5c075505151d6eeaea117989", "src_port": null, "tcp_stream": 404, "udp_stream": null, "frame_number": 15675, "timestamp_epoch": "1583962386.803046000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-61d9b80907043670c4cd92e9", "src_port": null, "tcp_stream": 404, "udp_stream": null, "frame_number": 15676, "timestamp_epoch": "1583962386.803655000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-903bfa12cef97a8495996818", "src_port": null, "tcp_stream": 411, "udp_stream": null, "frame_number": 16098, "timestamp_epoch": "1583962433.467839000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-97694501f4588407f2542052", "src_port": null, "tcp_stream": 411, "udp_stream": null, "frame_number": 16100, "timestamp_epoch": "1583962433.468702000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-2e7b0e8c380856f21f8bbb04", "src_port": null, "tcp_stream": 411, "udp_stream": null, "frame_number": 16101, "timestamp_epoch": "1583962433.469243000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-d57b1cbfb918e1d62f861ec6", "src_port": null, "tcp_stream": 416, "udp_stream": null, "frame_number": 16363, "timestamp_epoch": "1583962545.040157000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-2a4c8a1507139fb9bdb0b610", "src_port": null, "tcp_stream": 416, "udp_stream": null, "frame_number": 16365, "timestamp_epoch": "1583962545.040990000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-bff96cc693df783ed5261cd6", "src_port": null, "tcp_stream": 416, "udp_stream": null, "frame_number": 16366, "timestamp_epoch": "1583962545.041591000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-a1b4bf74ca4be4ba9cb50df0", "src_port": null, "tcp_stream": 452, "udp_stream": null, "frame_number": 20151, "timestamp_epoch": "1583962619.267995000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-aba2324739bf4a8e3b2c1ec5", "src_port": null, "tcp_stream": 452, "udp_stream": null, "frame_number": 20152, "timestamp_epoch": "1583962619.268369000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-4c97d25ffac39aa513da1083", "src_port": null, "tcp_stream": 452, "udp_stream": null, "frame_number": 20153, "timestamp_epoch": "1583962619.268758000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-047c4b9d570bfa3a41a44745", "src_port": null, "tcp_stream": 452, "udp_stream": null, "frame_number": 20154, "timestamp_epoch": "1583962619.269105000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-4276ac239acf7c7f0cdc73f2", "src_port": null, "tcp_stream": 452, "udp_stream": null, "frame_number": 20155, "timestamp_epoch": "1583962619.269393000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-4559628cb50be008ed01e4f2", "src_port": null, "tcp_stream": 452, "udp_stream": null, "frame_number": 20156, "timestamp_epoch": "1583962619.269568000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-01d9cc29bdcbe13fcf656cac", "src_port": null, "tcp_stream": 452, "udp_stream": null, "frame_number": 20159, "timestamp_epoch": "1583962619.271329000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-e5923afad3af74e929c6bbb3", "src_port": null, "tcp_stream": 452, "udp_stream": null, "frame_number": 20160, "timestamp_epoch": "1583962619.271595000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-4cfec4d9310a45fa3dc8d9f5", "src_port": null, "tcp_stream": 452, "udp_stream": null, "frame_number": 20161, "timestamp_epoch": "1583962619.272078000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-78f2a80e953be7e18ce61e64", "src_port": null, "tcp_stream": 452, "udp_stream": null, "frame_number": 20162, "timestamp_epoch": "1583962619.272812000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-51156156054daea22646eb70", "src_port": null, "tcp_stream": 452, "udp_stream": null, "frame_number": 20163, "timestamp_epoch": "1583962619.273165000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-05d2ffe9431fc814564aec10", "src_port": null, "tcp_stream": 452, "udp_stream": null, "frame_number": 20164, "timestamp_epoch": "1583962619.273440000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-faaf098f4375eda0f42ccf0b", "src_port": null, "tcp_stream": 456, "udp_stream": null, "frame_number": 20168, "timestamp_epoch": "1583962619.287451000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-4051ebe9934aa7781846fd2c", "src_port": null, "tcp_stream": 456, "udp_stream": null, "frame_number": 20170, "timestamp_epoch": "1583962619.287783000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-3b1d383ea9cc78cf44fbad22", "src_port": null, "tcp_stream": 456, "udp_stream": null, "frame_number": 20185, "timestamp_epoch": "1583962619.290624000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-ffedb8155a9f50066c368aa9", "src_port": null, "tcp_stream": 456, "udp_stream": null, "frame_number": 20187, "timestamp_epoch": "1583962619.291429000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-c9fc7ce7dbf426d38be1869e", "src_port": null, "tcp_stream": 456, "udp_stream": null, "frame_number": 20188, "timestamp_epoch": "1583962619.295464000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-410f0b98fb2d74b4ffd2d0a7", "src_port": null, "tcp_stream": 456, "udp_stream": null, "frame_number": 20189, "timestamp_epoch": "1583962619.295761000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-f04f50c62a5dc2758978babe", "src_port": null, "tcp_stream": 456, "udp_stream": null, "frame_number": 20191, "timestamp_epoch": "1583962619.297040000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-5b55777f077a60d1a5ac4324", "src_port": null, "tcp_stream": 456, "udp_stream": null, "frame_number": 20192, "timestamp_epoch": "1583962619.297645000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "3", "ldap.baseObject": "CN=Schema,CN=Configuration,DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-0d9deaace73d41e5b7129c01", "src_port": null, "tcp_stream": 456, "udp_stream": null, "frame_number": 20193, "timestamp_epoch": "1583962619.298206000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-b1f6b919b7108b1762c28d0f", "src_port": null, "tcp_stream": 456, "udp_stream": null, "frame_number": 20194, "timestamp_epoch": "1583962619.298479000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "3", "ldap.baseObject": "CN=Schema,CN=Configuration,DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-d86c1c514c6c33c0f99765e9", "src_port": null, "tcp_stream": 456, "udp_stream": null, "frame_number": 20195, "timestamp_epoch": "1583962619.298801000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-628a107d569022138a78d1eb", "src_port": null, "tcp_stream": 456, "udp_stream": null, "frame_number": 20196, "timestamp_epoch": "1583962619.299010000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=Aggregate,CN=Schema,CN=Configuration,DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-5645f67fe8f0452b9156f496", "src_port": null, "tcp_stream": 456, "udp_stream": null, "frame_number": 20197, "timestamp_epoch": "1583962619.299744000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-5d016948b9f0fb314c3c4e15", "src_port": null, "tcp_stream": 456, "udp_stream": null, "frame_number": 20424, "timestamp_epoch": "1583962619.311116000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-4b527b3fa69ae77cdfab7e84", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20439, "timestamp_epoch": "1583962619.471660000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-4273ab3fe340976d1ff92ca2", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20441, "timestamp_epoch": "1583962619.472073000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-796714b21f31b3015356fc25", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20444, "timestamp_epoch": "1583962619.473010000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-cc8b14d19523029f4e6d0b01", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20446, "timestamp_epoch": "1583962619.473746000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-de214055420d8a75566f56f5", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20447, "timestamp_epoch": "1583962619.474180000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-31d114c8502fe1888f51fe13", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20448, "timestamp_epoch": "1583962619.474372000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-dc698c4133d91704350d3f2d", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20449, "timestamp_epoch": "1583962619.474675000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-fbd5c2ae4b72f4ce2aeda7c3", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20450, "timestamp_epoch": "1583962619.474891000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-54a86158630a7073a3947fec", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20451, "timestamp_epoch": "1583962619.475212000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-836aec0d9107b434d138a013", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20452, "timestamp_epoch": "1583962619.475406000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-e4cf00e13497b2148813e9e8", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20453, "timestamp_epoch": "1583962619.475806000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-f2f92d02471a323ae3cad21b", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20455, "timestamp_epoch": "1583962619.476852000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-4a24ff9041961dcb6825ff58", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20457, "timestamp_epoch": "1583962619.479248000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-3c72152731e50268fd68527e", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20458, "timestamp_epoch": "1583962619.479533000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-481aa0e28eae4d5dd75bf578", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20459, "timestamp_epoch": "1583962619.479867000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-072d5af1ec6c02bf85995dab", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20460, "timestamp_epoch": "1583962619.480020000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-51d7a4c86bc97b0c1e26fdac", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20461, "timestamp_epoch": "1583962619.480275000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-620588aa77c75b3042f9abfb", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20462, "timestamp_epoch": "1583962619.480482000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-dbe3e8499c5e2afbb77a9609", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20463, "timestamp_epoch": "1583962619.480785000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-a0b95e313aedcea2cd066091", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20465, "timestamp_epoch": "1583962619.481219000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-46198b59aedcc08bbd274e31", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20467, "timestamp_epoch": "1583962619.481935000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-0e1a21021dc5cf5b0296b84a", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20468, "timestamp_epoch": "1583962619.482270000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-9bbdfa3396016a18546d66de", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20469, "timestamp_epoch": "1583962619.482603000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-ddb57a5e5e684803d3e18a97", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20470, "timestamp_epoch": "1583962619.482799000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-ef3b81b0cd09e8f713b7760f", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20471, "timestamp_epoch": "1583962619.483026000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-b1f808aeaeb6293bcc21daa4", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20472, "timestamp_epoch": "1583962619.483245000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-5c4f5648468b12f4938ed716", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20473, "timestamp_epoch": "1583962619.483490000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-f017e4ade038da6833286128", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20475, "timestamp_epoch": "1583962619.483984000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-13fa00d0d27f64ab039b9eb5", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20477, "timestamp_epoch": "1583962619.484662000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-f7490b632048b5972146dec3", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20478, "timestamp_epoch": "1583962619.485033000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-91f4ce261fd889ffa4920489", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20479, "timestamp_epoch": "1583962619.485429000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-6f1ef6ff0649bbeaa88e3480", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20480, "timestamp_epoch": "1583962619.485613000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-860891db6fd6e6dfb7e461e7", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20481, "timestamp_epoch": "1583962619.485835000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-b6e08551be008c62fd7a82f4", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20482, "timestamp_epoch": "1583962619.486039000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-cf8b3f6e5a606ffc8436e210", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20483, "timestamp_epoch": "1583962619.486354000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-ee21a8d11dcf9bd8b14eb6af", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20485, "timestamp_epoch": "1583962619.487174000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-8a3c3e88cc27f2d5bb8e11a2", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20487, "timestamp_epoch": "1583962619.487894000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-a34d517f5bd3595a7d9729cb", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20488, "timestamp_epoch": "1583962619.488248000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-948d06cc7e87b1ed6fa44914", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20489, "timestamp_epoch": "1583962619.488531000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-ca922543b6560eb5df6860d3", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20490, "timestamp_epoch": "1583962619.488692000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-5db60040ce32b6fcebf3226a", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20491, "timestamp_epoch": "1583962619.488905000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-ec61741937a400b009d0959b", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20492, "timestamp_epoch": "1583962619.489096000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-a7b689b2b251d09ba72c3597", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20493, "timestamp_epoch": "1583962619.489362000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-41941c043e7e0e7c8996e839", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20495, "timestamp_epoch": "1583962619.489867000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-630d4cf9b4408c12ee57b9e2", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20497, "timestamp_epoch": "1583962619.490600000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-82d2b7592ff7596f8f24aae3", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20498, "timestamp_epoch": "1583962619.490906000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-5603e397e71f6e88b5218e67", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20499, "timestamp_epoch": "1583962619.491234000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-16fe330257a9c49602ce1f06", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20500, "timestamp_epoch": "1583962619.491366000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-70eac7d3735b0d6e1eb90596", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20501, "timestamp_epoch": "1583962619.491538000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-7b4a0b748af0336ffe734d84", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20502, "timestamp_epoch": "1583962619.491737000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-b69452774c93e6ed06d9a013", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20503, "timestamp_epoch": "1583962619.492041000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-2b8cf368b460ec10635d5246", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20505, "timestamp_epoch": "1583962619.492496000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-5fcea6973bbfef10a0471144", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20507, "timestamp_epoch": "1583962619.493186000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-354d7f4eea338d87ae6900e2", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20508, "timestamp_epoch": "1583962619.493553000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-1f14dd0e55c36e134604d2fa", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20509, "timestamp_epoch": "1583962619.493839000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-e23fad69f62e515f0a4c60cc", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20510, "timestamp_epoch": "1583962619.494006000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-33456c63e8717674ab2c4343", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20511, "timestamp_epoch": "1583962619.494208000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-55952e5f02bbc883c98a8a6a", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20512, "timestamp_epoch": "1583962619.494387000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-8285ea21266d5809e44d48da", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20513, "timestamp_epoch": "1583962619.494672000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-d7a939f2f3e948a56dbab8a8", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20515, "timestamp_epoch": "1583962619.495184000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-f517416d8a1b6982beb27d49", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20517, "timestamp_epoch": "1583962619.495826000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-6da3dde671620f8b8cb9ae9a", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20518, "timestamp_epoch": "1583962619.496175000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-6ca77a093bc042824a7dbd6f", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20519, "timestamp_epoch": "1583962619.496453000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-20816517c5c2436bf5de86e6", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20520, "timestamp_epoch": "1583962619.496608000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-957cdc63509570873300a82f", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20521, "timestamp_epoch": "1583962619.496856000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-268bef21c066bc1fe2d2646e", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20522, "timestamp_epoch": "1583962619.497091000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-749cd4f47575bf435d44c734", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20523, "timestamp_epoch": "1583962619.497360000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-7978f5c2d0095d46406f972e", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20525, "timestamp_epoch": "1583962619.497945000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-3d3f4fddc8a1fee9746ff047", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20527, "timestamp_epoch": "1583962619.498599000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-0a166787695d2c8f15982ae5", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20528, "timestamp_epoch": "1583962619.498848000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-9a797889bf1ff9a92d12ca90", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20529, "timestamp_epoch": "1583962619.499228000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-420dec3e2530c25efee75e96", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20530, "timestamp_epoch": "1583962619.499464000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-e62086dc4d324c119be608db", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20531, "timestamp_epoch": "1583962619.499672000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-77d2cce3c143fa2d34bda445", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20532, "timestamp_epoch": "1583962619.499859000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-e19d9f8b315cfca8ce284c7a", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20533, "timestamp_epoch": "1583962619.500092000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-1de69441a6c2ab354b9d6369", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20535, "timestamp_epoch": "1583962619.500552000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-35bc5fc69a57035f3d50dc1b", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20537, "timestamp_epoch": "1583962619.501213000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-95022d4d650c4d53c5c13b33", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20538, "timestamp_epoch": "1583962619.501552000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-cd909c2866489aa69502d9e3", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20539, "timestamp_epoch": "1583962619.501905000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-999c90856a20fb02b1274343", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20540, "timestamp_epoch": "1583962619.502185000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-d681cc4c48aa2497ccd39689", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20541, "timestamp_epoch": "1583962619.502489000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-cb802867b04fa3279474a222", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20542, "timestamp_epoch": "1583962619.502774000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-cbc9da03b68f4754518cc2eb", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20543, "timestamp_epoch": "1583962619.503063000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-a763f4fc6ee1b327af3cea6b", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20545, "timestamp_epoch": "1583962619.503520000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-25206ae975e9bc9cbd0fef41", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20547, "timestamp_epoch": "1583962619.504153000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-98ff2503eed51402fda88eb8", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20548, "timestamp_epoch": "1583962619.504406000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-16952396bed77b0bda5ac0c8", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20549, "timestamp_epoch": "1583962619.504673000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-92bae8239b61ae475513efde", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20550, "timestamp_epoch": "1583962619.504820000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-a1bd588af6c21c2d057c570d", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20551, "timestamp_epoch": "1583962619.505024000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-dcb88bfeb447a511a27b9297", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20552, "timestamp_epoch": "1583962619.505189000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-32784144b9fcfbb4796b997b", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20553, "timestamp_epoch": "1583962619.505427000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-d793ff74e29babc36d200c6a", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20555, "timestamp_epoch": "1583962619.505850000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-c620dee8f87d6b6d44670e68", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20557, "timestamp_epoch": "1583962619.506455000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-72843f1e169e0e688e7e7340", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20558, "timestamp_epoch": "1583962619.506742000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-127bac152102a5369e6c4051", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20559, "timestamp_epoch": "1583962619.506979000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-1efe15a9d7f3f77d4a4d928a", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20560, "timestamp_epoch": "1583962619.507133000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-c9185913e255d16e142c4a03", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20561, "timestamp_epoch": "1583962619.507340000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-540dc3a5da4a8ba48190de31", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20562, "timestamp_epoch": "1583962619.507508000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-ba3ba238f2a38ae30e023249", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20563, "timestamp_epoch": "1583962619.507737000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-0c6247e4d12a5418e4d3e51e", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20565, "timestamp_epoch": "1583962619.508210000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-635c172a6ce9fe1f1755d733", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20567, "timestamp_epoch": "1583962619.508783000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-17a9206ea843616f790ad697", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20568, "timestamp_epoch": "1583962619.509061000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-93adad1e23b8e92a4c99ae96", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20569, "timestamp_epoch": "1583962619.509320000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-1cab23bb3f8a999594753a42", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20570, "timestamp_epoch": "1583962619.509438000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-2589a6d429f72a40ed559bcc", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20571, "timestamp_epoch": "1583962619.509606000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-0081802cb94a9b6b2a6cc95e", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20572, "timestamp_epoch": "1583962619.509790000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-baed620024c42431aa4c6f42", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20573, "timestamp_epoch": "1583962619.510019000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-349c8d489ce850e7ea6ed4a2", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20575, "timestamp_epoch": "1583962619.510466000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-9f4388eaaf606c565bdd4728", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20577, "timestamp_epoch": "1583962619.511092000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-018f85890448fe14d9ff60f8", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20578, "timestamp_epoch": "1583962619.511296000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-a2fa63cff5028dc0a8911088", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20579, "timestamp_epoch": "1583962619.511529000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-ef352be6ac0ff39be25383ff", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20580, "timestamp_epoch": "1583962619.511659000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-40c76ff3180f1fedb2e04907", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20581, "timestamp_epoch": "1583962619.511835000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-d16667334433783a2e01082a", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20582, "timestamp_epoch": "1583962619.512006000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-416f07d4ba63fc99e8aa546b", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20583, "timestamp_epoch": "1583962619.512275000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-8183f9d099a7216b5e88a5f6", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20585, "timestamp_epoch": "1583962619.512705000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-a6c6763a538f2b9ad47c10cf", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20587, "timestamp_epoch": "1583962619.513298000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-fd4ff36cbd79584d4fe661ac", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20588, "timestamp_epoch": "1583962619.513655000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-034c34e28de8c1ec2d0be739", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20589, "timestamp_epoch": "1583962619.513975000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-8d79aba5634dd2a3cad5829c", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20590, "timestamp_epoch": "1583962619.514187000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-e1d8b69463665a96ef65e828", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20591, "timestamp_epoch": "1583962619.514399000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-067d1fe3ce8433d6b32bd9d9", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20592, "timestamp_epoch": "1583962619.514568000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-06650ee228db065bfc441b16", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20593, "timestamp_epoch": "1583962619.514815000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-ddc0bc7633bd982a1b3b801f", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20595, "timestamp_epoch": "1583962619.515247000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-4ed36913985a8104d7054fe4", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20597, "timestamp_epoch": "1583962619.515906000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-7c6f3a4bf7f4d7cd8aa0f827", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20598, "timestamp_epoch": "1583962619.516207000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-2602912346dcb66819203269", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20599, "timestamp_epoch": "1583962619.516450000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-17fa8b017980e65faf7b6f4e", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20600, "timestamp_epoch": "1583962619.516589000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-5aeecb515d2e2533e7c340ae", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20601, "timestamp_epoch": "1583962619.516768000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-5fd4b1e389b3c44c67ca2f04", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20602, "timestamp_epoch": "1583962619.516961000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-83a4dfb610c98d71b01ab76e", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20603, "timestamp_epoch": "1583962619.517197000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-3cdd27ec29fc2a6d5152cd71", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20605, "timestamp_epoch": "1583962619.517675000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-f20a6ecbeb42d5a534ad3cd0", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20607, "timestamp_epoch": "1583962619.518422000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-cdf0151d85738eaff2f5b8b6", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20608, "timestamp_epoch": "1583962619.518679000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-bfb858e657ba7519f01c740a", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20609, "timestamp_epoch": "1583962619.518937000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-df5f29b85964a2d95a5018bf", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20610, "timestamp_epoch": "1583962619.519071000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-ebb4681836c37417ce1877f0", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20611, "timestamp_epoch": "1583962619.519293000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-b276ae475561fcb4eba602c0", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20612, "timestamp_epoch": "1583962619.519514000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-100037b18971bfe97db001a1", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20613, "timestamp_epoch": "1583962619.519778000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-fb26d61d13bd126882622148", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20615, "timestamp_epoch": "1583962619.520200000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-b9a880b52f782ebfa23a9b1f", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20617, "timestamp_epoch": "1583962619.520987000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-b070a193a55db296e2beefeb", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20618, "timestamp_epoch": "1583962619.521209000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-9b67e82d48c9ce032cd43d25", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20619, "timestamp_epoch": "1583962619.521491000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-ad1e7788cfa9968e3dfccede", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20620, "timestamp_epoch": "1583962619.521648000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-3c0b14b5401cbb380491fe44", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20621, "timestamp_epoch": "1583962619.521875000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-805992908541d5ca10ba2581", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20622, "timestamp_epoch": "1583962619.522053000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-1d406af6cac76c7dbd7a2ca2", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20623, "timestamp_epoch": "1583962619.522289000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-2c20bd78cb5b8b5e91581c1b", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20625, "timestamp_epoch": "1583962619.522728000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-a022de385845cc638e9e8453", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20627, "timestamp_epoch": "1583962619.523300000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-bd02eb29c7d8ef6002439e6d", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20628, "timestamp_epoch": "1583962619.523573000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-f5ac7eb0c93bf1307b5399b9", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20629, "timestamp_epoch": "1583962619.523812000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-e9f4cfa9a59108164bf0e772", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20630, "timestamp_epoch": "1583962619.523949000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-84ca2cd8523d802b4be266cd", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20631, "timestamp_epoch": "1583962619.524150000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-9bdf8d251bd37570e3366cb4", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20632, "timestamp_epoch": "1583962619.524369000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-89c83cc8953ab04c0fedf6da", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20633, "timestamp_epoch": "1583962619.524596000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-304076b91033f29494a63600", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20635, "timestamp_epoch": "1583962619.525069000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-ffaf1c4cdeff8af37e1a982a", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20637, "timestamp_epoch": "1583962619.525783000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-e7e7588dda1e322381b53ffe", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20638, "timestamp_epoch": "1583962619.526029000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-f3f0167d7a5071bad09bf8b6", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20639, "timestamp_epoch": "1583962619.526264000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-7d398eb85fa9c31198ed0f7a", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20640, "timestamp_epoch": "1583962619.526397000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-5923a8247eb1fdc6136eded9", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20641, "timestamp_epoch": "1583962619.526590000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-22959fdf0fa48320b247a47e", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20642, "timestamp_epoch": "1583962619.526774000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-4060a2a958871f09a41d4d26", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20643, "timestamp_epoch": "1583962619.527000000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-d35b1ab1678fccb03c41cd59", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20645, "timestamp_epoch": "1583962619.527491000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-2b9f78bf6df8235b1638e76f", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20647, "timestamp_epoch": "1583962619.528122000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-1f4a1791a4fa3ddcabb60078", "src_port": null, "tcp_stream": 458, "udp_stream": null, "frame_number": 20648, "timestamp_epoch": "1583962619.528470000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-d826bbb0e0cc0c34da406e83", "src_port": null, "tcp_stream": 456, "udp_stream": null, "frame_number": 20649, "timestamp_epoch": "1583962619.528721000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-7231f02c6a15d775b442fc40", "src_port": null, "tcp_stream": 461, "udp_stream": null, "frame_number": 20809, "timestamp_epoch": "1583962637.171171000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-3614e1c50e1d69c00755f0f2", "src_port": null, "tcp_stream": 461, "udp_stream": null, "frame_number": 20811, "timestamp_epoch": "1583962637.171459000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-d849cc736b485df22816e808", "src_port": null, "tcp_stream": 461, "udp_stream": null, "frame_number": 20814, "timestamp_epoch": "1583962637.172564000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-ae92b5406817654391e889ff", "src_port": null, "tcp_stream": 461, "udp_stream": null, "frame_number": 20816, "timestamp_epoch": "1583962637.173284000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-7cd6e1a652c4bddec29adcb8", "src_port": null, "tcp_stream": 461, "udp_stream": null, "frame_number": 20817, "timestamp_epoch": "1583962637.176305000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-21742564ab5741814438dd7c", "src_port": null, "tcp_stream": 461, "udp_stream": null, "frame_number": 20818, "timestamp_epoch": "1583962637.176494000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-521cdf244bc740ee699246ab", "src_port": null, "tcp_stream": 461, "udp_stream": null, "frame_number": 20819, "timestamp_epoch": "1583962637.176808000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-255335c56511334ed8036874", "src_port": null, "tcp_stream": 461, "udp_stream": null, "frame_number": 20820, "timestamp_epoch": "1583962637.177098000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "3", "ldap.baseObject": "CN=Schema,CN=Configuration,DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-d9acea331411465f8abec19e", "src_port": null, "tcp_stream": 461, "udp_stream": null, "frame_number": 20821, "timestamp_epoch": "1583962637.177369000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-61f60e1b46653588599557b9", "src_port": null, "tcp_stream": 461, "udp_stream": null, "frame_number": 20822, "timestamp_epoch": "1583962637.177562000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "3", "ldap.baseObject": "CN=Schema,CN=Configuration,DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-c27840b9379ca142da397ba8", "src_port": null, "tcp_stream": 461, "udp_stream": null, "frame_number": 20823, "timestamp_epoch": "1583962637.177815000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-8264df94970009676bbd9c05", "src_port": null, "tcp_stream": 461, "udp_stream": null, "frame_number": 20824, "timestamp_epoch": "1583962637.177984000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=Aggregate,CN=Schema,CN=Configuration,DC=mondogreek,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-a46c38bc3945e462b69d6c01", "src_port": null, "tcp_stream": 461, "udp_stream": null, "frame_number": 20825, "timestamp_epoch": "1583962637.179024000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-8d292722832c699ad23a2370", "src_port": null, "tcp_stream": 461, "udp_stream": null, "frame_number": 21050, "timestamp_epoch": "1583962637.184108000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.filter": "3", "ldap.protocolOp": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-1ba67bbe3231dbd64de29901", "src_port": null, "tcp_stream": 461, "udp_stream": null, "frame_number": 21054, "timestamp_epoch": "1583962637.211162000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "ldap.protocolOp": "4,4,4,4,5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-b9dc753174ffa8d859f2ffac", "src_port": null, "tcp_stream": 461, "udp_stream": null, "frame_number": 21055, "timestamp_epoch": "1583962637.211640000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-8432c238c81525498c93bffc", "src_port": null, "tcp_stream": 461, "udp_stream": null, "frame_number": 21077, "timestamp_epoch": "1583962637.224413000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "samr.opnum": "64" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-43abee78196dae8e58d2afe6", "src_port": null, "tcp_stream": 639, "udp_stream": null, "frame_number": 29570, "timestamp_epoch": "1583963172.291390000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "samr.opnum": "64" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-5ff81a1354b124bf5e40502a", "src_port": null, "tcp_stream": 639, "udp_stream": null, "frame_number": 29571, "timestamp_epoch": "1583963172.291804000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "samr.opnum": "6" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-d7ca73225247bbf1ef051375", "src_port": null, "tcp_stream": 639, "udp_stream": null, "frame_number": 29572, "timestamp_epoch": "1583963172.292020000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "samr.opnum": "6" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-6091e6ef4e91d6f46608a503", "src_port": null, "tcp_stream": 639, "udp_stream": null, "frame_number": 29573, "timestamp_epoch": "1583963172.292307000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "samr.opnum": "5" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-78fd521227597907d7dbb9b2", "src_port": null, "tcp_stream": 639, "udp_stream": null, "frame_number": 29574, "timestamp_epoch": "1583963172.292723000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "samr.opnum": "5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-173575411b0a352766974c24", "src_port": null, "tcp_stream": 639, "udp_stream": null, "frame_number": 29575, "timestamp_epoch": "1583963172.293040000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "samr.opnum": "7" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-42e7589286625d0cfb7fd8b1", "src_port": null, "tcp_stream": 639, "udp_stream": null, "frame_number": 29576, "timestamp_epoch": "1583963172.293223000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "samr.opnum": "7" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-b6bed056a57ba0f90e555f55", "src_port": null, "tcp_stream": 639, "udp_stream": null, "frame_number": 29577, "timestamp_epoch": "1583963172.293690000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "samr.opnum": "7" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-afeb6d89e5ac27e95c8eaa34", "src_port": null, "tcp_stream": 639, "udp_stream": null, "frame_number": 29578, "timestamp_epoch": "1583963172.294657000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "samr.opnum": "7" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-604ce8db2b472d17c145d0e0", "src_port": null, "tcp_stream": 639, "udp_stream": null, "frame_number": 29579, "timestamp_epoch": "1583963172.295001000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "samr.opnum": "17" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-00fccc5ae826daf55656a96d", "src_port": null, "tcp_stream": 639, "udp_stream": null, "frame_number": 29580, "timestamp_epoch": "1583963172.295704000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "samr.opnum": "17" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-b4db92e6ba726b0cf65754fc", "src_port": null, "tcp_stream": 639, "udp_stream": null, "frame_number": 29581, "timestamp_epoch": "1583963172.296253000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "samr.opnum": "34" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-f1f47b9fac5ee5c45e40d900", "src_port": null, "tcp_stream": 639, "udp_stream": null, "frame_number": 29582, "timestamp_epoch": "1583963172.296777000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "samr.opnum": "34" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-9accdd7e3504514ac6399285", "src_port": null, "tcp_stream": 639, "udp_stream": null, "frame_number": 29583, "timestamp_epoch": "1583963172.297398000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "samr.opnum": "36" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-ff7ce0104f08121b90a36ad8", "src_port": null, "tcp_stream": 639, "udp_stream": null, "frame_number": 29584, "timestamp_epoch": "1583963172.298079000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "samr.opnum": "36", "samr.samr_UserInfo21.full_name": "Otis Witherspoon", "samr.samr_UserInfo21.account_name": "otis.witherspoon" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-22350de38e519a1dbd6680fc", "src_port": null, "tcp_stream": 639, "udp_stream": null, "frame_number": 29585, "timestamp_epoch": "1583963172.298498000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "samr.opnum": "3" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-35141ff6eee0a4784d10aa6c", "src_port": null, "tcp_stream": 639, "udp_stream": null, "frame_number": 29586, "timestamp_epoch": "1583963172.298786000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "samr.opnum": "3" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-1d0587abc58e0565da843a09", "src_port": null, "tcp_stream": 639, "udp_stream": null, "frame_number": 29587, "timestamp_epoch": "1583963172.299304000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "samr.opnum": "39" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-f32dfef6fbe057f7131e87eb", "src_port": null, "tcp_stream": 639, "udp_stream": null, "frame_number": 29588, "timestamp_epoch": "1583963172.299516000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "samr.opnum": "39" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-cf2155f49167031d2745db74", "src_port": null, "tcp_stream": 639, "udp_stream": null, "frame_number": 29589, "timestamp_epoch": "1583963172.299919000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "samr.opnum": "16" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-3b4e75ad94e436e5d8bc9316", "src_port": null, "tcp_stream": 639, "udp_stream": null, "frame_number": 29590, "timestamp_epoch": "1583963172.300145000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "samr.opnum": "16" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-c8ea301271cddc4a8b0838be", "src_port": null, "tcp_stream": 639, "udp_stream": null, "frame_number": 29591, "timestamp_epoch": "1583963172.300497000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "samr.opnum": "1" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-2063046bb03d72e3332d17aa", "src_port": null, "tcp_stream": 639, "udp_stream": null, "frame_number": 29592, "timestamp_epoch": "1583963172.300808000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "samr.opnum": "1" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-20cbc87b165c1ab1d860aa31", "src_port": null, "tcp_stream": 639, "udp_stream": null, "frame_number": 29593, "timestamp_epoch": "1583963172.301077000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "samr.opnum": "1" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-528b81be48cefe2c82befba5", "src_port": null, "tcp_stream": 639, "udp_stream": null, "frame_number": 29594, "timestamp_epoch": "1583963172.301288000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "samr.opnum": "1" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-a351b0a5f236ebd8b7e56d84", "src_port": null, "tcp_stream": 639, "udp_stream": null, "frame_number": 29595, "timestamp_epoch": "1583963172.301592000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "samr.opnum": "1" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-6714661789044f55d003c42e", "src_port": null, "tcp_stream": 639, "udp_stream": null, "frame_number": 29596, "timestamp_epoch": "1583963172.301775000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "samr.opnum": "1" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-6dc49fb898d0fb9acaf2df1d", "src_port": null, "tcp_stream": 639, "udp_stream": null, "frame_number": 29597, "timestamp_epoch": "1583963172.302042000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "samr.opnum": "1" }, "src_ip": "10.3.11.194", "dst_port": null, "event_id": "evt-a56479ff7a179649f1056770", "src_port": null, "tcp_stream": 639, "udp_stream": null, "frame_number": 29598, "timestamp_epoch": "1583963172.302214000" }, { "kind": "directory_service", "dst_ip": "10.3.11.194", "fields": { "samr.opnum": "1" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-24be28f611d158ea8a14ad18", "src_port": null, "tcp_stream": 639, "udp_stream": null, "frame_number": 29599, "timestamp_epoch": "1583963172.302507000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "samr.opnum": "64" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-66890c43e53a062641cb8b28", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29679, "timestamp_epoch": "1583963188.854903000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "samr.opnum": "64" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-aa2264ab74a5421401284183", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29682, "timestamp_epoch": "1583963188.855606000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "samr.opnum": "6" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-b896a3fb41b4cb647c6b6f93", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29683, "timestamp_epoch": "1583963188.856052000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "samr.opnum": "6" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-f266f20cc5dac00f88eb8ae6", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29686, "timestamp_epoch": "1583963188.857036000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "samr.opnum": "5" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-739cf26bd8189eaa1bcb059d", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29687, "timestamp_epoch": "1583963188.858447000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "samr.opnum": "5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-627058a7bea969d88571c27d", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29690, "timestamp_epoch": "1583963188.859457000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "samr.opnum": "7" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-01c4c43a7f19caffbf59b469", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29691, "timestamp_epoch": "1583963188.861107000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "samr.opnum": "7" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-82cf7c443bece66f7f8443fb", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29694, "timestamp_epoch": "1583963188.864153000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "samr.opnum": "7" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-ae5feca10ad0e5e4d4b61bd0", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29695, "timestamp_epoch": "1583963188.864609000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "samr.opnum": "7" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-c26f9ef54e6ffca5fec12185", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29698, "timestamp_epoch": "1583963188.866079000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "samr.opnum": "17" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-289715f545aa8510079f561a", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29699, "timestamp_epoch": "1583963188.866810000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "samr.opnum": "17" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-17c7a84bab0194f23bb8e0f2", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29702, "timestamp_epoch": "1583963188.867536000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "samr.opnum": "34" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-99f986f3893f8256662f1b1d", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29703, "timestamp_epoch": "1583963188.867805000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "samr.opnum": "34" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-6e4dbec58c72e0a2a0b6f869", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29706, "timestamp_epoch": "1583963188.869578000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "samr.opnum": "36" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-3b08e108b4b06fb676a884ea", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29707, "timestamp_epoch": "1583963188.869779000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "samr.opnum": "36", "samr.samr_UserInfo21.full_name": "Dominga McDowell", "samr.samr_UserInfo21.account_name": "dominga.mcdowell" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-651f1a19f0f4fab61e39f8c7", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29710, "timestamp_epoch": "1583963188.870712000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "samr.opnum": "3" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-23603f8b8d3803308c82d928", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29711, "timestamp_epoch": "1583963188.871225000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "samr.opnum": "3" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-d0abb8d42eceb36c75de1cc8", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29714, "timestamp_epoch": "1583963188.872026000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "samr.opnum": "39" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-150b17a254ed47e56a81ce23", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29715, "timestamp_epoch": "1583963188.872693000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "samr.opnum": "39" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-24f331ba8624bf18b660ce8d", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29718, "timestamp_epoch": "1583963188.874046000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "samr.opnum": "16" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-a9d8da0d82a973e5f706449d", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29719, "timestamp_epoch": "1583963188.874966000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "samr.opnum": "16" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-e426570c13a70bd796f1e1d6", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29722, "timestamp_epoch": "1583963188.875620000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "samr.opnum": "1" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-28942a0936c440c176d9250b", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29723, "timestamp_epoch": "1583963188.876053000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "samr.opnum": "1" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-70f9da3f81298d53837b15f2", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29726, "timestamp_epoch": "1583963188.876823000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "samr.opnum": "1" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-28e8206fec86468958586df5", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29727, "timestamp_epoch": "1583963188.877155000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "samr.opnum": "1" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-e876c10e3727f6430b5c1431", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29730, "timestamp_epoch": "1583963188.877833000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "samr.opnum": "1" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-894d35ac3ce69fceec0000a8", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29731, "timestamp_epoch": "1583963188.878116000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "samr.opnum": "1" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-edfe4738d3a09342031c9fed", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29734, "timestamp_epoch": "1583963188.878860000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "samr.opnum": "1" }, "src_ip": "10.3.11.218", "dst_port": null, "event_id": "evt-bd9574687af909ce0b6bbdbd", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29735, "timestamp_epoch": "1583963188.879148000" }, { "kind": "directory_service", "dst_ip": "10.3.11.218", "fields": { "samr.opnum": "1" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-0e1f0eddee857ddd72428b95", "src_port": null, "tcp_stream": 643, "udp_stream": null, "frame_number": 29738, "timestamp_epoch": "1583963188.879846000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "samr.opnum": "64" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-58e73cf5a8db42f4216f56df", "src_port": null, "tcp_stream": 645, "udp_stream": null, "frame_number": 29793, "timestamp_epoch": "1583963206.456131000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "samr.opnum": "64" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-db4da9491983c5a4ecbf1496", "src_port": null, "tcp_stream": 645, "udp_stream": null, "frame_number": 29794, "timestamp_epoch": "1583963206.456536000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "samr.opnum": "6" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-ecfd3011616f890291e78973", "src_port": null, "tcp_stream": 645, "udp_stream": null, "frame_number": 29795, "timestamp_epoch": "1583963206.456802000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "samr.opnum": "6" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-fda4003e1e32c42e41b048e7", "src_port": null, "tcp_stream": 645, "udp_stream": null, "frame_number": 29796, "timestamp_epoch": "1583963206.457097000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "samr.opnum": "5" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-756f6bcb3a75b43524631dca", "src_port": null, "tcp_stream": 645, "udp_stream": null, "frame_number": 29797, "timestamp_epoch": "1583963206.457324000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "samr.opnum": "5" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-8cfe68ee417a37b0062a8249", "src_port": null, "tcp_stream": 645, "udp_stream": null, "frame_number": 29798, "timestamp_epoch": "1583963206.457652000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "samr.opnum": "7" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-6d2df669efe71f165641da87", "src_port": null, "tcp_stream": 645, "udp_stream": null, "frame_number": 29799, "timestamp_epoch": "1583963206.457906000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "samr.opnum": "7" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-3a334251eedd39cd192d68c6", "src_port": null, "tcp_stream": 645, "udp_stream": null, "frame_number": 29800, "timestamp_epoch": "1583963206.458267000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "samr.opnum": "7" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-8ba7fe53e0683ef7399609ec", "src_port": null, "tcp_stream": 645, "udp_stream": null, "frame_number": 29801, "timestamp_epoch": "1583963206.459042000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "samr.opnum": "7" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-5ad32702286b2444a794f788", "src_port": null, "tcp_stream": 645, "udp_stream": null, "frame_number": 29802, "timestamp_epoch": "1583963206.459659000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "samr.opnum": "17" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-9ebccbf84c258eed4d618cf2", "src_port": null, "tcp_stream": 645, "udp_stream": null, "frame_number": 29803, "timestamp_epoch": "1583963206.459967000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "samr.opnum": "17" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-385aca9fee727910920bb75e", "src_port": null, "tcp_stream": 645, "udp_stream": null, "frame_number": 29804, "timestamp_epoch": "1583963206.460409000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "samr.opnum": "34" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-f5e6aef846defd5a3d0b091b", "src_port": null, "tcp_stream": 645, "udp_stream": null, "frame_number": 29805, "timestamp_epoch": "1583963206.460639000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "samr.opnum": "34" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-6c95d538c0a9398ad7dc1384", "src_port": null, "tcp_stream": 645, "udp_stream": null, "frame_number": 29806, "timestamp_epoch": "1583963206.461323000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "samr.opnum": "36" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-f739f6881350631fbf03edf9", "src_port": null, "tcp_stream": 645, "udp_stream": null, "frame_number": 29807, "timestamp_epoch": "1583963206.461629000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "samr.opnum": "36", "samr.samr_UserInfo21.full_name": "Dorian Neff", "samr.samr_UserInfo21.account_name": "dorian.neff" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-0ec4566d05d55b087e93de9f", "src_port": null, "tcp_stream": 645, "udp_stream": null, "frame_number": 29808, "timestamp_epoch": "1583963206.462085000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "samr.opnum": "3" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-d6daca6376d25abf851578e3", "src_port": null, "tcp_stream": 645, "udp_stream": null, "frame_number": 29809, "timestamp_epoch": "1583963206.462320000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "samr.opnum": "3" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-7bb19ccc93a50e0b9ac33b42", "src_port": null, "tcp_stream": 645, "udp_stream": null, "frame_number": 29810, "timestamp_epoch": "1583963206.462709000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "samr.opnum": "39" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-78c6e2cc3ed2256f30336039", "src_port": null, "tcp_stream": 645, "udp_stream": null, "frame_number": 29811, "timestamp_epoch": "1583963206.463010000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "samr.opnum": "39" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-a0fe1d85e19689a37335be03", "src_port": null, "tcp_stream": 645, "udp_stream": null, "frame_number": 29812, "timestamp_epoch": "1583963206.463362000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "samr.opnum": "16" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-43b1b9c64dc35fdf086c5513", "src_port": null, "tcp_stream": 645, "udp_stream": null, "frame_number": 29813, "timestamp_epoch": "1583963206.463679000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "samr.opnum": "16" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-5c4f4c1cc46f41930094ee6a", "src_port": null, "tcp_stream": 645, "udp_stream": null, "frame_number": 29814, "timestamp_epoch": "1583963206.464161000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "samr.opnum": "1" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-ba3adc7b6d089c6606f604e0", "src_port": null, "tcp_stream": 645, "udp_stream": null, "frame_number": 29815, "timestamp_epoch": "1583963206.464388000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "samr.opnum": "1" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-6c6896ad9f2e9590edae7bad", "src_port": null, "tcp_stream": 645, "udp_stream": null, "frame_number": 29816, "timestamp_epoch": "1583963206.464665000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "samr.opnum": "1" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-d5c25f2776a568725118ba38", "src_port": null, "tcp_stream": 645, "udp_stream": null, "frame_number": 29817, "timestamp_epoch": "1583963206.464948000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "samr.opnum": "1" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-e449bea73b146c1925725780", "src_port": null, "tcp_stream": 645, "udp_stream": null, "frame_number": 29818, "timestamp_epoch": "1583963206.465225000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "samr.opnum": "1" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-895955ffd1d80d9fad950c60", "src_port": null, "tcp_stream": 645, "udp_stream": null, "frame_number": 29819, "timestamp_epoch": "1583963206.465420000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "samr.opnum": "1" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-e152c67afcd044343cfeabfa", "src_port": null, "tcp_stream": 645, "udp_stream": null, "frame_number": 29820, "timestamp_epoch": "1583963206.465683000" }, { "kind": "directory_service", "dst_ip": "10.3.11.3", "fields": { "samr.opnum": "1" }, "src_ip": "10.3.11.119", "dst_port": null, "event_id": "evt-b00d10770cf000a04408793a", "src_port": null, "tcp_stream": 645, "udp_stream": null, "frame_number": 29821, "timestamp_epoch": "1583963206.466088000" }, { "kind": "directory_service", "dst_ip": "10.3.11.119", "fields": { "samr.opnum": "1" }, "src_ip": "10.3.11.3", "dst_port": null, "event_id": "evt-38330d5a92f7dbc819576bad", "src_port": null, "tcp_stream": 645, "udp_stream": null, "frame_number": 29822, "timestamp_epoch": "1583963206.466415000" } ] }, "capture": { "format": "pcap-le-microsecond", "packet_count": 30239, "interface_ids": [], "source_sha256": "8df815a53e873e01803010c33752080414b0975709c1c02327e12661eec883a4", "captured_bytes": 21325473, "protocol_counts": { "ip": 30239, "cms": 24, "dns": 748, "eth": 30239, "ntp": 18, "png": 6, "smb": 84, "tcp": 28618, "tls": 7764, "udp": 1584, "data": 358, "http": 140, "igmp": 74, "ldap": 623, "mdns": 62, "nbns": 119, "nbss": 986, "ocsp": 356, "smb2": 959, "ssdp": 91, "cldap": 72, "gquic": 366, "llmnr": 51, "media": 13, "nbdgm": 57, "dcerpc": 658, "pkcs-1": 55, "spnego": 252, "x509ce": 5086, "browser": 57, "gss-api": 555, "ntlmssp": 15, "x509sat": 6487, "kerberos": 156, "ethertype": 30239, "image-jfif": 18, "spnego-krb5": 1011, "pkix1explicit": 500, "pkix1implicit": 572, "mime_multipart": 5, "data-text-lines": 23 }, "duration_seconds": 2645.912095, "last_packet_epoch": "1583964400.899336", "source_size_bytes": 21809321, "first_packet_epoch": "1583961754.987241", "encapsulation_types": [ 1 ] }, "summary": "Decoded 30239 packets across 150 IP endpoints and 1083 transport flows. Observed 748 DNS events, 161 HTTP requests, 349 TLS ClientHello events, and 63 recovered file/message object(s). Deterministic rules produced 30 finding(s): 0 high, 11 medium, and 19 low. Findings are evidence-bound candidates and require analyst review; encrypted payload contents remain unavailable.", "coverage": { "warnings": [ "Conflicting TCP overlap: fallback extraction rejected this direction" ], "limitations": [ "Encrypted application contents are not decrypted", "Protocol decoding and heuristic findings do not establish malware family or attribution", "No endpoint execution, persistence, or credential-theft proof without corresponding evidence" ], "event_limits": { "dns": { "returned": 748, "truncated": false }, "dhcp": { "returned": 0, "truncated": false }, "smtp": { "returned": 0, "truncated": false }, "identity": { "returned": 1552, "truncated": false }, "http_request": { "returned": 161, "truncated": false }, "http_response": { "returned": 70, "truncated": false }, "tls_client_hello": { "returned": 349, "truncated": false }, "unclassified_tcp": { "returned": 335, "truncated": false }, "directory_service": { "returned": 919, "truncated": false } }, "http_objects": { "complete": true, "selection": "content-classified first, then size descending, SHA256 tie-break; deduplicated by full hash; overflow retains a compact hash index", "hashed_bytes": 6915057, "export_status": "completed", "unique_hashes": 63, "hashed_objects": 67, "compact_objects": 0, "detailed_objects": 63, "exported_objects": 67, "unhashed_objects": 0, "compact_hash_index": [], "omitted_unique_hashes": 0, "returned_unique_hashes": 63 }, "name_resolution": false, "supplemental_objects": { "scope": "bounded IMF, inert embedded base64 and complete contiguous HTTP response recovery", "returned": 0 }, "complete_within_profile": false, "encrypted_payload_visibility": "metadata-only" }, "findings": [ { "title": "Script, archive, or executable transfer candidate", "status": "candidate", "metrics": { "uri": "/starfield/duel/v2.5.8/duel.js?appid=O3BkA5J1", "source": "23.211.18.27", "destination": "10.3.11.119", "content_type": "application/x-javascript", "response_count": 1, "declared_body_bytes": 15038 }, "rule_id": "script-or-executable-transfer", "evidence": [ { "tcp_stream": 207, "frame_number": 4475, "display_filter": "frame.number == 4475", "timestamp_epoch": "1583961854.850635000" }, { "tcp_stream": 207, "frame_number": 4616, "display_filter": "frame.number == 4616", "timestamp_epoch": "1583961855.132596000" } ], "severity": "medium", "confidence": 0.86, "finding_id": "finding-a4929b2939a774b5be00f563", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "rule_version": "pcap-rules-v5" }, { "title": "Script, archive, or executable transfer candidate", "status": "candidate", "metrics": { "uri": "/js/300/addthis_widget.js", "source": "72.246.84.150", "destination": "10.3.11.119", "content_type": "text/html", "response_count": 1, "declared_body_bytes": 171 }, "rule_id": "script-or-executable-transfer", "evidence": [ { "tcp_stream": 216, "frame_number": 4559, "display_filter": "frame.number == 4559", "timestamp_epoch": "1583961854.985134000" }, { "tcp_stream": 216, "frame_number": 4568, "display_filter": "frame.number == 4568", "timestamp_epoch": "1583961855.033448000" } ], "severity": "medium", "confidence": 0.86, "finding_id": "finding-b719ff0cc4815abb825ef07d", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "rule_version": "pcap-rules-v5" }, { "title": "Script, archive, or executable transfer candidate", "status": "candidate", "metrics": { "uri": "/tcc/tcc_l.combined.1.0.5.min.js", "source": "23.211.18.27", "destination": "10.3.11.119", "content_type": "application/x-javascript", "response_count": 1, "declared_body_bytes": 2157 }, "rule_id": "script-or-executable-transfer", "evidence": [ { "tcp_stream": 207, "frame_number": 4638, "display_filter": "frame.number == 4638", "timestamp_epoch": "1583961855.179664000" }, { "tcp_stream": 207, "frame_number": 4679, "display_filter": "frame.number == 4679", "timestamp_epoch": "1583961855.206585000" } ], "severity": "medium", "confidence": 0.86, "finding_id": "finding-00fe5f4c7aefd26b811e3ed4", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "rule_version": "pcap-rules-v5" }, { "title": "Script, archive, or executable transfer candidate", "status": "candidate", "metrics": { "uri": "/starfield/duel/v2.5.8/sf.core/sf.core.pkg.js", "source": "23.211.18.27", "destination": "10.3.11.119", "content_type": "application/x-javascript", "response_count": 1, "declared_body_bytes": 23160 }, "rule_id": "script-or-executable-transfer", "evidence": [ { "tcp_stream": 231, "frame_number": 5551, "display_filter": "frame.number == 5551", "timestamp_epoch": "1583961856.605293000" }, { "tcp_stream": 231, "frame_number": 5791, "display_filter": "frame.number == 5791", "timestamp_epoch": "1583961856.703926000" } ], "severity": "medium", "confidence": 0.86, "finding_id": "finding-1b49952f56bd846c20797136", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "rule_version": "pcap-rules-v5" }, { "title": "Script, archive, or executable transfer candidate", "status": "candidate", "metrics": { "uri": "/widgets.js", "source": "72.21.91.66", "destination": "10.3.11.119", "content_type": "application/javascript; charset=utf-8", "response_count": 1, "declared_body_bytes": 29100 }, "rule_id": "script-or-executable-transfer", "evidence": [ { "tcp_stream": 237, "frame_number": 6154, "display_filter": "frame.number == 6154", "timestamp_epoch": "1583961857.286196000" }, { "tcp_stream": 237, "frame_number": 6254, "display_filter": "frame.number == 6254", "timestamp_epoch": "1583961857.339599000" } ], "severity": "medium", "confidence": 0.86, "finding_id": "finding-f26f0d5b59b803e0a19770bc", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "rule_version": "pcap-rules-v5" }, { "title": "Script, archive, or executable transfer candidate", "status": "candidate", "metrics": { "uri": "/YAS20.exe", "source": "50.87.248.17", "destination": "10.3.11.194", "content_type": "application/x-msdownload", "response_count": 1, "declared_body_bytes": 466944 }, "rule_id": "script-or-executable-transfer", "evidence": [ { "tcp_stream": 259, "frame_number": 8616, "display_filter": "frame.number == 8616", "timestamp_epoch": "1583961876.516400000" }, { "tcp_stream": 259, "frame_number": 8998, "display_filter": "frame.number == 8998", "timestamp_epoch": "1583961876.987327000" } ], "severity": "medium", "confidence": 0.86, "finding_id": "finding-cb44e1bfa4c5fe319a17101f", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "rule_version": "pcap-rules-v5" }, { "title": "Script, archive, or executable transfer candidate", "status": "candidate", "metrics": { "uri": "/markerly-cdn.js", "source": "172.217.6.144", "destination": "10.3.11.218", "content_type": "text/javascript", "response_count": 1, "declared_body_bytes": 1292 }, "rule_id": "script-or-executable-transfer", "evidence": [ { "tcp_stream": 351, "frame_number": 13377, "display_filter": "frame.number == 13377", "timestamp_epoch": "1583962027.490893000" }, { "tcp_stream": 351, "frame_number": 13389, "display_filter": "frame.number == 13389", "timestamp_epoch": "1583962027.518133000" } ], "severity": "medium", "confidence": 0.86, "finding_id": "finding-6ca9b7acd7ff212a21ca0d96", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "rule_version": "pcap-rules-v5" }, { "title": "Script, archive, or executable transfer candidate", "status": "candidate", "metrics": { "uri": "/js/bootstrap.min.js", "source": "65.254.227.240", "destination": "10.3.11.218", "content_type": "application/x-javascript", "response_count": 1, "declared_body_bytes": 35951 }, "rule_id": "script-or-executable-transfer", "evidence": [ { "tcp_stream": 344, "frame_number": 13453, "display_filter": "frame.number == 13453", "timestamp_epoch": "1583962027.547622000" }, { "tcp_stream": 344, "frame_number": 13559, "display_filter": "frame.number == 13559", "timestamp_epoch": "1583962027.622723000" } ], "severity": "medium", "confidence": 0.86, "finding_id": "finding-58449113e255a2130114c983", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "rule_version": "pcap-rules-v5" }, { "title": "Script, archive, or executable transfer candidate", "status": "candidate", "metrics": { "uri": "/ajax/libs/jquery/1.6.4/jquery.min.js", "source": "172.217.12.74", "destination": "10.3.11.218", "content_type": "text/javascript; charset=utf-8", "response_count": 1, "declared_body_bytes": 32222 }, "rule_id": "script-or-executable-transfer", "evidence": [ { "tcp_stream": 358, "frame_number": 13836, "display_filter": "frame.number == 13836", "timestamp_epoch": "1583962031.485239000" }, { "tcp_stream": 358, "frame_number": 13891, "display_filter": "frame.number == 13891", "timestamp_epoch": "1583962031.543194000" } ], "severity": "medium", "confidence": 0.86, "finding_id": "finding-9d1007f2a8ad5e4cd409b66a", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "rule_version": "pcap-rules-v5" }, { "title": "Script, archive, or executable transfer candidate", "status": "candidate", "metrics": { "uri": "/toolbar.cdn.min.js", "source": "172.217.6.144", "destination": "10.3.11.218", "content_type": "text/javascript", "response_count": 1, "declared_body_bytes": 61214 }, "rule_id": "script-or-executable-transfer", "evidence": [ { "tcp_stream": 351, "frame_number": 13902, "display_filter": "frame.number == 13902", "timestamp_epoch": "1583962031.571744000" }, { "tcp_stream": 351, "frame_number": 13981, "display_filter": "frame.number == 13981", "timestamp_epoch": "1583962031.731453000" } ], "severity": "medium", "confidence": 0.86, "finding_id": "finding-1b856a7e84adb279afa011a2", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "rule_version": "pcap-rules-v5" }, { "title": "Repeated unsuccessful DNS resolution", "status": "candidate", "metrics": { "domain": "wpad.mondogreek.com", "source": "10.3.11.119", "response_count": 20 }, "rule_id": "repeated-nxdomain", "evidence": [ { "udp_stream": 85, "frame_number": 2500, "display_filter": "frame.number == 2500", "timestamp_epoch": "1583961811.510192000" }, { "udp_stream": 119, "frame_number": 3764, "display_filter": "frame.number == 3764", "timestamp_epoch": "1583961826.576920000" }, { "udp_stream": 133, "frame_number": 4316, "display_filter": "frame.number == 4316", "timestamp_epoch": "1583961853.498879000" }, { "udp_stream": 169, "frame_number": 7699, "display_filter": "frame.number == 7699", "timestamp_epoch": "1583961862.500827000" }, { "udp_stream": 171, "frame_number": 7704, "display_filter": "frame.number == 7704", "timestamp_epoch": "1583961862.503491000" }, { "udp_stream": 181, "frame_number": 9418, "display_filter": "frame.number == 9418", "timestamp_epoch": "1583961886.594398000" }, { "udp_stream": 184, "frame_number": 9824, "display_filter": "frame.number == 9824", "timestamp_epoch": "1583961895.300384000" }, { "udp_stream": 187, "frame_number": 10208, "display_filter": "frame.number == 10208", "timestamp_epoch": "1583961911.713832000" }, { "udp_stream": 221, "frame_number": 14638, "display_filter": "frame.number == 14638", "timestamp_epoch": "1583962217.840598000" }, { "udp_stream": 263, "frame_number": 16113, "display_filter": "frame.number == 16113", "timestamp_epoch": "1583962434.138674000" }, { "udp_stream": 264, "frame_number": 16201, "display_filter": "frame.number == 16201", "timestamp_epoch": "1583962438.367679000" }, { "udp_stream": 266, "frame_number": 16206, "display_filter": "frame.number == 16206", "timestamp_epoch": "1583962438.371476000" }, { "udp_stream": 275, "frame_number": 16261, "display_filter": "frame.number == 16261", "timestamp_epoch": "1583962447.371328000" }, { "udp_stream": 277, "frame_number": 16266, "display_filter": "frame.number == 16266", "timestamp_epoch": "1583962447.375845000" }, { "udp_stream": 279, "frame_number": 16280, "display_filter": "frame.number == 16280", "timestamp_epoch": "1583962452.150409000" }, { "udp_stream": 283, "frame_number": 16321, "display_filter": "frame.number == 16321", "timestamp_epoch": "1583962512.155592000" }, { "udp_stream": 312, "frame_number": 21119, "display_filter": "frame.number == 21119", "timestamp_epoch": "1583962650.285771000" }, { "udp_stream": 415, "frame_number": 29347, "display_filter": "frame.number == 29347", "timestamp_epoch": "1583963112.169749000" }, { "udp_stream": 419, "frame_number": 30031, "display_filter": "frame.number == 30031", "timestamp_epoch": "1583963712.230956000" }, { "udp_stream": 422, "frame_number": 30227, "display_filter": "frame.number == 30227", "timestamp_epoch": "1583964312.292695000" } ], "severity": "low", "confidence": 0.5, "finding_id": "finding-437ba6956b48c17adc1decf7", "explanation": "Repeated NXDOMAIN responses may indicate a dead domain, misconfiguration, retrying software, or malicious fallback. They do not establish a domain-generation algorithm.", "rule_version": "pcap-rules-v5" }, { "title": "Directory-service protocol activity", "status": "candidate", "metrics": { "source": "10.3.11.119", "protocol": "drsuapi", "destination": "10.3.11.3", "event_count": 32, "operation_numbers": [ "0", "1", "12", "30" ] }, "rule_id": "directory-service-activity", "evidence": [ { "tcp_stream": 129, "frame_number": 2652, "display_filter": "frame.number == 2652", "timestamp_epoch": "1583961813.162563000" }, { "tcp_stream": 129, "frame_number": 2655, "display_filter": "frame.number == 2655", "timestamp_epoch": "1583961813.163158000" }, { "tcp_stream": 129, "frame_number": 2657, "display_filter": "frame.number == 2657", "timestamp_epoch": "1583961813.163961000" }, { "tcp_stream": 129, "frame_number": 2673, "display_filter": "frame.number == 2673", "timestamp_epoch": "1583961813.168884000" }, { "tcp_stream": 129, "frame_number": 2675, "display_filter": "frame.number == 2675", "timestamp_epoch": "1583961813.170723000" }, { "tcp_stream": 129, "frame_number": 2677, "display_filter": "frame.number == 2677", "timestamp_epoch": "1583961813.173551000" }, { "tcp_stream": 129, "frame_number": 2790, "display_filter": "frame.number == 2790", "timestamp_epoch": "1583961813.619689000" }, { "tcp_stream": 129, "frame_number": 2792, "display_filter": "frame.number == 2792", "timestamp_epoch": "1583961813.620366000" }, { "tcp_stream": 129, "frame_number": 2794, "display_filter": "frame.number == 2794", "timestamp_epoch": "1583961813.621101000" }, { "tcp_stream": 129, "frame_number": 2796, "display_filter": "frame.number == 2796", "timestamp_epoch": "1583961813.621706000" }, { "tcp_stream": 144, "frame_number": 3049, "display_filter": "frame.number == 3049", "timestamp_epoch": "1583961815.810997000" }, { "tcp_stream": 144, "frame_number": 3051, "display_filter": "frame.number == 3051", "timestamp_epoch": "1583961815.811926000" }, { "tcp_stream": 144, "frame_number": 3053, "display_filter": "frame.number == 3053", "timestamp_epoch": "1583961815.812679000" }, { "tcp_stream": 144, "frame_number": 3057, "display_filter": "frame.number == 3057", "timestamp_epoch": "1583961815.814446000" }, { "tcp_stream": 144, "frame_number": 3059, "display_filter": "frame.number == 3059", "timestamp_epoch": "1583961815.814959000" }, { "tcp_stream": 144, "frame_number": 3061, "display_filter": "frame.number == 3061", "timestamp_epoch": "1583961815.815497000" }, { "tcp_stream": 129, "frame_number": 3821, "display_filter": "frame.number == 3821", "timestamp_epoch": "1583961831.474895000" }, { "tcp_stream": 129, "frame_number": 3823, "display_filter": "frame.number == 3823", "timestamp_epoch": "1583961831.475410000" }, { "tcp_stream": 129, "frame_number": 3826, "display_filter": "frame.number == 3826", "timestamp_epoch": "1583961831.476180000" }, { "tcp_stream": 129, "frame_number": 3829, "display_filter": "frame.number == 3829", "timestamp_epoch": "1583961831.476842000" }, { "tcp_stream": 264, "frame_number": 9758, "display_filter": "frame.number == 9758", "timestamp_epoch": "1583961892.421132000" }, { "tcp_stream": 264, "frame_number": 9760, "display_filter": "frame.number == 9760", "timestamp_epoch": "1583961892.422611000" }, { "tcp_stream": 264, "frame_number": 9762, "display_filter": "frame.number == 9762", "timestamp_epoch": "1583961892.423479000" }, { "tcp_stream": 264, "frame_number": 9766, "display_filter": "frame.number == 9766", "timestamp_epoch": "1583961892.425775000" }, { "tcp_stream": 264, "frame_number": 9768, "display_filter": "frame.number == 9768", "timestamp_epoch": "1583961892.426539000" }, { "tcp_stream": 264, "frame_number": 9770, "display_filter": "frame.number == 9770", "timestamp_epoch": "1583961892.427460000" }, { "tcp_stream": 368, "frame_number": 14362, "display_filter": "frame.number == 14362", "timestamp_epoch": "1583962113.814107000" }, { "tcp_stream": 368, "frame_number": 14364, "display_filter": "frame.number == 14364", "timestamp_epoch": "1583962113.814709000" }, { "tcp_stream": 368, "frame_number": 14366, "display_filter": "frame.number == 14366", "timestamp_epoch": "1583962113.815215000" }, { "tcp_stream": 368, "frame_number": 14370, "display_filter": "frame.number == 14370", "timestamp_epoch": "1583962113.817104000" }, { "tcp_stream": 368, "frame_number": 14372, "display_filter": "frame.number == 14372", "timestamp_epoch": "1583962113.817650000" }, { "tcp_stream": 368, "frame_number": 14374, "display_filter": "frame.number == 14374", "timestamp_epoch": "1583962113.818170000" } ], "severity": "low", "confidence": 0.95, "finding_id": "finding-44cc6397901101312abbfb15", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "rule_version": "pcap-rules-v5" }, { "title": "Directory-service protocol activity", "status": "candidate", "metrics": { "source": "10.3.11.119", "protocol": "ldap", "destination": "10.3.11.3", "event_count": 74, "operation_numbers": [ "", "0", "2", "3" ] }, "rule_id": "directory-service-activity", "evidence": [ { "tcp_stream": 119, "frame_number": 2493, "display_filter": "frame.number == 2493", "timestamp_epoch": "1583961811.057983000" }, { "tcp_stream": 122, "frame_number": 2565, "display_filter": "frame.number == 2565", "timestamp_epoch": "1583961813.030234000" }, { "tcp_stream": 122, "frame_number": 2627, "display_filter": "frame.number == 2627", "timestamp_epoch": "1583961813.157646000" }, { "tcp_stream": 119, "frame_number": 2643, "display_filter": "frame.number == 2643", "timestamp_epoch": "1583961813.160499000" }, { "tcp_stream": 122, "frame_number": 2646, "display_filter": "frame.number == 2646", "timestamp_epoch": "1583961813.161171000" }, { "tcp_stream": 122, "frame_number": 2651, "display_filter": "frame.number == 2651", "timestamp_epoch": "1583961813.162526000" }, { "tcp_stream": 119, "frame_number": 2662, "display_filter": "frame.number == 2662", "timestamp_epoch": "1583961813.164702000" }, { "tcp_stream": 122, "frame_number": 2691, "display_filter": "frame.number == 2691", "timestamp_epoch": "1583961813.295695000" }, { "tcp_stream": 122, "frame_number": 2743, "display_filter": "frame.number == 2743", "timestamp_epoch": "1583961813.449891000" }, { "tcp_stream": 122, "frame_number": 2761, "display_filter": "frame.number == 2761", "timestamp_epoch": "1583961813.559524000" }, { "tcp_stream": 122, "frame_number": 2769, "display_filter": "frame.number == 2769", "timestamp_epoch": "1583961813.561868000" }, { "tcp_stream": 122, "frame_number": 2773, "display_filter": "frame.number == 2773", "timestamp_epoch": "1583961813.562936000" }, { "tcp_stream": 122, "frame_number": 2776, "display_filter": "frame.number == 2776", "timestamp_epoch": "1583961813.563581000" }, { "tcp_stream": 137, "frame_number": 2815, "display_filter": "frame.number == 2815", "timestamp_epoch": "1583961814.055614000" }, { "tcp_stream": 137, "frame_number": 2820, "display_filter": "frame.number == 2820", "timestamp_epoch": "1583961814.058784000" }, { "tcp_stream": 137, "frame_number": 2836, "display_filter": "frame.number == 2836", "timestamp_epoch": "1583961814.115833000" }, { "tcp_stream": 139, "frame_number": 2842, "display_filter": "frame.number == 2842", "timestamp_epoch": "1583961814.133631000" }, { "tcp_stream": 139, "frame_number": 2845, "display_filter": "frame.number == 2845", "timestamp_epoch": "1583961814.135851000" }, { "tcp_stream": 139, "frame_number": 2847, "display_filter": "frame.number == 2847", "timestamp_epoch": "1583961814.136308000" }, { "tcp_stream": 137, "frame_number": 2850, "display_filter": "frame.number == 2850", "timestamp_epoch": "1583961814.137537000" }, { "tcp_stream": 139, "frame_number": 2994, "display_filter": "frame.number == 2994", "timestamp_epoch": "1583961814.440305000" }, { "tcp_stream": 137, "frame_number": 2998, "display_filter": "frame.number == 2998", "timestamp_epoch": "1583961814.449018000" }, { "tcp_stream": 145, "frame_number": 3072, "display_filter": "frame.number == 3072", "timestamp_epoch": "1583961815.919472000" }, { "tcp_stream": 145, "frame_number": 3077, "display_filter": "frame.number == 3077", "timestamp_epoch": "1583961815.921016000" }, { "tcp_stream": 145, "frame_number": 3080, "display_filter": "frame.number == 3080", "timestamp_epoch": "1583961815.922270000" }, { "tcp_stream": 145, "frame_number": 3082, "display_filter": "frame.number == 3082", "timestamp_epoch": "1583961815.923132000" }, { "tcp_stream": 145, "frame_number": 3084, "display_filter": "frame.number == 3084", "timestamp_epoch": "1583961815.923482000" }, { "tcp_stream": 146, "frame_number": 3090, "display_filter": "frame.number == 3090", "timestamp_epoch": "1583961815.926463000" }, { "tcp_stream": 146, "frame_number": 3093, "display_filter": "frame.number == 3093", "timestamp_epoch": "1583961815.927753000" }, { "tcp_stream": 146, "frame_number": 3098, "display_filter": "frame.number == 3098", "timestamp_epoch": "1583961815.928713000" }, { "tcp_stream": 146, "frame_number": 3100, "display_filter": "frame.number == 3100", "timestamp_epoch": "1583961815.929335000" }, { "tcp_stream": 145, "frame_number": 3104, "display_filter": "frame.number == 3104", "timestamp_epoch": "1583961815.929954000" }, { "tcp_stream": 169, "frame_number": 3622, "display_filter": "frame.number == 3622", "timestamp_epoch": "1583961821.346293000" }, { "tcp_stream": 169, "frame_number": 3627, "display_filter": "frame.number == 3627", "timestamp_epoch": "1583961821.348431000" }, { "tcp_stream": 169, "frame_number": 3630, "display_filter": "frame.number == 3630", "timestamp_epoch": "1583961821.351313000" }, { "tcp_stream": 169, "frame_number": 3632, "display_filter": "frame.number == 3632", "timestamp_epoch": "1583961821.351940000" }, { "tcp_stream": 169, "frame_number": 3634, "display_filter": "frame.number == 3634", "timestamp_epoch": "1583961821.352520000" }, { "tcp_stream": 169, "frame_number": 3636, "display_filter": "frame.number == 3636", "timestamp_epoch": "1583961821.353128000" }, { "tcp_stream": 169, "frame_number": 3638, "display_filter": "frame.number == 3638", "timestamp_epoch": "1583961821.353868000" }, { "tcp_stream": 170, "frame_number": 3644, "display_filter": "frame.number == 3644", "timestamp_epoch": "1583961821.368228000" }, { "tcp_stream": 170, "frame_number": 3647, "display_filter": "frame.number == 3647", "timestamp_epoch": "1583961821.370365000" }, { "tcp_stream": 170, "frame_number": 3679, "display_filter": "frame.number == 3679", "timestamp_epoch": "1583961821.379684000" }, { "tcp_stream": 170, "frame_number": 3681, "display_filter": "frame.number == 3681", "timestamp_epoch": "1583961821.381273000" }, { "tcp_stream": 169, "frame_number": 3685, "display_filter": "frame.number == 3685", "timestamp_epoch": "1583961821.382035000" }, { "tcp_stream": 185, "frame_number": 3948, "display_filter": "frame.number == 3948", "timestamp_epoch": "1583961831.834781000" }, { "tcp_stream": 185, "frame_number": 3951, "display_filter": "frame.number == 3951", "timestamp_epoch": "1583961831.841415000" }, { "tcp_stream": 186, "frame_number": 3957, "display_filter": "frame.number == 3957", "timestamp_epoch": "1583961831.845532000" }, { "tcp_stream": 186, "frame_number": 3960, "display_filter": "frame.number == 3960", "timestamp_epoch": "1583961831.846903000" }, { "tcp_stream": 186, "frame_number": 3962, "display_filter": "frame.number == 3962", "timestamp_epoch": "1583961831.847368000" }, { "tcp_stream": 185, "frame_number": 3964, "display_filter": "frame.number == 3964", "timestamp_epoch": "1583961831.848536000" }, { "tcp_stream": 186, "frame_number": 3971, "display_filter": "frame.number == 3971", "timestamp_epoch": "1583961832.169381000" }, { "tcp_stream": 185, "frame_number": 3973, "display_filter": "frame.number == 3973", "timestamp_epoch": "1583961832.196399000" }, { "tcp_stream": 265, "frame_number": 9775, "display_filter": "frame.number == 9775", "timestamp_epoch": "1583961892.431463000" }, { "tcp_stream": 265, "frame_number": 9780, "display_filter": "frame.number == 9780", "timestamp_epoch": "1583961892.434751000" }, { "tcp_stream": 265, "frame_number": 9783, "display_filter": "frame.number == 9783", "timestamp_epoch": "1583961892.436700000" }, { "tcp_stream": 265, "frame_number": 9785, "display_filter": "frame.number == 9785", "timestamp_epoch": "1583961892.438029000" }, { "tcp_stream": 265, "frame_number": 9787, "display_filter": "frame.number == 9787", "timestamp_epoch": "1583961892.439016000" }, { "tcp_stream": 266, "frame_number": 9793, "display_filter": "frame.number == 9793", "timestamp_epoch": "1583961892.443657000" }, { "tcp_stream": 266, "frame_number": 9796, "display_filter": "frame.number == 9796", "timestamp_epoch": "1583961892.445698000" }, { "tcp_stream": 266, "frame_number": 9801, "display_filter": "frame.number == 9801", "timestamp_epoch": "1583961892.446682000" }, { "tcp_stream": 266, "frame_number": 9803, "display_filter": "frame.number == 9803", "timestamp_epoch": "1583961892.447393000" }, { "tcp_stream": 265, "frame_number": 9805, "display_filter": "frame.number == 9805", "timestamp_epoch": "1583961892.447885000" }, { "tcp_stream": 369, "frame_number": 14379, "display_filter": "frame.number == 14379", "timestamp_epoch": "1583962113.820662000" }, { "tcp_stream": 369, "frame_number": 14384, "display_filter": "frame.number == 14384", "timestamp_epoch": "1583962113.822029000" }, { "tcp_stream": 369, "frame_number": 14387, "display_filter": "frame.number == 14387", "timestamp_epoch": "1583962113.823356000" }, { "tcp_stream": 369, "frame_number": 14389, "display_filter": "frame.number == 14389", "timestamp_epoch": "1583962113.823921000" }, { "tcp_stream": 369, "frame_number": 14391, "display_filter": "frame.number == 14391", "timestamp_epoch": "1583962113.824435000" }, { "tcp_stream": 370, "frame_number": 14397, "display_filter": "frame.number == 14397", "timestamp_epoch": "1583962113.827952000" }, { "tcp_stream": 370, "frame_number": 14400, "display_filter": "frame.number == 14400", "timestamp_epoch": "1583962113.829454000" }, { "tcp_stream": 370, "frame_number": 14405, "display_filter": "frame.number == 14405", "timestamp_epoch": "1583962113.830464000" }, { "tcp_stream": 370, "frame_number": 14407, "display_filter": "frame.number == 14407", "timestamp_epoch": "1583962113.831229000" }, { "tcp_stream": 369, "frame_number": 14411, "display_filter": "frame.number == 14411", "timestamp_epoch": "1583962113.831928000" }, { "tcp_stream": 411, "frame_number": 16098, "display_filter": "frame.number == 16098", "timestamp_epoch": "1583962433.467839000" }, { "tcp_stream": 411, "frame_number": 16101, "display_filter": "frame.number == 16101", "timestamp_epoch": "1583962433.469243000" } ], "severity": "low", "confidence": 0.95, "finding_id": "finding-896e3727fe6edd69dacd950a", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "rule_version": "pcap-rules-v5" }, { "title": "Directory-service protocol activity", "status": "candidate", "metrics": { "source": "10.3.11.119", "protocol": "samr", "destination": "10.3.11.3", "event_count": 30, "operation_numbers": [ "1", "16", "17", "3", "34", "36", "39", "5", "6", "64", "7" ] }, "rule_id": "directory-service-activity", "evidence": [ { "tcp_stream": 180, "frame_number": 3866, "display_filter": "frame.number == 3866", "timestamp_epoch": "1583961831.539577000" }, { "tcp_stream": 180, "frame_number": 3868, "display_filter": "frame.number == 3868", "timestamp_epoch": "1583961831.540299000" }, { "tcp_stream": 180, "frame_number": 3870, "display_filter": "frame.number == 3870", "timestamp_epoch": "1583961831.543416000" }, { "tcp_stream": 180, "frame_number": 3872, "display_filter": "frame.number == 3872", "timestamp_epoch": "1583961831.544195000" }, { "tcp_stream": 180, "frame_number": 3874, "display_filter": "frame.number == 3874", "timestamp_epoch": "1583961831.544846000" }, { "tcp_stream": 180, "frame_number": 3876, "display_filter": "frame.number == 3876", "timestamp_epoch": "1583961831.545688000" }, { "tcp_stream": 180, "frame_number": 3878, "display_filter": "frame.number == 3878", "timestamp_epoch": "1583961831.546939000" }, { "tcp_stream": 180, "frame_number": 3880, "display_filter": "frame.number == 3880", "timestamp_epoch": "1583961831.547995000" }, { "tcp_stream": 180, "frame_number": 3882, "display_filter": "frame.number == 3882", "timestamp_epoch": "1583961831.548772000" }, { "tcp_stream": 180, "frame_number": 3884, "display_filter": "frame.number == 3884", "timestamp_epoch": "1583961831.549532000" }, { "tcp_stream": 180, "frame_number": 3886, "display_filter": "frame.number == 3886", "timestamp_epoch": "1583961831.550231000" }, { "tcp_stream": 180, "frame_number": 3888, "display_filter": "frame.number == 3888", "timestamp_epoch": "1583961831.550999000" }, { "tcp_stream": 180, "frame_number": 3890, "display_filter": "frame.number == 3890", "timestamp_epoch": "1583961831.551821000" }, { "tcp_stream": 180, "frame_number": 3892, "display_filter": "frame.number == 3892", "timestamp_epoch": "1583961831.552412000" }, { "tcp_stream": 180, "frame_number": 3894, "display_filter": "frame.number == 3894", "timestamp_epoch": "1583961831.552964000" }, { "tcp_stream": 645, "frame_number": 29793, "display_filter": "frame.number == 29793", "timestamp_epoch": "1583963206.456131000" }, { "tcp_stream": 645, "frame_number": 29795, "display_filter": "frame.number == 29795", "timestamp_epoch": "1583963206.456802000" }, { "tcp_stream": 645, "frame_number": 29797, "display_filter": "frame.number == 29797", "timestamp_epoch": "1583963206.457324000" }, { "tcp_stream": 645, "frame_number": 29799, "display_filter": "frame.number == 29799", "timestamp_epoch": "1583963206.457906000" }, { "tcp_stream": 645, "frame_number": 29801, "display_filter": "frame.number == 29801", "timestamp_epoch": "1583963206.459042000" }, { "tcp_stream": 645, "frame_number": 29803, "display_filter": "frame.number == 29803", "timestamp_epoch": "1583963206.459967000" }, { "tcp_stream": 645, "frame_number": 29805, "display_filter": "frame.number == 29805", "timestamp_epoch": "1583963206.460639000" }, { "tcp_stream": 645, "frame_number": 29807, "display_filter": "frame.number == 29807", "timestamp_epoch": "1583963206.461629000" }, { "tcp_stream": 645, "frame_number": 29809, "display_filter": "frame.number == 29809", "timestamp_epoch": "1583963206.462320000" }, { "tcp_stream": 645, "frame_number": 29811, "display_filter": "frame.number == 29811", "timestamp_epoch": "1583963206.463010000" }, { "tcp_stream": 645, "frame_number": 29813, "display_filter": "frame.number == 29813", "timestamp_epoch": "1583963206.463679000" }, { "tcp_stream": 645, "frame_number": 29815, "display_filter": "frame.number == 29815", "timestamp_epoch": "1583963206.464388000" }, { "tcp_stream": 645, "frame_number": 29817, "display_filter": "frame.number == 29817", "timestamp_epoch": "1583963206.464948000" }, { "tcp_stream": 645, "frame_number": 29819, "display_filter": "frame.number == 29819", "timestamp_epoch": "1583963206.465420000" }, { "tcp_stream": 645, "frame_number": 29821, "display_filter": "frame.number == 29821", "timestamp_epoch": "1583963206.466088000" } ], "severity": "low", "confidence": 0.95, "finding_id": "finding-40d7ec217ae23cac3e276da3", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "rule_version": "pcap-rules-v5" }, { "title": "Directory-service protocol activity", "status": "candidate", "metrics": { "source": "10.3.11.194", "protocol": "drsuapi", "destination": "10.3.11.3", "event_count": 26, "operation_numbers": [ "0", "1", "12", "30" ] }, "rule_id": "directory-service-activity", "evidence": [ { "tcp_stream": 58, "frame_number": 1216, "display_filter": "frame.number == 1216", "timestamp_epoch": "1583961781.254112000" }, { "tcp_stream": 58, "frame_number": 1218, "display_filter": "frame.number == 1218", "timestamp_epoch": "1583961781.255289000" }, { "tcp_stream": 58, "frame_number": 1220, "display_filter": "frame.number == 1220", "timestamp_epoch": "1583961781.256098000" }, { "tcp_stream": 58, "frame_number": 1230, "display_filter": "frame.number == 1230", "timestamp_epoch": "1583961781.259186000" }, { "tcp_stream": 58, "frame_number": 1232, "display_filter": "frame.number == 1232", "timestamp_epoch": "1583961781.260341000" }, { "tcp_stream": 58, "frame_number": 1234, "display_filter": "frame.number == 1234", "timestamp_epoch": "1583961781.261522000" }, { "tcp_stream": 58, "frame_number": 1367, "display_filter": "frame.number == 1367", "timestamp_epoch": "1583961781.757583000" }, { "tcp_stream": 58, "frame_number": 1369, "display_filter": "frame.number == 1369", "timestamp_epoch": "1583961781.757923000" }, { "tcp_stream": 58, "frame_number": 1371, "display_filter": "frame.number == 1371", "timestamp_epoch": "1583961781.758370000" }, { "tcp_stream": 58, "frame_number": 1373, "display_filter": "frame.number == 1373", "timestamp_epoch": "1583961781.758822000" }, { "tcp_stream": 58, "frame_number": 2122, "display_filter": "frame.number == 2122", "timestamp_epoch": "1583961800.968358000" }, { "tcp_stream": 58, "frame_number": 2124, "display_filter": "frame.number == 2124", "timestamp_epoch": "1583961800.969081000" }, { "tcp_stream": 58, "frame_number": 2126, "display_filter": "frame.number == 2126", "timestamp_epoch": "1583961800.969972000" }, { "tcp_stream": 58, "frame_number": 2128, "display_filter": "frame.number == 2128", "timestamp_epoch": "1583961800.970788000" }, { "tcp_stream": 252, "frame_number": 8082, "display_filter": "frame.number == 8082", "timestamp_epoch": "1583961870.372726000" }, { "tcp_stream": 252, "frame_number": 8084, "display_filter": "frame.number == 8084", "timestamp_epoch": "1583961870.373270000" }, { "tcp_stream": 252, "frame_number": 8086, "display_filter": "frame.number == 8086", "timestamp_epoch": "1583961870.374795000" }, { "tcp_stream": 252, "frame_number": 8090, "display_filter": "frame.number == 8090", "timestamp_epoch": "1583961870.377360000" }, { "tcp_stream": 252, "frame_number": 8092, "display_filter": "frame.number == 8092", "timestamp_epoch": "1583961870.377811000" }, { "tcp_stream": 252, "frame_number": 8094, "display_filter": "frame.number == 8094", "timestamp_epoch": "1583961870.378445000" }, { "tcp_stream": 452, "frame_number": 20151, "display_filter": "frame.number == 20151", "timestamp_epoch": "1583962619.267995000" }, { "tcp_stream": 452, "frame_number": 20153, "display_filter": "frame.number == 20153", "timestamp_epoch": "1583962619.268758000" }, { "tcp_stream": 452, "frame_number": 20155, "display_filter": "frame.number == 20155", "timestamp_epoch": "1583962619.269393000" }, { "tcp_stream": 452, "frame_number": 20159, "display_filter": "frame.number == 20159", "timestamp_epoch": "1583962619.271329000" }, { "tcp_stream": 452, "frame_number": 20161, "display_filter": "frame.number == 20161", "timestamp_epoch": "1583962619.272078000" }, { "tcp_stream": 452, "frame_number": 20163, "display_filter": "frame.number == 20163", "timestamp_epoch": "1583962619.273165000" } ], "severity": "low", "confidence": 0.95, "finding_id": "finding-f5a6ae16fa62636bb6953b5c", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "rule_version": "pcap-rules-v5" }, { "title": "Directory-service protocol activity", "status": "candidate", "metrics": { "source": "10.3.11.194", "protocol": "ldap", "destination": "10.3.11.3", "event_count": 154, "operation_numbers": [ "", "0", "2", "3" ] }, "rule_id": "directory-service-activity", "evidence": [ { "tcp_stream": 52, "frame_number": 1075, "display_filter": "frame.number == 1075", "timestamp_epoch": "1583961779.869860000" }, { "tcp_stream": 52, "frame_number": 1171, "display_filter": "frame.number == 1171", "timestamp_epoch": "1583961781.230479000" }, { "tcp_stream": 52, "frame_number": 1178, "display_filter": "frame.number == 1178", "timestamp_epoch": "1583961781.238565000" }, { "tcp_stream": 63, "frame_number": 1239, "display_filter": "frame.number == 1239", "timestamp_epoch": "1583961781.263514000" }, { "tcp_stream": 63, "frame_number": 1244, "display_filter": "frame.number == 1244", "timestamp_epoch": "1583961781.265476000" }, { "tcp_stream": 63, "frame_number": 1247, "display_filter": "frame.number == 1247", "timestamp_epoch": "1583961781.268509000" }, { "tcp_stream": 63, "frame_number": 1249, "display_filter": "frame.number == 1249", "timestamp_epoch": "1583961781.269493000" }, { "tcp_stream": 63, "frame_number": 1266, "display_filter": "frame.number == 1266", "timestamp_epoch": "1583961781.396733000" }, { "tcp_stream": 63, "frame_number": 1329, "display_filter": "frame.number == 1329", "timestamp_epoch": "1583961781.591831000" }, { "tcp_stream": 63, "frame_number": 1342, "display_filter": "frame.number == 1342", "timestamp_epoch": "1583961781.701691000" }, { "tcp_stream": 63, "frame_number": 1351, "display_filter": "frame.number == 1351", "timestamp_epoch": "1583961781.704324000" }, { "tcp_stream": 63, "frame_number": 1353, "display_filter": "frame.number == 1353", "timestamp_epoch": "1583961781.704798000" }, { "tcp_stream": 63, "frame_number": 1355, "display_filter": "frame.number == 1355", "timestamp_epoch": "1583961781.706374000" }, { "tcp_stream": 71, "frame_number": 1384, "display_filter": "frame.number == 1384", "timestamp_epoch": "1583961782.229016000" }, { "tcp_stream": 71, "frame_number": 1389, "display_filter": "frame.number == 1389", "timestamp_epoch": "1583961782.231459000" }, { "tcp_stream": 71, "frame_number": 1413, "display_filter": "frame.number == 1413", "timestamp_epoch": "1583961782.261397000" }, { "tcp_stream": 73, "frame_number": 1419, "display_filter": "frame.number == 1419", "timestamp_epoch": "1583961782.266315000" }, { "tcp_stream": 73, "frame_number": 1422, "display_filter": "frame.number == 1422", "timestamp_epoch": "1583961782.268552000" }, { "tcp_stream": 73, "frame_number": 1424, "display_filter": "frame.number == 1424", "timestamp_epoch": "1583961782.269216000" }, { "tcp_stream": 71, "frame_number": 1426, "display_filter": "frame.number == 1426", "timestamp_epoch": "1583961782.270302000" }, { "tcp_stream": 73, "frame_number": 1571, "display_filter": "frame.number == 1571", "timestamp_epoch": "1583961782.504700000" }, { "tcp_stream": 71, "frame_number": 1575, "display_filter": "frame.number == 1575", "timestamp_epoch": "1583961782.520520000" }, { "tcp_stream": 95, "frame_number": 1955, "display_filter": "frame.number == 1955", "timestamp_epoch": "1583961789.906473000" }, { "tcp_stream": 95, "frame_number": 1960, "display_filter": "frame.number == 1960", "timestamp_epoch": "1583961789.909925000" }, { "tcp_stream": 95, "frame_number": 1965, "display_filter": "frame.number == 1965", "timestamp_epoch": "1583961789.914383000" }, { "tcp_stream": 95, "frame_number": 1967, "display_filter": "frame.number == 1967", "timestamp_epoch": "1583961789.915255000" }, { "tcp_stream": 95, "frame_number": 1969, "display_filter": "frame.number == 1969", "timestamp_epoch": "1583961789.915793000" }, { "tcp_stream": 95, "frame_number": 1971, "display_filter": "frame.number == 1971", "timestamp_epoch": "1583961789.916598000" }, { "tcp_stream": 95, "frame_number": 1973, "display_filter": "frame.number == 1973", "timestamp_epoch": "1583961789.917408000" }, { "tcp_stream": 95, "frame_number": 2006, "display_filter": "frame.number == 2006", "timestamp_epoch": "1583961789.949556000" }, { "tcp_stream": 109, "frame_number": 2248, "display_filter": "frame.number == 2248", "timestamp_epoch": "1583961801.304771000" }, { "tcp_stream": 109, "frame_number": 2252, "display_filter": "frame.number == 2252", "timestamp_epoch": "1583961801.312482000" }, { "tcp_stream": 110, "frame_number": 2260, "display_filter": "frame.number == 2260", "timestamp_epoch": "1583961801.332921000" }, { "tcp_stream": 110, "frame_number": 2263, "display_filter": "frame.number == 2263", "timestamp_epoch": "1583961801.334876000" }, { "tcp_stream": 110, "frame_number": 2265, "display_filter": "frame.number == 2265", "timestamp_epoch": "1583961801.335506000" }, { "tcp_stream": 109, "frame_number": 2267, "display_filter": "frame.number == 2267", "timestamp_epoch": "1583961801.336235000" }, { "tcp_stream": 110, "frame_number": 2272, "display_filter": "frame.number == 2272", "timestamp_epoch": "1583961801.664944000" }, { "tcp_stream": 109, "frame_number": 2276, "display_filter": "frame.number == 2276", "timestamp_epoch": "1583961801.684911000" }, { "tcp_stream": 253, "frame_number": 8099, "display_filter": "frame.number == 8099", "timestamp_epoch": "1583961870.382479000" }, { "tcp_stream": 253, "frame_number": 8104, "display_filter": "frame.number == 8104", "timestamp_epoch": "1583961870.385349000" }, { "tcp_stream": 253, "frame_number": 8107, "display_filter": "frame.number == 8107", "timestamp_epoch": "1583961870.387213000" }, { "tcp_stream": 253, "frame_number": 8109, "display_filter": "frame.number == 8109", "timestamp_epoch": "1583961870.388261000" }, { "tcp_stream": 253, "frame_number": 8111, "display_filter": "frame.number == 8111", "timestamp_epoch": "1583961870.388851000" }, { "tcp_stream": 254, "frame_number": 8117, "display_filter": "frame.number == 8117", "timestamp_epoch": "1583961870.395969000" }, { "tcp_stream": 254, "frame_number": 8120, "display_filter": "frame.number == 8120", "timestamp_epoch": "1583961870.398074000" }, { "tcp_stream": 254, "frame_number": 8125, "display_filter": "frame.number == 8125", "timestamp_epoch": "1583961870.399053000" }, { "tcp_stream": 254, "frame_number": 8127, "display_filter": "frame.number == 8127", "timestamp_epoch": "1583961870.399611000" }, { "tcp_stream": 253, "frame_number": 8129, "display_filter": "frame.number == 8129", "timestamp_epoch": "1583961870.400009000" }, { "tcp_stream": 256, "frame_number": 8270, "display_filter": "frame.number == 8270", "timestamp_epoch": "1583961872.519985000" }, { "tcp_stream": 256, "frame_number": 8290, "display_filter": "frame.number == 8290", "timestamp_epoch": "1583961872.527613000" }, { "tcp_stream": 256, "frame_number": 8306, "display_filter": "frame.number == 8306", "timestamp_epoch": "1583961872.543878000" }, { "tcp_stream": 256, "frame_number": 8308, "display_filter": "frame.number == 8308", "timestamp_epoch": "1583961872.551421000" }, { "tcp_stream": 416, "frame_number": 16363, "display_filter": "frame.number == 16363", "timestamp_epoch": "1583962545.040157000" }, { "tcp_stream": 416, "frame_number": 16366, "display_filter": "frame.number == 16366", "timestamp_epoch": "1583962545.041591000" }, { "tcp_stream": 456, "frame_number": 20168, "display_filter": "frame.number == 20168", "timestamp_epoch": "1583962619.287451000" }, { "tcp_stream": 456, "frame_number": 20185, "display_filter": "frame.number == 20185", "timestamp_epoch": "1583962619.290624000" }, { "tcp_stream": 456, "frame_number": 20188, "display_filter": "frame.number == 20188", "timestamp_epoch": "1583962619.295464000" }, { "tcp_stream": 456, "frame_number": 20191, "display_filter": "frame.number == 20191", "timestamp_epoch": "1583962619.297040000" }, { "tcp_stream": 456, "frame_number": 20193, "display_filter": "frame.number == 20193", "timestamp_epoch": "1583962619.298206000" }, { "tcp_stream": 456, "frame_number": 20195, "display_filter": "frame.number == 20195", "timestamp_epoch": "1583962619.298801000" }, { "tcp_stream": 456, "frame_number": 20197, "display_filter": "frame.number == 20197", "timestamp_epoch": "1583962619.299744000" }, { "tcp_stream": 458, "frame_number": 20439, "display_filter": "frame.number == 20439", "timestamp_epoch": "1583962619.471660000" }, { "tcp_stream": 458, "frame_number": 20444, "display_filter": "frame.number == 20444", "timestamp_epoch": "1583962619.473010000" }, { "tcp_stream": 458, "frame_number": 20447, "display_filter": "frame.number == 20447", "timestamp_epoch": "1583962619.474180000" }, { "tcp_stream": 458, "frame_number": 20449, "display_filter": "frame.number == 20449", "timestamp_epoch": "1583962619.474675000" }, { "tcp_stream": 458, "frame_number": 20451, "display_filter": "frame.number == 20451", "timestamp_epoch": "1583962619.475212000" }, { "tcp_stream": 458, "frame_number": 20453, "display_filter": "frame.number == 20453", "timestamp_epoch": "1583962619.475806000" }, { "tcp_stream": 458, "frame_number": 20457, "display_filter": "frame.number == 20457", "timestamp_epoch": "1583962619.479248000" }, { "tcp_stream": 458, "frame_number": 20459, "display_filter": "frame.number == 20459", "timestamp_epoch": "1583962619.479867000" }, { "tcp_stream": 458, "frame_number": 20461, "display_filter": "frame.number == 20461", "timestamp_epoch": "1583962619.480275000" }, { "tcp_stream": 458, "frame_number": 20463, "display_filter": "frame.number == 20463", "timestamp_epoch": "1583962619.480785000" }, { "tcp_stream": 458, "frame_number": 20467, "display_filter": "frame.number == 20467", "timestamp_epoch": "1583962619.481935000" }, { "tcp_stream": 458, "frame_number": 20469, "display_filter": "frame.number == 20469", "timestamp_epoch": "1583962619.482603000" }, { "tcp_stream": 458, "frame_number": 20471, "display_filter": "frame.number == 20471", "timestamp_epoch": "1583962619.483026000" }, { "tcp_stream": 458, "frame_number": 20473, "display_filter": "frame.number == 20473", "timestamp_epoch": "1583962619.483490000" }, { "tcp_stream": 458, "frame_number": 20477, "display_filter": "frame.number == 20477", "timestamp_epoch": "1583962619.484662000" }, { "tcp_stream": 458, "frame_number": 20479, "display_filter": "frame.number == 20479", "timestamp_epoch": "1583962619.485429000" }, { "tcp_stream": 458, "frame_number": 20481, "display_filter": "frame.number == 20481", "timestamp_epoch": "1583962619.485835000" }, { "tcp_stream": 458, "frame_number": 20483, "display_filter": "frame.number == 20483", "timestamp_epoch": "1583962619.486354000" }, { "tcp_stream": 458, "frame_number": 20487, "display_filter": "frame.number == 20487", "timestamp_epoch": "1583962619.487894000" }, { "tcp_stream": 458, "frame_number": 20489, "display_filter": "frame.number == 20489", "timestamp_epoch": "1583962619.488531000" }, { "tcp_stream": 458, "frame_number": 20491, "display_filter": "frame.number == 20491", "timestamp_epoch": "1583962619.488905000" }, { "tcp_stream": 458, "frame_number": 20493, "display_filter": "frame.number == 20493", "timestamp_epoch": "1583962619.489362000" }, { "tcp_stream": 458, "frame_number": 20497, "display_filter": "frame.number == 20497", "timestamp_epoch": "1583962619.490600000" }, { "tcp_stream": 458, "frame_number": 20499, "display_filter": "frame.number == 20499", "timestamp_epoch": "1583962619.491234000" }, { "tcp_stream": 458, "frame_number": 20501, "display_filter": "frame.number == 20501", "timestamp_epoch": "1583962619.491538000" }, { "tcp_stream": 458, "frame_number": 20503, "display_filter": "frame.number == 20503", "timestamp_epoch": "1583962619.492041000" }, { "tcp_stream": 458, "frame_number": 20507, "display_filter": "frame.number == 20507", "timestamp_epoch": "1583962619.493186000" }, { "tcp_stream": 458, "frame_number": 20509, "display_filter": "frame.number == 20509", "timestamp_epoch": "1583962619.493839000" }, { "tcp_stream": 458, "frame_number": 20511, "display_filter": "frame.number == 20511", "timestamp_epoch": "1583962619.494208000" }, { "tcp_stream": 458, "frame_number": 20513, "display_filter": "frame.number == 20513", "timestamp_epoch": "1583962619.494672000" }, { "tcp_stream": 458, "frame_number": 20517, "display_filter": "frame.number == 20517", "timestamp_epoch": "1583962619.495826000" }, { "tcp_stream": 458, "frame_number": 20519, "display_filter": "frame.number == 20519", "timestamp_epoch": "1583962619.496453000" }, { "tcp_stream": 458, "frame_number": 20521, "display_filter": "frame.number == 20521", "timestamp_epoch": "1583962619.496856000" }, { "tcp_stream": 458, "frame_number": 20523, "display_filter": "frame.number == 20523", "timestamp_epoch": "1583962619.497360000" }, { "tcp_stream": 458, "frame_number": 20527, "display_filter": "frame.number == 20527", "timestamp_epoch": "1583962619.498599000" }, { "tcp_stream": 458, "frame_number": 20529, "display_filter": "frame.number == 20529", "timestamp_epoch": "1583962619.499228000" }, { "tcp_stream": 458, "frame_number": 20531, "display_filter": "frame.number == 20531", "timestamp_epoch": "1583962619.499672000" }, { "tcp_stream": 458, "frame_number": 20533, "display_filter": "frame.number == 20533", "timestamp_epoch": "1583962619.500092000" }, { "tcp_stream": 458, "frame_number": 20537, "display_filter": "frame.number == 20537", "timestamp_epoch": "1583962619.501213000" } ], "severity": "low", "confidence": 0.95, "finding_id": "finding-b5d309c8fb374027d891a101", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "rule_version": "pcap-rules-v5" }, { "title": "Directory-service protocol activity", "status": "candidate", "metrics": { "source": "10.3.11.194", "protocol": "samr", "destination": "10.3.11.3", "event_count": 30, "operation_numbers": [ "1", "16", "17", "3", "34", "36", "39", "5", "6", "64", "7" ] }, "rule_id": "directory-service-activity", "evidence": [ { "tcp_stream": 104, "frame_number": 2167, "display_filter": "frame.number == 2167", "timestamp_epoch": "1583961801.016998000" }, { "tcp_stream": 104, "frame_number": 2169, "display_filter": "frame.number == 2169", "timestamp_epoch": "1583961801.017867000" }, { "tcp_stream": 104, "frame_number": 2171, "display_filter": "frame.number == 2171", "timestamp_epoch": "1583961801.018566000" }, { "tcp_stream": 104, "frame_number": 2173, "display_filter": "frame.number == 2173", "timestamp_epoch": "1583961801.019419000" }, { "tcp_stream": 104, "frame_number": 2175, "display_filter": "frame.number == 2175", "timestamp_epoch": "1583961801.020054000" }, { "tcp_stream": 104, "frame_number": 2177, "display_filter": "frame.number == 2177", "timestamp_epoch": "1583961801.020634000" }, { "tcp_stream": 104, "frame_number": 2179, "display_filter": "frame.number == 2179", "timestamp_epoch": "1583961801.021406000" }, { "tcp_stream": 104, "frame_number": 2181, "display_filter": "frame.number == 2181", "timestamp_epoch": "1583961801.022294000" }, { "tcp_stream": 104, "frame_number": 2183, "display_filter": "frame.number == 2183", "timestamp_epoch": "1583961801.022946000" }, { "tcp_stream": 104, "frame_number": 2185, "display_filter": "frame.number == 2185", "timestamp_epoch": "1583961801.023789000" }, { "tcp_stream": 104, "frame_number": 2187, "display_filter": "frame.number == 2187", "timestamp_epoch": "1583961801.024530000" }, { "tcp_stream": 104, "frame_number": 2189, "display_filter": "frame.number == 2189", "timestamp_epoch": "1583961801.025244000" }, { "tcp_stream": 104, "frame_number": 2191, "display_filter": "frame.number == 2191", "timestamp_epoch": "1583961801.025958000" }, { "tcp_stream": 104, "frame_number": 2193, "display_filter": "frame.number == 2193", "timestamp_epoch": "1583961801.026642000" }, { "tcp_stream": 104, "frame_number": 2195, "display_filter": "frame.number == 2195", "timestamp_epoch": "1583961801.027216000" }, { "tcp_stream": 639, "frame_number": 29570, "display_filter": "frame.number == 29570", "timestamp_epoch": "1583963172.291390000" }, { "tcp_stream": 639, "frame_number": 29572, "display_filter": "frame.number == 29572", "timestamp_epoch": "1583963172.292020000" }, { "tcp_stream": 639, "frame_number": 29574, "display_filter": "frame.number == 29574", "timestamp_epoch": "1583963172.292723000" }, { "tcp_stream": 639, "frame_number": 29576, "display_filter": "frame.number == 29576", "timestamp_epoch": "1583963172.293223000" }, { "tcp_stream": 639, "frame_number": 29578, "display_filter": "frame.number == 29578", "timestamp_epoch": "1583963172.294657000" }, { "tcp_stream": 639, "frame_number": 29580, "display_filter": "frame.number == 29580", "timestamp_epoch": "1583963172.295704000" }, { "tcp_stream": 639, "frame_number": 29582, "display_filter": "frame.number == 29582", "timestamp_epoch": "1583963172.296777000" }, { "tcp_stream": 639, "frame_number": 29584, "display_filter": "frame.number == 29584", "timestamp_epoch": "1583963172.298079000" }, { "tcp_stream": 639, "frame_number": 29586, "display_filter": "frame.number == 29586", "timestamp_epoch": "1583963172.298786000" }, { "tcp_stream": 639, "frame_number": 29588, "display_filter": "frame.number == 29588", "timestamp_epoch": "1583963172.299516000" }, { "tcp_stream": 639, "frame_number": 29590, "display_filter": "frame.number == 29590", "timestamp_epoch": "1583963172.300145000" }, { "tcp_stream": 639, "frame_number": 29592, "display_filter": "frame.number == 29592", "timestamp_epoch": "1583963172.300808000" }, { "tcp_stream": 639, "frame_number": 29594, "display_filter": "frame.number == 29594", "timestamp_epoch": "1583963172.301288000" }, { "tcp_stream": 639, "frame_number": 29596, "display_filter": "frame.number == 29596", "timestamp_epoch": "1583963172.301775000" }, { "tcp_stream": 639, "frame_number": 29598, "display_filter": "frame.number == 29598", "timestamp_epoch": "1583963172.302214000" } ], "severity": "low", "confidence": 0.95, "finding_id": "finding-f7a5ebcf901fd461e2eb03d6", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "rule_version": "pcap-rules-v5" }, { "title": "Directory-service protocol activity", "status": "candidate", "metrics": { "source": "10.3.11.218", "protocol": "drsuapi", "destination": "10.3.11.3", "event_count": 32, "operation_numbers": [ "0", "1", "12", "30" ] }, "rule_id": "directory-service-activity", "evidence": [ { "tcp_stream": 2, "frame_number": 124, "display_filter": "frame.number == 124", "timestamp_epoch": "1583961755.535517000" }, { "tcp_stream": 2, "frame_number": 126, "display_filter": "frame.number == 126", "timestamp_epoch": "1583961755.536095000" }, { "tcp_stream": 2, "frame_number": 128, "display_filter": "frame.number == 128", "timestamp_epoch": "1583961755.537196000" }, { "tcp_stream": 2, "frame_number": 142, "display_filter": "frame.number == 142", "timestamp_epoch": "1583961755.541707000" }, { "tcp_stream": 2, "frame_number": 144, "display_filter": "frame.number == 144", "timestamp_epoch": "1583961755.543857000" }, { "tcp_stream": 2, "frame_number": 146, "display_filter": "frame.number == 146", "timestamp_epoch": "1583961755.545942000" }, { "tcp_stream": 2, "frame_number": 309, "display_filter": "frame.number == 309", "timestamp_epoch": "1583961756.107768000" }, { "tcp_stream": 2, "frame_number": 311, "display_filter": "frame.number == 311", "timestamp_epoch": "1583961756.108175000" }, { "tcp_stream": 2, "frame_number": 313, "display_filter": "frame.number == 313", "timestamp_epoch": "1583961756.108621000" }, { "tcp_stream": 2, "frame_number": 315, "display_filter": "frame.number == 315", "timestamp_epoch": "1583961756.109524000" }, { "tcp_stream": 29, "frame_number": 570, "display_filter": "frame.number == 570", "timestamp_epoch": "1583961758.487165000" }, { "tcp_stream": 29, "frame_number": 572, "display_filter": "frame.number == 572", "timestamp_epoch": "1583961758.487858000" }, { "tcp_stream": 29, "frame_number": 574, "display_filter": "frame.number == 574", "timestamp_epoch": "1583961758.488429000" }, { "tcp_stream": 29, "frame_number": 578, "display_filter": "frame.number == 578", "timestamp_epoch": "1583961758.489905000" }, { "tcp_stream": 29, "frame_number": 580, "display_filter": "frame.number == 580", "timestamp_epoch": "1583961758.490346000" }, { "tcp_stream": 29, "frame_number": 582, "display_filter": "frame.number == 582", "timestamp_epoch": "1583961758.490900000" }, { "tcp_stream": 2, "frame_number": 1641, "display_filter": "frame.number == 1641", "timestamp_epoch": "1583961783.484661000" }, { "tcp_stream": 2, "frame_number": 1643, "display_filter": "frame.number == 1643", "timestamp_epoch": "1583961783.485902000" }, { "tcp_stream": 2, "frame_number": 1645, "display_filter": "frame.number == 1645", "timestamp_epoch": "1583961783.487003000" }, { "tcp_stream": 2, "frame_number": 1647, "display_filter": "frame.number == 1647", "timestamp_epoch": "1583961783.487978000" }, { "tcp_stream": 194, "frame_number": 4193, "display_filter": "frame.number == 4193", "timestamp_epoch": "1583961844.416717000" }, { "tcp_stream": 194, "frame_number": 4195, "display_filter": "frame.number == 4195", "timestamp_epoch": "1583961844.417694000" }, { "tcp_stream": 194, "frame_number": 4197, "display_filter": "frame.number == 4197", "timestamp_epoch": "1583961844.418646000" }, { "tcp_stream": 194, "frame_number": 4201, "display_filter": "frame.number == 4201", "timestamp_epoch": "1583961844.420285000" }, { "tcp_stream": 194, "frame_number": 4203, "display_filter": "frame.number == 4203", "timestamp_epoch": "1583961844.420973000" }, { "tcp_stream": 194, "frame_number": 4205, "display_filter": "frame.number == 4205", "timestamp_epoch": "1583961844.421515000" }, { "tcp_stream": 362, "frame_number": 14156, "display_filter": "frame.number == 14156", "timestamp_epoch": "1583962055.690792000" }, { "tcp_stream": 362, "frame_number": 14158, "display_filter": "frame.number == 14158", "timestamp_epoch": "1583962055.691678000" }, { "tcp_stream": 362, "frame_number": 14160, "display_filter": "frame.number == 14160", "timestamp_epoch": "1583962055.692268000" }, { "tcp_stream": 362, "frame_number": 14164, "display_filter": "frame.number == 14164", "timestamp_epoch": "1583962055.693947000" }, { "tcp_stream": 362, "frame_number": 14166, "display_filter": "frame.number == 14166", "timestamp_epoch": "1583962055.694403000" }, { "tcp_stream": 362, "frame_number": 14168, "display_filter": "frame.number == 14168", "timestamp_epoch": "1583962055.694949000" } ], "severity": "low", "confidence": 0.95, "finding_id": "finding-880b3f6c70a77d6e5f3c95a6", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "rule_version": "pcap-rules-v5" }, { "title": "Directory-service protocol activity", "status": "candidate", "metrics": { "source": "10.3.11.218", "protocol": "ldap", "destination": "10.3.11.3", "event_count": 73, "operation_numbers": [ "", "0", "2", "3" ] }, "rule_id": "directory-service-activity", "evidence": [ { "tcp_stream": 3, "frame_number": 48, "display_filter": "frame.number == 48", "timestamp_epoch": "1583961755.355025000" }, { "tcp_stream": 3, "frame_number": 89, "display_filter": "frame.number == 89", "timestamp_epoch": "1583961755.490610000" }, { "tcp_stream": 3, "frame_number": 92, "display_filter": "frame.number == 92", "timestamp_epoch": "1583961755.493339000" }, { "tcp_stream": 3, "frame_number": 94, "display_filter": "frame.number == 94", "timestamp_epoch": "1583961755.494519000" }, { "tcp_stream": 3, "frame_number": 160, "display_filter": "frame.number == 160", "timestamp_epoch": "1583961755.635399000" }, { "tcp_stream": 18, "frame_number": 255, "display_filter": "frame.number == 255", "timestamp_epoch": "1583961755.860435000" }, { "tcp_stream": 18, "frame_number": 258, "display_filter": "frame.number == 258", "timestamp_epoch": "1583961755.865606000" }, { "tcp_stream": 3, "frame_number": 264, "display_filter": "frame.number == 264", "timestamp_epoch": "1583961755.886463000" }, { "tcp_stream": 3, "frame_number": 283, "display_filter": "frame.number == 283", "timestamp_epoch": "1583961755.994156000" }, { "tcp_stream": 3, "frame_number": 292, "display_filter": "frame.number == 292", "timestamp_epoch": "1583961755.996217000" }, { "tcp_stream": 3, "frame_number": 295, "display_filter": "frame.number == 295", "timestamp_epoch": "1583961755.996846000" }, { "tcp_stream": 3, "frame_number": 297, "display_filter": "frame.number == 297", "timestamp_epoch": "1583961755.997389000" }, { "tcp_stream": 22, "frame_number": 326, "display_filter": "frame.number == 326", "timestamp_epoch": "1583961756.517808000" }, { "tcp_stream": 22, "frame_number": 331, "display_filter": "frame.number == 331", "timestamp_epoch": "1583961756.521469000" }, { "tcp_stream": 22, "frame_number": 347, "display_filter": "frame.number == 347", "timestamp_epoch": "1583961756.587955000" }, { "tcp_stream": 24, "frame_number": 353, "display_filter": "frame.number == 353", "timestamp_epoch": "1583961756.594953000" }, { "tcp_stream": 24, "frame_number": 356, "display_filter": "frame.number == 356", "timestamp_epoch": "1583961756.596931000" }, { "tcp_stream": 24, "frame_number": 358, "display_filter": "frame.number == 358", "timestamp_epoch": "1583961756.597790000" }, { "tcp_stream": 22, "frame_number": 360, "display_filter": "frame.number == 360", "timestamp_epoch": "1583961756.598941000" }, { "tcp_stream": 24, "frame_number": 506, "display_filter": "frame.number == 506", "timestamp_epoch": "1583961756.943006000" }, { "tcp_stream": 22, "frame_number": 511, "display_filter": "frame.number == 511", "timestamp_epoch": "1583961756.981858000" }, { "tcp_stream": 30, "frame_number": 596, "display_filter": "frame.number == 596", "timestamp_epoch": "1583961758.612172000" }, { "tcp_stream": 30, "frame_number": 601, "display_filter": "frame.number == 601", "timestamp_epoch": "1583961758.614413000" }, { "tcp_stream": 30, "frame_number": 606, "display_filter": "frame.number == 606", "timestamp_epoch": "1583961758.616522000" }, { "tcp_stream": 30, "frame_number": 608, "display_filter": "frame.number == 608", "timestamp_epoch": "1583961758.617896000" }, { "tcp_stream": 30, "frame_number": 610, "display_filter": "frame.number == 610", "timestamp_epoch": "1583961758.622990000" }, { "tcp_stream": 32, "frame_number": 616, "display_filter": "frame.number == 616", "timestamp_epoch": "1583961758.626812000" }, { "tcp_stream": 32, "frame_number": 619, "display_filter": "frame.number == 619", "timestamp_epoch": "1583961758.629314000" }, { "tcp_stream": 32, "frame_number": 624, "display_filter": "frame.number == 624", "timestamp_epoch": "1583961758.631713000" }, { "tcp_stream": 32, "frame_number": 626, "display_filter": "frame.number == 626", "timestamp_epoch": "1583961758.633625000" }, { "tcp_stream": 30, "frame_number": 630, "display_filter": "frame.number == 630", "timestamp_epoch": "1583961758.637371000" }, { "tcp_stream": 45, "frame_number": 942, "display_filter": "frame.number == 942", "timestamp_epoch": "1583961764.276575000" }, { "tcp_stream": 45, "frame_number": 947, "display_filter": "frame.number == 947", "timestamp_epoch": "1583961764.279535000" }, { "tcp_stream": 45, "frame_number": 950, "display_filter": "frame.number == 950", "timestamp_epoch": "1583961764.282618000" }, { "tcp_stream": 45, "frame_number": 952, "display_filter": "frame.number == 952", "timestamp_epoch": "1583961764.283309000" }, { "tcp_stream": 45, "frame_number": 954, "display_filter": "frame.number == 954", "timestamp_epoch": "1583961764.283838000" }, { "tcp_stream": 45, "frame_number": 956, "display_filter": "frame.number == 956", "timestamp_epoch": "1583961764.284586000" }, { "tcp_stream": 45, "frame_number": 958, "display_filter": "frame.number == 958", "timestamp_epoch": "1583961764.285230000" }, { "tcp_stream": 46, "frame_number": 964, "display_filter": "frame.number == 964", "timestamp_epoch": "1583961764.307177000" }, { "tcp_stream": 46, "frame_number": 968, "display_filter": "frame.number == 968", "timestamp_epoch": "1583961764.309701000" }, { "tcp_stream": 46, "frame_number": 1000, "display_filter": "frame.number == 1000", "timestamp_epoch": "1583961764.319460000" }, { "tcp_stream": 46, "frame_number": 1002, "display_filter": "frame.number == 1002", "timestamp_epoch": "1583961764.321385000" }, { "tcp_stream": 45, "frame_number": 1006, "display_filter": "frame.number == 1006", "timestamp_epoch": "1583961764.322377000" }, { "tcp_stream": 86, "frame_number": 1765, "display_filter": "frame.number == 1765", "timestamp_epoch": "1583961783.845560000" }, { "tcp_stream": 86, "frame_number": 1768, "display_filter": "frame.number == 1768", "timestamp_epoch": "1583961783.851358000" }, { "tcp_stream": 87, "frame_number": 1774, "display_filter": "frame.number == 1774", "timestamp_epoch": "1583961783.867213000" }, { "tcp_stream": 87, "frame_number": 1778, "display_filter": "frame.number == 1778", "timestamp_epoch": "1583961783.869260000" }, { "tcp_stream": 87, "frame_number": 1780, "display_filter": "frame.number == 1780", "timestamp_epoch": "1583961783.870075000" }, { "tcp_stream": 86, "frame_number": 1782, "display_filter": "frame.number == 1782", "timestamp_epoch": "1583961783.870826000" }, { "tcp_stream": 87, "frame_number": 1793, "display_filter": "frame.number == 1793", "timestamp_epoch": "1583961784.208010000" }, { "tcp_stream": 86, "frame_number": 1797, "display_filter": "frame.number == 1797", "timestamp_epoch": "1583961784.215634000" }, { "tcp_stream": 195, "frame_number": 4210, "display_filter": "frame.number == 4210", "timestamp_epoch": "1583961844.423709000" }, { "tcp_stream": 195, "frame_number": 4215, "display_filter": "frame.number == 4215", "timestamp_epoch": "1583961844.425286000" }, { "tcp_stream": 195, "frame_number": 4218, "display_filter": "frame.number == 4218", "timestamp_epoch": "1583961844.426516000" }, { "tcp_stream": 195, "frame_number": 4220, "display_filter": "frame.number == 4220", "timestamp_epoch": "1583961844.429266000" }, { "tcp_stream": 195, "frame_number": 4222, "display_filter": "frame.number == 4222", "timestamp_epoch": "1583961844.429899000" }, { "tcp_stream": 196, "frame_number": 4228, "display_filter": "frame.number == 4228", "timestamp_epoch": "1583961844.433816000" }, { "tcp_stream": 196, "frame_number": 4231, "display_filter": "frame.number == 4231", "timestamp_epoch": "1583961844.435291000" }, { "tcp_stream": 196, "frame_number": 4236, "display_filter": "frame.number == 4236", "timestamp_epoch": "1583961844.436425000" }, { "tcp_stream": 196, "frame_number": 4238, "display_filter": "frame.number == 4238", "timestamp_epoch": "1583961844.436967000" }, { "tcp_stream": 195, "frame_number": 4242, "display_filter": "frame.number == 4242", "timestamp_epoch": "1583961844.437351000" }, { "tcp_stream": 363, "frame_number": 14173, "display_filter": "frame.number == 14173", "timestamp_epoch": "1583962055.697608000" }, { "tcp_stream": 363, "frame_number": 14178, "display_filter": "frame.number == 14178", "timestamp_epoch": "1583962055.699463000" }, { "tcp_stream": 363, "frame_number": 14181, "display_filter": "frame.number == 14181", "timestamp_epoch": "1583962055.701231000" }, { "tcp_stream": 363, "frame_number": 14183, "display_filter": "frame.number == 14183", "timestamp_epoch": "1583962055.702016000" }, { "tcp_stream": 363, "frame_number": 14185, "display_filter": "frame.number == 14185", "timestamp_epoch": "1583962055.702590000" }, { "tcp_stream": 364, "frame_number": 14191, "display_filter": "frame.number == 14191", "timestamp_epoch": "1583962055.706933000" }, { "tcp_stream": 364, "frame_number": 14194, "display_filter": "frame.number == 14194", "timestamp_epoch": "1583962055.708515000" }, { "tcp_stream": 364, "frame_number": 14199, "display_filter": "frame.number == 14199", "timestamp_epoch": "1583962055.709276000" }, { "tcp_stream": 364, "frame_number": 14201, "display_filter": "frame.number == 14201", "timestamp_epoch": "1583962055.709840000" }, { "tcp_stream": 363, "frame_number": 14205, "display_filter": "frame.number == 14205", "timestamp_epoch": "1583962055.710352000" }, { "tcp_stream": 404, "frame_number": 15673, "display_filter": "frame.number == 15673", "timestamp_epoch": "1583962386.801974000" }, { "tcp_stream": 404, "frame_number": 15676, "display_filter": "frame.number == 15676", "timestamp_epoch": "1583962386.803655000" } ], "severity": "low", "confidence": 0.95, "finding_id": "finding-35f8dd8e0444afddbae1600d", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "rule_version": "pcap-rules-v5" }, { "title": "Directory-service protocol activity", "status": "candidate", "metrics": { "source": "10.3.11.218", "protocol": "samr", "destination": "10.3.11.3", "event_count": 30, "operation_numbers": [ "1", "16", "17", "3", "34", "36", "39", "5", "6", "64", "7" ] }, "rule_id": "directory-service-activity", "evidence": [ { "tcp_stream": 81, "frame_number": 1683, "display_filter": "frame.number == 1683", "timestamp_epoch": "1583961783.543910000" }, { "tcp_stream": 81, "frame_number": 1685, "display_filter": "frame.number == 1685", "timestamp_epoch": "1583961783.545049000" }, { "tcp_stream": 81, "frame_number": 1687, "display_filter": "frame.number == 1687", "timestamp_epoch": "1583961783.545711000" }, { "tcp_stream": 81, "frame_number": 1689, "display_filter": "frame.number == 1689", "timestamp_epoch": "1583961783.546555000" }, { "tcp_stream": 81, "frame_number": 1691, "display_filter": "frame.number == 1691", "timestamp_epoch": "1583961783.547874000" }, { "tcp_stream": 81, "frame_number": 1693, "display_filter": "frame.number == 1693", "timestamp_epoch": "1583961783.548844000" }, { "tcp_stream": 81, "frame_number": 1695, "display_filter": "frame.number == 1695", "timestamp_epoch": "1583961783.550201000" }, { "tcp_stream": 81, "frame_number": 1697, "display_filter": "frame.number == 1697", "timestamp_epoch": "1583961783.551380000" }, { "tcp_stream": 81, "frame_number": 1699, "display_filter": "frame.number == 1699", "timestamp_epoch": "1583961783.552725000" }, { "tcp_stream": 81, "frame_number": 1701, "display_filter": "frame.number == 1701", "timestamp_epoch": "1583961783.554327000" }, { "tcp_stream": 81, "frame_number": 1703, "display_filter": "frame.number == 1703", "timestamp_epoch": "1583961783.555640000" }, { "tcp_stream": 81, "frame_number": 1705, "display_filter": "frame.number == 1705", "timestamp_epoch": "1583961783.562945000" }, { "tcp_stream": 81, "frame_number": 1707, "display_filter": "frame.number == 1707", "timestamp_epoch": "1583961783.564153000" }, { "tcp_stream": 81, "frame_number": 1709, "display_filter": "frame.number == 1709", "timestamp_epoch": "1583961783.565899000" }, { "tcp_stream": 81, "frame_number": 1711, "display_filter": "frame.number == 1711", "timestamp_epoch": "1583961783.572530000" }, { "tcp_stream": 643, "frame_number": 29679, "display_filter": "frame.number == 29679", "timestamp_epoch": "1583963188.854903000" }, { "tcp_stream": 643, "frame_number": 29683, "display_filter": "frame.number == 29683", "timestamp_epoch": "1583963188.856052000" }, { "tcp_stream": 643, "frame_number": 29687, "display_filter": "frame.number == 29687", "timestamp_epoch": "1583963188.858447000" }, { "tcp_stream": 643, "frame_number": 29691, "display_filter": "frame.number == 29691", "timestamp_epoch": "1583963188.861107000" }, { "tcp_stream": 643, "frame_number": 29695, "display_filter": "frame.number == 29695", "timestamp_epoch": "1583963188.864609000" }, { "tcp_stream": 643, "frame_number": 29699, "display_filter": "frame.number == 29699", "timestamp_epoch": "1583963188.866810000" }, { "tcp_stream": 643, "frame_number": 29703, "display_filter": "frame.number == 29703", "timestamp_epoch": "1583963188.867805000" }, { "tcp_stream": 643, "frame_number": 29707, "display_filter": "frame.number == 29707", "timestamp_epoch": "1583963188.869779000" }, { "tcp_stream": 643, "frame_number": 29711, "display_filter": "frame.number == 29711", "timestamp_epoch": "1583963188.871225000" }, { "tcp_stream": 643, "frame_number": 29715, "display_filter": "frame.number == 29715", "timestamp_epoch": "1583963188.872693000" }, { "tcp_stream": 643, "frame_number": 29719, "display_filter": "frame.number == 29719", "timestamp_epoch": "1583963188.874966000" }, { "tcp_stream": 643, "frame_number": 29723, "display_filter": "frame.number == 29723", "timestamp_epoch": "1583963188.876053000" }, { "tcp_stream": 643, "frame_number": 29727, "display_filter": "frame.number == 29727", "timestamp_epoch": "1583963188.877155000" }, { "tcp_stream": 643, "frame_number": 29731, "display_filter": "frame.number == 29731", "timestamp_epoch": "1583963188.878116000" }, { "tcp_stream": 643, "frame_number": 29735, "display_filter": "frame.number == 29735", "timestamp_epoch": "1583963188.879148000" } ], "severity": "low", "confidence": 0.95, "finding_id": "finding-fc3ce94d78387bef147495e9", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "rule_version": "pcap-rules-v5" }, { "title": "Directory-service protocol activity", "status": "candidate", "metrics": { "source": "10.3.11.3", "protocol": "drsuapi", "destination": "10.3.11.119", "event_count": 32, "operation_numbers": [ "0", "1", "12", "30" ] }, "rule_id": "directory-service-activity", "evidence": [ { "tcp_stream": 129, "frame_number": 2653, "display_filter": "frame.number == 2653", "timestamp_epoch": "1583961813.162867000" }, { "tcp_stream": 129, "frame_number": 2656, "display_filter": "frame.number == 2656", "timestamp_epoch": "1583961813.163511000" }, { "tcp_stream": 129, "frame_number": 2658, "display_filter": "frame.number == 2658", "timestamp_epoch": "1583961813.164133000" }, { "tcp_stream": 129, "frame_number": 2674, "display_filter": "frame.number == 2674", "timestamp_epoch": "1583961813.169145000" }, { "tcp_stream": 129, "frame_number": 2676, "display_filter": "frame.number == 2676", "timestamp_epoch": "1583961813.171160000" }, { "tcp_stream": 129, "frame_number": 2678, "display_filter": "frame.number == 2678", "timestamp_epoch": "1583961813.173775000" }, { "tcp_stream": 129, "frame_number": 2791, "display_filter": "frame.number == 2791", "timestamp_epoch": "1583961813.619975000" }, { "tcp_stream": 129, "frame_number": 2793, "display_filter": "frame.number == 2793", "timestamp_epoch": "1583961813.620895000" }, { "tcp_stream": 129, "frame_number": 2795, "display_filter": "frame.number == 2795", "timestamp_epoch": "1583961813.621421000" }, { "tcp_stream": 129, "frame_number": 2797, "display_filter": "frame.number == 2797", "timestamp_epoch": "1583961813.621879000" }, { "tcp_stream": 144, "frame_number": 3050, "display_filter": "frame.number == 3050", "timestamp_epoch": "1583961815.811385000" }, { "tcp_stream": 144, "frame_number": 3052, "display_filter": "frame.number == 3052", "timestamp_epoch": "1583961815.812380000" }, { "tcp_stream": 144, "frame_number": 3054, "display_filter": "frame.number == 3054", "timestamp_epoch": "1583961815.812854000" }, { "tcp_stream": 144, "frame_number": 3058, "display_filter": "frame.number == 3058", "timestamp_epoch": "1583961815.814657000" }, { "tcp_stream": 144, "frame_number": 3060, "display_filter": "frame.number == 3060", "timestamp_epoch": "1583961815.815287000" }, { "tcp_stream": 144, "frame_number": 3062, "display_filter": "frame.number == 3062", "timestamp_epoch": "1583961815.815673000" }, { "tcp_stream": 129, "frame_number": 3822, "display_filter": "frame.number == 3822", "timestamp_epoch": "1583961831.475169000" }, { "tcp_stream": 129, "frame_number": 3824, "display_filter": "frame.number == 3824", "timestamp_epoch": "1583961831.475820000" }, { "tcp_stream": 129, "frame_number": 3828, "display_filter": "frame.number == 3828", "timestamp_epoch": "1583961831.476593000" }, { "tcp_stream": 129, "frame_number": 3830, "display_filter": "frame.number == 3830", "timestamp_epoch": "1583961831.477041000" }, { "tcp_stream": 264, "frame_number": 9759, "display_filter": "frame.number == 9759", "timestamp_epoch": "1583961892.421650000" }, { "tcp_stream": 264, "frame_number": 9761, "display_filter": "frame.number == 9761", "timestamp_epoch": "1583961892.423110000" }, { "tcp_stream": 264, "frame_number": 9763, "display_filter": "frame.number == 9763", "timestamp_epoch": "1583961892.423686000" }, { "tcp_stream": 264, "frame_number": 9767, "display_filter": "frame.number == 9767", "timestamp_epoch": "1583961892.426157000" }, { "tcp_stream": 264, "frame_number": 9769, "display_filter": "frame.number == 9769", "timestamp_epoch": "1583961892.426999000" }, { "tcp_stream": 264, "frame_number": 9771, "display_filter": "frame.number == 9771", "timestamp_epoch": "1583961892.427739000" }, { "tcp_stream": 368, "frame_number": 14363, "display_filter": "frame.number == 14363", "timestamp_epoch": "1583962113.814360000" }, { "tcp_stream": 368, "frame_number": 14365, "display_filter": "frame.number == 14365", "timestamp_epoch": "1583962113.814997000" }, { "tcp_stream": 368, "frame_number": 14367, "display_filter": "frame.number == 14367", "timestamp_epoch": "1583962113.815359000" }, { "tcp_stream": 368, "frame_number": 14371, "display_filter": "frame.number == 14371", "timestamp_epoch": "1583962113.817359000" }, { "tcp_stream": 368, "frame_number": 14373, "display_filter": "frame.number == 14373", "timestamp_epoch": "1583962113.817936000" }, { "tcp_stream": 368, "frame_number": 14375, "display_filter": "frame.number == 14375", "timestamp_epoch": "1583962113.818335000" } ], "severity": "low", "confidence": 0.95, "finding_id": "finding-d08ffb5aa8a0cb05e6e7e4ef", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "rule_version": "pcap-rules-v5" }, { "title": "Directory-service protocol activity", "status": "candidate", "metrics": { "source": "10.3.11.3", "protocol": "ldap", "destination": "10.3.11.119", "event_count": 59, "operation_numbers": [ "", "1", "4,19,19,19,5", "4,5", "5" ] }, "rule_id": "directory-service-activity", "evidence": [ { "tcp_stream": 119, "frame_number": 2495, "display_filter": "frame.number == 2495", "timestamp_epoch": "1583961811.058430000" }, { "tcp_stream": 122, "frame_number": 2567, "display_filter": "frame.number == 2567", "timestamp_epoch": "1583961813.030611000" }, { "tcp_stream": 122, "frame_number": 2631, "display_filter": "frame.number == 2631", "timestamp_epoch": "1583961813.158489000" }, { "tcp_stream": 119, "frame_number": 2647, "display_filter": "frame.number == 2647", "timestamp_epoch": "1583961813.161220000" }, { "tcp_stream": 122, "frame_number": 2648, "display_filter": "frame.number == 2648", "timestamp_epoch": "1583961813.161534000" }, { "tcp_stream": 122, "frame_number": 2654, "display_filter": "frame.number == 2654", "timestamp_epoch": "1583961813.163004000" }, { "tcp_stream": 122, "frame_number": 2693, "display_filter": "frame.number == 2693", "timestamp_epoch": "1583961813.296019000" }, { "tcp_stream": 122, "frame_number": 2746, "display_filter": "frame.number == 2746", "timestamp_epoch": "1583961813.450245000" }, { "tcp_stream": 122, "frame_number": 2763, "display_filter": "frame.number == 2763", "timestamp_epoch": "1583961813.559848000" }, { "tcp_stream": 122, "frame_number": 2771, "display_filter": "frame.number == 2771", "timestamp_epoch": "1583961813.562271000" }, { "tcp_stream": 122, "frame_number": 2775, "display_filter": "frame.number == 2775", "timestamp_epoch": "1583961813.563383000" }, { "tcp_stream": 137, "frame_number": 2817, "display_filter": "frame.number == 2817", "timestamp_epoch": "1583961814.055981000" }, { "tcp_stream": 137, "frame_number": 2822, "display_filter": "frame.number == 2822", "timestamp_epoch": "1583961814.059565000" }, { "tcp_stream": 137, "frame_number": 2837, "display_filter": "frame.number == 2837", "timestamp_epoch": "1583961814.116310000" }, { "tcp_stream": 139, "frame_number": 2844, "display_filter": "frame.number == 2844", "timestamp_epoch": "1583961814.135186000" }, { "tcp_stream": 139, "frame_number": 2846, "display_filter": "frame.number == 2846", "timestamp_epoch": "1583961814.136075000" }, { "tcp_stream": 139, "frame_number": 2849, "display_filter": "frame.number == 2849", "timestamp_epoch": "1583961814.136635000" }, { "tcp_stream": 137, "frame_number": 2851, "display_filter": "frame.number == 2851", "timestamp_epoch": "1583961814.137990000" }, { "tcp_stream": 145, "frame_number": 3074, "display_filter": "frame.number == 3074", "timestamp_epoch": "1583961815.919756000" }, { "tcp_stream": 145, "frame_number": 3079, "display_filter": "frame.number == 3079", "timestamp_epoch": "1583961815.921730000" }, { "tcp_stream": 145, "frame_number": 3081, "display_filter": "frame.number == 3081", "timestamp_epoch": "1583961815.922632000" }, { "tcp_stream": 145, "frame_number": 3083, "display_filter": "frame.number == 3083", "timestamp_epoch": "1583961815.923319000" }, { "tcp_stream": 145, "frame_number": 3085, "display_filter": "frame.number == 3085", "timestamp_epoch": "1583961815.923663000" }, { "tcp_stream": 146, "frame_number": 3092, "display_filter": "frame.number == 3092", "timestamp_epoch": "1583961815.927260000" }, { "tcp_stream": 146, "frame_number": 3096, "display_filter": "frame.number == 3096", "timestamp_epoch": "1583961815.928075000" }, { "tcp_stream": 146, "frame_number": 3099, "display_filter": "frame.number == 3099", "timestamp_epoch": "1583961815.928975000" }, { "tcp_stream": 169, "frame_number": 3624, "display_filter": "frame.number == 3624", "timestamp_epoch": "1583961821.346640000" }, { "tcp_stream": 169, "frame_number": 3629, "display_filter": "frame.number == 3629", "timestamp_epoch": "1583961821.349230000" }, { "tcp_stream": 169, "frame_number": 3631, "display_filter": "frame.number == 3631", "timestamp_epoch": "1583961821.351534000" }, { "tcp_stream": 169, "frame_number": 3633, "display_filter": "frame.number == 3633", "timestamp_epoch": "1583961821.352191000" }, { "tcp_stream": 169, "frame_number": 3635, "display_filter": "frame.number == 3635", "timestamp_epoch": "1583961821.352841000" }, { "tcp_stream": 169, "frame_number": 3637, "display_filter": "frame.number == 3637", "timestamp_epoch": "1583961821.353508000" }, { "tcp_stream": 169, "frame_number": 3639, "display_filter": "frame.number == 3639", "timestamp_epoch": "1583961821.354194000" }, { "tcp_stream": 170, "frame_number": 3646, "display_filter": "frame.number == 3646", "timestamp_epoch": "1583961821.369171000" }, { "tcp_stream": 170, "frame_number": 3648, "display_filter": "frame.number == 3648", "timestamp_epoch": "1583961821.370778000" }, { "tcp_stream": 170, "frame_number": 3680, "display_filter": "frame.number == 3680", "timestamp_epoch": "1583961821.380283000" }, { "tcp_stream": 185, "frame_number": 3950, "display_filter": "frame.number == 3950", "timestamp_epoch": "1583961831.835650000" }, { "tcp_stream": 185, "frame_number": 3952, "display_filter": "frame.number == 3952", "timestamp_epoch": "1583961831.841895000" }, { "tcp_stream": 186, "frame_number": 3959, "display_filter": "frame.number == 3959", "timestamp_epoch": "1583961831.846467000" }, { "tcp_stream": 186, "frame_number": 3961, "display_filter": "frame.number == 3961", "timestamp_epoch": "1583961831.847117000" }, { "tcp_stream": 186, "frame_number": 3963, "display_filter": "frame.number == 3963", "timestamp_epoch": "1583961831.847613000" }, { "tcp_stream": 185, "frame_number": 3965, "display_filter": "frame.number == 3965", "timestamp_epoch": "1583961831.848955000" }, { "tcp_stream": 265, "frame_number": 9777, "display_filter": "frame.number == 9777", "timestamp_epoch": "1583961892.431876000" }, { "tcp_stream": 265, "frame_number": 9782, "display_filter": "frame.number == 9782", "timestamp_epoch": "1583961892.435791000" }, { "tcp_stream": 265, "frame_number": 9784, "display_filter": "frame.number == 9784", "timestamp_epoch": "1583961892.437425000" }, { "tcp_stream": 265, "frame_number": 9786, "display_filter": "frame.number == 9786", "timestamp_epoch": "1583961892.438452000" }, { "tcp_stream": 265, "frame_number": 9788, "display_filter": "frame.number == 9788", "timestamp_epoch": "1583961892.439360000" }, { "tcp_stream": 266, "frame_number": 9795, "display_filter": "frame.number == 9795", "timestamp_epoch": "1583961892.444997000" }, { "tcp_stream": 266, "frame_number": 9799, "display_filter": "frame.number == 9799", "timestamp_epoch": "1583961892.446155000" }, { "tcp_stream": 266, "frame_number": 9802, "display_filter": "frame.number == 9802", "timestamp_epoch": "1583961892.447053000" }, { "tcp_stream": 369, "frame_number": 14381, "display_filter": "frame.number == 14381", "timestamp_epoch": "1583962113.820995000" }, { "tcp_stream": 369, "frame_number": 14386, "display_filter": "frame.number == 14386", "timestamp_epoch": "1583962113.822829000" }, { "tcp_stream": 369, "frame_number": 14388, "display_filter": "frame.number == 14388", "timestamp_epoch": "1583962113.823619000" }, { "tcp_stream": 369, "frame_number": 14390, "display_filter": "frame.number == 14390", "timestamp_epoch": "1583962113.824116000" }, { "tcp_stream": 369, "frame_number": 14392, "display_filter": "frame.number == 14392", "timestamp_epoch": "1583962113.824650000" }, { "tcp_stream": 370, "frame_number": 14399, "display_filter": "frame.number == 14399", "timestamp_epoch": "1583962113.828884000" }, { "tcp_stream": 370, "frame_number": 14403, "display_filter": "frame.number == 14403", "timestamp_epoch": "1583962113.829823000" }, { "tcp_stream": 370, "frame_number": 14406, "display_filter": "frame.number == 14406", "timestamp_epoch": "1583962113.830735000" }, { "tcp_stream": 411, "frame_number": 16100, "display_filter": "frame.number == 16100", "timestamp_epoch": "1583962433.468702000" } ], "severity": "low", "confidence": 0.95, "finding_id": "finding-51dbd44ebacea39018922489", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "rule_version": "pcap-rules-v5" }, { "title": "Directory-service protocol activity", "status": "candidate", "metrics": { "source": "10.3.11.3", "protocol": "samr", "destination": "10.3.11.119", "event_count": 30, "operation_numbers": [ "1", "16", "17", "3", "34", "36", "39", "5", "6", "64", "7" ] }, "rule_id": "directory-service-activity", "evidence": [ { "tcp_stream": 180, "frame_number": 3867, "display_filter": "frame.number == 3867", "timestamp_epoch": "1583961831.540079000" }, { "tcp_stream": 180, "frame_number": 3869, "display_filter": "frame.number == 3869", "timestamp_epoch": "1583961831.540622000" }, { "tcp_stream": 180, "frame_number": 3871, "display_filter": "frame.number == 3871", "timestamp_epoch": "1583961831.543813000" }, { "tcp_stream": 180, "frame_number": 3873, "display_filter": "frame.number == 3873", "timestamp_epoch": "1583961831.544604000" }, { "tcp_stream": 180, "frame_number": 3875, "display_filter": "frame.number == 3875", "timestamp_epoch": "1583961831.545406000" }, { "tcp_stream": 180, "frame_number": 3877, "display_filter": "frame.number == 3877", "timestamp_epoch": "1583961831.546356000" }, { "tcp_stream": 180, "frame_number": 3879, "display_filter": "frame.number == 3879", "timestamp_epoch": "1583961831.547559000" }, { "tcp_stream": 180, "frame_number": 3881, "display_filter": "frame.number == 3881", "timestamp_epoch": "1583961831.548512000" }, { "tcp_stream": 180, "frame_number": 3883, "display_filter": "frame.number == 3883", "timestamp_epoch": "1583961831.549303000" }, { "tcp_stream": 180, "frame_number": 3885, "display_filter": "frame.number == 3885", "timestamp_epoch": "1583961831.549976000" }, { "tcp_stream": 180, "frame_number": 3887, "display_filter": "frame.number == 3887", "timestamp_epoch": "1583961831.550646000" }, { "tcp_stream": 180, "frame_number": 3889, "display_filter": "frame.number == 3889", "timestamp_epoch": "1583961831.551314000" }, { "tcp_stream": 180, "frame_number": 3891, "display_filter": "frame.number == 3891", "timestamp_epoch": "1583961831.552217000" }, { "tcp_stream": 180, "frame_number": 3893, "display_filter": "frame.number == 3893", "timestamp_epoch": "1583961831.552745000" }, { "tcp_stream": 180, "frame_number": 3895, "display_filter": "frame.number == 3895", "timestamp_epoch": "1583961831.553399000" }, { "tcp_stream": 645, "frame_number": 29794, "display_filter": "frame.number == 29794", "timestamp_epoch": "1583963206.456536000" }, { "tcp_stream": 645, "frame_number": 29796, "display_filter": "frame.number == 29796", "timestamp_epoch": "1583963206.457097000" }, { "tcp_stream": 645, "frame_number": 29798, "display_filter": "frame.number == 29798", "timestamp_epoch": "1583963206.457652000" }, { "tcp_stream": 645, "frame_number": 29800, "display_filter": "frame.number == 29800", "timestamp_epoch": "1583963206.458267000" }, { "tcp_stream": 645, "frame_number": 29802, "display_filter": "frame.number == 29802", "timestamp_epoch": "1583963206.459659000" }, { "tcp_stream": 645, "frame_number": 29804, "display_filter": "frame.number == 29804", "timestamp_epoch": "1583963206.460409000" }, { "tcp_stream": 645, "frame_number": 29806, "display_filter": "frame.number == 29806", "timestamp_epoch": "1583963206.461323000" }, { "tcp_stream": 645, "frame_number": 29808, "display_filter": "frame.number == 29808", "timestamp_epoch": "1583963206.462085000" }, { "tcp_stream": 645, "frame_number": 29810, "display_filter": "frame.number == 29810", "timestamp_epoch": "1583963206.462709000" }, { "tcp_stream": 645, "frame_number": 29812, "display_filter": "frame.number == 29812", "timestamp_epoch": "1583963206.463362000" }, { "tcp_stream": 645, "frame_number": 29814, "display_filter": "frame.number == 29814", "timestamp_epoch": "1583963206.464161000" }, { "tcp_stream": 645, "frame_number": 29816, "display_filter": "frame.number == 29816", "timestamp_epoch": "1583963206.464665000" }, { "tcp_stream": 645, "frame_number": 29818, "display_filter": "frame.number == 29818", "timestamp_epoch": "1583963206.465225000" }, { "tcp_stream": 645, "frame_number": 29820, "display_filter": "frame.number == 29820", "timestamp_epoch": "1583963206.465683000" }, { "tcp_stream": 645, "frame_number": 29822, "display_filter": "frame.number == 29822", "timestamp_epoch": "1583963206.466415000" } ], "severity": "low", "confidence": 0.95, "finding_id": "finding-385abbe2a6750a299484f19e", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "rule_version": "pcap-rules-v5" }, { "title": "Directory-service protocol activity", "status": "candidate", "metrics": { "source": "10.3.11.3", "protocol": "drsuapi", "destination": "10.3.11.194", "event_count": 26, "operation_numbers": [ "0", "1", "12", "30" ] }, "rule_id": "directory-service-activity", "evidence": [ { "tcp_stream": 58, "frame_number": 1217, "display_filter": "frame.number == 1217", "timestamp_epoch": "1583961781.254593000" }, { "tcp_stream": 58, "frame_number": 1219, "display_filter": "frame.number == 1219", "timestamp_epoch": "1583961781.255819000" }, { "tcp_stream": 58, "frame_number": 1221, "display_filter": "frame.number == 1221", "timestamp_epoch": "1583961781.256347000" }, { "tcp_stream": 58, "frame_number": 1231, "display_filter": "frame.number == 1231", "timestamp_epoch": "1583961781.259377000" }, { "tcp_stream": 58, "frame_number": 1233, "display_filter": "frame.number == 1233", "timestamp_epoch": "1583961781.260689000" }, { "tcp_stream": 58, "frame_number": 1235, "display_filter": "frame.number == 1235", "timestamp_epoch": "1583961781.261809000" }, { "tcp_stream": 58, "frame_number": 1368, "display_filter": "frame.number == 1368", "timestamp_epoch": "1583961781.757746000" }, { "tcp_stream": 58, "frame_number": 1370, "display_filter": "frame.number == 1370", "timestamp_epoch": "1583961781.758187000" }, { "tcp_stream": 58, "frame_number": 1372, "display_filter": "frame.number == 1372", "timestamp_epoch": "1583961781.758580000" }, { "tcp_stream": 58, "frame_number": 1374, "display_filter": "frame.number == 1374", "timestamp_epoch": "1583961781.758944000" }, { "tcp_stream": 58, "frame_number": 2123, "display_filter": "frame.number == 2123", "timestamp_epoch": "1583961800.968736000" }, { "tcp_stream": 58, "frame_number": 2125, "display_filter": "frame.number == 2125", "timestamp_epoch": "1583961800.969473000" }, { "tcp_stream": 58, "frame_number": 2127, "display_filter": "frame.number == 2127", "timestamp_epoch": "1583961800.970252000" }, { "tcp_stream": 58, "frame_number": 2130, "display_filter": "frame.number == 2130", "timestamp_epoch": "1583961800.970945000" }, { "tcp_stream": 252, "frame_number": 8083, "display_filter": "frame.number == 8083", "timestamp_epoch": "1583961870.373035000" }, { "tcp_stream": 252, "frame_number": 8085, "display_filter": "frame.number == 8085", "timestamp_epoch": "1583961870.373867000" }, { "tcp_stream": 252, "frame_number": 8087, "display_filter": "frame.number == 8087", "timestamp_epoch": "1583961870.375101000" }, { "tcp_stream": 252, "frame_number": 8091, "display_filter": "frame.number == 8091", "timestamp_epoch": "1583961870.377608000" }, { "tcp_stream": 252, "frame_number": 8093, "display_filter": "frame.number == 8093", "timestamp_epoch": "1583961870.378222000" }, { "tcp_stream": 252, "frame_number": 8095, "display_filter": "frame.number == 8095", "timestamp_epoch": "1583961870.378643000" }, { "tcp_stream": 452, "frame_number": 20152, "display_filter": "frame.number == 20152", "timestamp_epoch": "1583962619.268369000" }, { "tcp_stream": 452, "frame_number": 20154, "display_filter": "frame.number == 20154", "timestamp_epoch": "1583962619.269105000" }, { "tcp_stream": 452, "frame_number": 20156, "display_filter": "frame.number == 20156", "timestamp_epoch": "1583962619.269568000" }, { "tcp_stream": 452, "frame_number": 20160, "display_filter": "frame.number == 20160", "timestamp_epoch": "1583962619.271595000" }, { "tcp_stream": 452, "frame_number": 20162, "display_filter": "frame.number == 20162", "timestamp_epoch": "1583962619.272812000" }, { "tcp_stream": 452, "frame_number": 20164, "display_filter": "frame.number == 20164", "timestamp_epoch": "1583962619.273440000" } ], "severity": "low", "confidence": 0.95, "finding_id": "finding-3fb24b663f9fc4e9ff88943a", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "rule_version": "pcap-rules-v5" }, { "title": "Directory-service protocol activity", "status": "candidate", "metrics": { "source": "10.3.11.3", "protocol": "ldap", "destination": "10.3.11.194", "event_count": 141, "operation_numbers": [ "", "1", "4,19,19,19,5", "4,4,4,4,4,4,4,4,4,4,4,4,4,19,19,19,5", "4,4,4,4,5", "4,5", "5" ] }, "rule_id": "directory-service-activity", "evidence": [ { "tcp_stream": 52, "frame_number": 1077, "display_filter": "frame.number == 1077", "timestamp_epoch": "1583961779.870174000" }, { "tcp_stream": 52, "frame_number": 1177, "display_filter": "frame.number == 1177", "timestamp_epoch": "1583961781.231691000" }, { "tcp_stream": 63, "frame_number": 1241, "display_filter": "frame.number == 1241", "timestamp_epoch": "1583961781.263928000" }, { "tcp_stream": 63, "frame_number": 1246, "display_filter": "frame.number == 1246", "timestamp_epoch": "1583961781.266459000" }, { "tcp_stream": 63, "frame_number": 1248, "display_filter": "frame.number == 1248", "timestamp_epoch": "1583961781.268779000" }, { "tcp_stream": 63, "frame_number": 1250, "display_filter": "frame.number == 1250", "timestamp_epoch": "1583961781.269931000" }, { "tcp_stream": 63, "frame_number": 1268, "display_filter": "frame.number == 1268", "timestamp_epoch": "1583961781.397131000" }, { "tcp_stream": 63, "frame_number": 1331, "display_filter": "frame.number == 1331", "timestamp_epoch": "1583961781.592162000" }, { "tcp_stream": 63, "frame_number": 1344, "display_filter": "frame.number == 1344", "timestamp_epoch": "1583961781.702159000" }, { "tcp_stream": 63, "frame_number": 1352, "display_filter": "frame.number == 1352", "timestamp_epoch": "1583961781.704596000" }, { "tcp_stream": 63, "frame_number": 1354, "display_filter": "frame.number == 1354", "timestamp_epoch": "1583961781.705226000" }, { "tcp_stream": 71, "frame_number": 1386, "display_filter": "frame.number == 1386", "timestamp_epoch": "1583961782.229427000" }, { "tcp_stream": 71, "frame_number": 1391, "display_filter": "frame.number == 1391", "timestamp_epoch": "1583961782.232292000" }, { "tcp_stream": 71, "frame_number": 1414, "display_filter": "frame.number == 1414", "timestamp_epoch": "1583961782.261723000" }, { "tcp_stream": 73, "frame_number": 1421, "display_filter": "frame.number == 1421", "timestamp_epoch": "1583961782.267321000" }, { "tcp_stream": 73, "frame_number": 1423, "display_filter": "frame.number == 1423", "timestamp_epoch": "1583961782.268871000" }, { "tcp_stream": 73, "frame_number": 1425, "display_filter": "frame.number == 1425", "timestamp_epoch": "1583961782.269480000" }, { "tcp_stream": 71, "frame_number": 1427, "display_filter": "frame.number == 1427", "timestamp_epoch": "1583961782.270753000" }, { "tcp_stream": 95, "frame_number": 1957, "display_filter": "frame.number == 1957", "timestamp_epoch": "1583961789.906888000" }, { "tcp_stream": 95, "frame_number": 1962, "display_filter": "frame.number == 1962", "timestamp_epoch": "1583961789.910946000" }, { "tcp_stream": 95, "frame_number": 1966, "display_filter": "frame.number == 1966", "timestamp_epoch": "1583961789.914801000" }, { "tcp_stream": 95, "frame_number": 1968, "display_filter": "frame.number == 1968", "timestamp_epoch": "1583961789.915534000" }, { "tcp_stream": 95, "frame_number": 1970, "display_filter": "frame.number == 1970", "timestamp_epoch": "1583961789.916132000" }, { "tcp_stream": 95, "frame_number": 1972, "display_filter": "frame.number == 1972", "timestamp_epoch": "1583961789.917026000" }, { "tcp_stream": 95, "frame_number": 1974, "display_filter": "frame.number == 1974", "timestamp_epoch": "1583961789.917679000" }, { "tcp_stream": 109, "frame_number": 2250, "display_filter": "frame.number == 2250", "timestamp_epoch": "1583961801.305753000" }, { "tcp_stream": 109, "frame_number": 2253, "display_filter": "frame.number == 2253", "timestamp_epoch": "1583961801.313025000" }, { "tcp_stream": 110, "frame_number": 2262, "display_filter": "frame.number == 2262", "timestamp_epoch": "1583961801.333878000" }, { "tcp_stream": 110, "frame_number": 2264, "display_filter": "frame.number == 2264", "timestamp_epoch": "1583961801.335202000" }, { "tcp_stream": 110, "frame_number": 2266, "display_filter": "frame.number == 2266", "timestamp_epoch": "1583961801.335809000" }, { "tcp_stream": 109, "frame_number": 2268, "display_filter": "frame.number == 2268", "timestamp_epoch": "1583961801.336667000" }, { "tcp_stream": 253, "frame_number": 8101, "display_filter": "frame.number == 8101", "timestamp_epoch": "1583961870.382896000" }, { "tcp_stream": 253, "frame_number": 8106, "display_filter": "frame.number == 8106", "timestamp_epoch": "1583961870.386372000" }, { "tcp_stream": 253, "frame_number": 8108, "display_filter": "frame.number == 8108", "timestamp_epoch": "1583961870.387808000" }, { "tcp_stream": 253, "frame_number": 8110, "display_filter": "frame.number == 8110", "timestamp_epoch": "1583961870.388572000" }, { "tcp_stream": 253, "frame_number": 8112, "display_filter": "frame.number == 8112", "timestamp_epoch": "1583961870.389176000" }, { "tcp_stream": 254, "frame_number": 8119, "display_filter": "frame.number == 8119", "timestamp_epoch": "1583961870.397293000" }, { "tcp_stream": 254, "frame_number": 8123, "display_filter": "frame.number == 8123", "timestamp_epoch": "1583961870.398442000" }, { "tcp_stream": 254, "frame_number": 8126, "display_filter": "frame.number == 8126", "timestamp_epoch": "1583961870.399308000" }, { "tcp_stream": 256, "frame_number": 8275, "display_filter": "frame.number == 8275", "timestamp_epoch": "1583961872.520588000" }, { "tcp_stream": 256, "frame_number": 8295, "display_filter": "frame.number == 8295", "timestamp_epoch": "1583961872.528719000" }, { "tcp_stream": 256, "frame_number": 8307, "display_filter": "frame.number == 8307", "timestamp_epoch": "1583961872.544564000" }, { "tcp_stream": 416, "frame_number": 16365, "display_filter": "frame.number == 16365", "timestamp_epoch": "1583962545.040990000" }, { "tcp_stream": 456, "frame_number": 20170, "display_filter": "frame.number == 20170", "timestamp_epoch": "1583962619.287783000" }, { "tcp_stream": 456, "frame_number": 20187, "display_filter": "frame.number == 20187", "timestamp_epoch": "1583962619.291429000" }, { "tcp_stream": 456, "frame_number": 20189, "display_filter": "frame.number == 20189", "timestamp_epoch": "1583962619.295761000" }, { "tcp_stream": 456, "frame_number": 20192, "display_filter": "frame.number == 20192", "timestamp_epoch": "1583962619.297645000" }, { "tcp_stream": 456, "frame_number": 20194, "display_filter": "frame.number == 20194", "timestamp_epoch": "1583962619.298479000" }, { "tcp_stream": 456, "frame_number": 20196, "display_filter": "frame.number == 20196", "timestamp_epoch": "1583962619.299010000" }, { "tcp_stream": 456, "frame_number": 20424, "display_filter": "frame.number == 20424", "timestamp_epoch": "1583962619.311116000" }, { "tcp_stream": 458, "frame_number": 20441, "display_filter": "frame.number == 20441", "timestamp_epoch": "1583962619.472073000" }, { "tcp_stream": 458, "frame_number": 20446, "display_filter": "frame.number == 20446", "timestamp_epoch": "1583962619.473746000" }, { "tcp_stream": 458, "frame_number": 20448, "display_filter": "frame.number == 20448", "timestamp_epoch": "1583962619.474372000" }, { "tcp_stream": 458, "frame_number": 20450, "display_filter": "frame.number == 20450", "timestamp_epoch": "1583962619.474891000" }, { "tcp_stream": 458, "frame_number": 20452, "display_filter": "frame.number == 20452", "timestamp_epoch": "1583962619.475406000" }, { "tcp_stream": 458, "frame_number": 20455, "display_filter": "frame.number == 20455", "timestamp_epoch": "1583962619.476852000" }, { "tcp_stream": 458, "frame_number": 20458, "display_filter": "frame.number == 20458", "timestamp_epoch": "1583962619.479533000" }, { "tcp_stream": 458, "frame_number": 20460, "display_filter": "frame.number == 20460", "timestamp_epoch": "1583962619.480020000" }, { "tcp_stream": 458, "frame_number": 20462, "display_filter": "frame.number == 20462", "timestamp_epoch": "1583962619.480482000" }, { "tcp_stream": 458, "frame_number": 20465, "display_filter": "frame.number == 20465", "timestamp_epoch": "1583962619.481219000" }, { "tcp_stream": 458, "frame_number": 20468, "display_filter": "frame.number == 20468", "timestamp_epoch": "1583962619.482270000" }, { "tcp_stream": 458, "frame_number": 20470, "display_filter": "frame.number == 20470", "timestamp_epoch": "1583962619.482799000" }, { "tcp_stream": 458, "frame_number": 20472, "display_filter": "frame.number == 20472", "timestamp_epoch": "1583962619.483245000" }, { "tcp_stream": 458, "frame_number": 20475, "display_filter": "frame.number == 20475", "timestamp_epoch": "1583962619.483984000" }, { "tcp_stream": 458, "frame_number": 20478, "display_filter": "frame.number == 20478", "timestamp_epoch": "1583962619.485033000" }, { "tcp_stream": 458, "frame_number": 20480, "display_filter": "frame.number == 20480", "timestamp_epoch": "1583962619.485613000" }, { "tcp_stream": 458, "frame_number": 20482, "display_filter": "frame.number == 20482", "timestamp_epoch": "1583962619.486039000" }, { "tcp_stream": 458, "frame_number": 20485, "display_filter": "frame.number == 20485", "timestamp_epoch": "1583962619.487174000" }, { "tcp_stream": 458, "frame_number": 20488, "display_filter": "frame.number == 20488", "timestamp_epoch": "1583962619.488248000" }, { "tcp_stream": 458, "frame_number": 20490, "display_filter": "frame.number == 20490", "timestamp_epoch": "1583962619.488692000" }, { "tcp_stream": 458, "frame_number": 20492, "display_filter": "frame.number == 20492", "timestamp_epoch": "1583962619.489096000" }, { "tcp_stream": 458, "frame_number": 20495, "display_filter": "frame.number == 20495", "timestamp_epoch": "1583962619.489867000" }, { "tcp_stream": 458, "frame_number": 20498, "display_filter": "frame.number == 20498", "timestamp_epoch": "1583962619.490906000" }, { "tcp_stream": 458, "frame_number": 20500, "display_filter": "frame.number == 20500", "timestamp_epoch": "1583962619.491366000" }, { "tcp_stream": 458, "frame_number": 20502, "display_filter": "frame.number == 20502", "timestamp_epoch": "1583962619.491737000" }, { "tcp_stream": 458, "frame_number": 20505, "display_filter": "frame.number == 20505", "timestamp_epoch": "1583962619.492496000" }, { "tcp_stream": 458, "frame_number": 20508, "display_filter": "frame.number == 20508", "timestamp_epoch": "1583962619.493553000" }, { "tcp_stream": 458, "frame_number": 20510, "display_filter": "frame.number == 20510", "timestamp_epoch": "1583962619.494006000" }, { "tcp_stream": 458, "frame_number": 20512, "display_filter": "frame.number == 20512", "timestamp_epoch": "1583962619.494387000" }, { "tcp_stream": 458, "frame_number": 20515, "display_filter": "frame.number == 20515", "timestamp_epoch": "1583962619.495184000" }, { "tcp_stream": 458, "frame_number": 20518, "display_filter": "frame.number == 20518", "timestamp_epoch": "1583962619.496175000" }, { "tcp_stream": 458, "frame_number": 20520, "display_filter": "frame.number == 20520", "timestamp_epoch": "1583962619.496608000" }, { "tcp_stream": 458, "frame_number": 20522, "display_filter": "frame.number == 20522", "timestamp_epoch": "1583962619.497091000" }, { "tcp_stream": 458, "frame_number": 20525, "display_filter": "frame.number == 20525", "timestamp_epoch": "1583962619.497945000" }, { "tcp_stream": 458, "frame_number": 20528, "display_filter": "frame.number == 20528", "timestamp_epoch": "1583962619.498848000" }, { "tcp_stream": 458, "frame_number": 20530, "display_filter": "frame.number == 20530", "timestamp_epoch": "1583962619.499464000" }, { "tcp_stream": 458, "frame_number": 20532, "display_filter": "frame.number == 20532", "timestamp_epoch": "1583962619.499859000" }, { "tcp_stream": 458, "frame_number": 20535, "display_filter": "frame.number == 20535", "timestamp_epoch": "1583962619.500552000" }, { "tcp_stream": 458, "frame_number": 20538, "display_filter": "frame.number == 20538", "timestamp_epoch": "1583962619.501552000" }, { "tcp_stream": 458, "frame_number": 20540, "display_filter": "frame.number == 20540", "timestamp_epoch": "1583962619.502185000" }, { "tcp_stream": 458, "frame_number": 20542, "display_filter": "frame.number == 20542", "timestamp_epoch": "1583962619.502774000" }, { "tcp_stream": 458, "frame_number": 20545, "display_filter": "frame.number == 20545", "timestamp_epoch": "1583962619.503520000" }, { "tcp_stream": 458, "frame_number": 20548, "display_filter": "frame.number == 20548", "timestamp_epoch": "1583962619.504406000" }, { "tcp_stream": 458, "frame_number": 20550, "display_filter": "frame.number == 20550", "timestamp_epoch": "1583962619.504820000" }, { "tcp_stream": 458, "frame_number": 20552, "display_filter": "frame.number == 20552", "timestamp_epoch": "1583962619.505189000" }, { "tcp_stream": 458, "frame_number": 20555, "display_filter": "frame.number == 20555", "timestamp_epoch": "1583962619.505850000" }, { "tcp_stream": 458, "frame_number": 20558, "display_filter": "frame.number == 20558", "timestamp_epoch": "1583962619.506742000" }, { "tcp_stream": 458, "frame_number": 20560, "display_filter": "frame.number == 20560", "timestamp_epoch": "1583962619.507133000" }, { "tcp_stream": 458, "frame_number": 20562, "display_filter": "frame.number == 20562", "timestamp_epoch": "1583962619.507508000" }, { "tcp_stream": 458, "frame_number": 20565, "display_filter": "frame.number == 20565", "timestamp_epoch": "1583962619.508210000" } ], "severity": "low", "confidence": 0.95, "finding_id": "finding-814db169cb3fe82a4fc1c6bc", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "rule_version": "pcap-rules-v5" }, { "title": "Directory-service protocol activity", "status": "candidate", "metrics": { "source": "10.3.11.3", "protocol": "samr", "destination": "10.3.11.194", "event_count": 30, "operation_numbers": [ "1", "16", "17", "3", "34", "36", "39", "5", "6", "64", "7" ] }, "rule_id": "directory-service-activity", "evidence": [ { "tcp_stream": 104, "frame_number": 2168, "display_filter": "frame.number == 2168", "timestamp_epoch": "1583961801.017613000" }, { "tcp_stream": 104, "frame_number": 2170, "display_filter": "frame.number == 2170", "timestamp_epoch": "1583961801.018252000" }, { "tcp_stream": 104, "frame_number": 2172, "display_filter": "frame.number == 2172", "timestamp_epoch": "1583961801.018989000" }, { "tcp_stream": 104, "frame_number": 2174, "display_filter": "frame.number == 2174", "timestamp_epoch": "1583961801.019828000" }, { "tcp_stream": 104, "frame_number": 2176, "display_filter": "frame.number == 2176", "timestamp_epoch": "1583961801.020459000" }, { "tcp_stream": 104, "frame_number": 2178, "display_filter": "frame.number == 2178", "timestamp_epoch": "1583961801.021192000" }, { "tcp_stream": 104, "frame_number": 2180, "display_filter": "frame.number == 2180", "timestamp_epoch": "1583961801.022083000" }, { "tcp_stream": 104, "frame_number": 2182, "display_filter": "frame.number == 2182", "timestamp_epoch": "1583961801.022721000" }, { "tcp_stream": 104, "frame_number": 2184, "display_filter": "frame.number == 2184", "timestamp_epoch": "1583961801.023523000" }, { "tcp_stream": 104, "frame_number": 2186, "display_filter": "frame.number == 2186", "timestamp_epoch": "1583961801.024248000" }, { "tcp_stream": 104, "frame_number": 2188, "display_filter": "frame.number == 2188", "timestamp_epoch": "1583961801.024886000" }, { "tcp_stream": 104, "frame_number": 2190, "display_filter": "frame.number == 2190", "timestamp_epoch": "1583961801.025678000" }, { "tcp_stream": 104, "frame_number": 2192, "display_filter": "frame.number == 2192", "timestamp_epoch": "1583961801.026402000" }, { "tcp_stream": 104, "frame_number": 2194, "display_filter": "frame.number == 2194", "timestamp_epoch": "1583961801.026991000" }, { "tcp_stream": 104, "frame_number": 2196, "display_filter": "frame.number == 2196", "timestamp_epoch": "1583961801.027543000" }, { "tcp_stream": 639, "frame_number": 29571, "display_filter": "frame.number == 29571", "timestamp_epoch": "1583963172.291804000" }, { "tcp_stream": 639, "frame_number": 29573, "display_filter": "frame.number == 29573", "timestamp_epoch": "1583963172.292307000" }, { "tcp_stream": 639, "frame_number": 29575, "display_filter": "frame.number == 29575", "timestamp_epoch": "1583963172.293040000" }, { "tcp_stream": 639, "frame_number": 29577, "display_filter": "frame.number == 29577", "timestamp_epoch": "1583963172.293690000" }, { "tcp_stream": 639, "frame_number": 29579, "display_filter": "frame.number == 29579", "timestamp_epoch": "1583963172.295001000" }, { "tcp_stream": 639, "frame_number": 29581, "display_filter": "frame.number == 29581", "timestamp_epoch": "1583963172.296253000" }, { "tcp_stream": 639, "frame_number": 29583, "display_filter": "frame.number == 29583", "timestamp_epoch": "1583963172.297398000" }, { "tcp_stream": 639, "frame_number": 29585, "display_filter": "frame.number == 29585", "timestamp_epoch": "1583963172.298498000" }, { "tcp_stream": 639, "frame_number": 29587, "display_filter": "frame.number == 29587", "timestamp_epoch": "1583963172.299304000" }, { "tcp_stream": 639, "frame_number": 29589, "display_filter": "frame.number == 29589", "timestamp_epoch": "1583963172.299919000" }, { "tcp_stream": 639, "frame_number": 29591, "display_filter": "frame.number == 29591", "timestamp_epoch": "1583963172.300497000" }, { "tcp_stream": 639, "frame_number": 29593, "display_filter": "frame.number == 29593", "timestamp_epoch": "1583963172.301077000" }, { "tcp_stream": 639, "frame_number": 29595, "display_filter": "frame.number == 29595", "timestamp_epoch": "1583963172.301592000" }, { "tcp_stream": 639, "frame_number": 29597, "display_filter": "frame.number == 29597", "timestamp_epoch": "1583963172.302042000" }, { "tcp_stream": 639, "frame_number": 29599, "display_filter": "frame.number == 29599", "timestamp_epoch": "1583963172.302507000" } ], "severity": "low", "confidence": 0.95, "finding_id": "finding-df4b4ef1133b0bd2e1e95d7f", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "rule_version": "pcap-rules-v5" }, { "title": "Directory-service protocol activity", "status": "candidate", "metrics": { "source": "10.3.11.3", "protocol": "drsuapi", "destination": "10.3.11.218", "event_count": 32, "operation_numbers": [ "0", "1", "12", "30" ] }, "rule_id": "directory-service-activity", "evidence": [ { "tcp_stream": 2, "frame_number": 125, "display_filter": "frame.number == 125", "timestamp_epoch": "1583961755.535854000" }, { "tcp_stream": 2, "frame_number": 127, "display_filter": "frame.number == 127", "timestamp_epoch": "1583961755.536740000" }, { "tcp_stream": 2, "frame_number": 129, "display_filter": "frame.number == 129", "timestamp_epoch": "1583961755.537426000" }, { "tcp_stream": 2, "frame_number": 143, "display_filter": "frame.number == 143", "timestamp_epoch": "1583961755.541992000" }, { "tcp_stream": 2, "frame_number": 145, "display_filter": "frame.number == 145", "timestamp_epoch": "1583961755.544340000" }, { "tcp_stream": 2, "frame_number": 147, "display_filter": "frame.number == 147", "timestamp_epoch": "1583961755.546289000" }, { "tcp_stream": 2, "frame_number": 310, "display_filter": "frame.number == 310", "timestamp_epoch": "1583961756.107962000" }, { "tcp_stream": 2, "frame_number": 312, "display_filter": "frame.number == 312", "timestamp_epoch": "1583961756.108474000" }, { "tcp_stream": 2, "frame_number": 314, "display_filter": "frame.number == 314", "timestamp_epoch": "1583961756.108928000" }, { "tcp_stream": 2, "frame_number": 316, "display_filter": "frame.number == 316", "timestamp_epoch": "1583961756.109657000" }, { "tcp_stream": 29, "frame_number": 571, "display_filter": "frame.number == 571", "timestamp_epoch": "1583961758.487408000" }, { "tcp_stream": 29, "frame_number": 573, "display_filter": "frame.number == 573", "timestamp_epoch": "1583961758.488224000" }, { "tcp_stream": 29, "frame_number": 575, "display_filter": "frame.number == 575", "timestamp_epoch": "1583961758.488595000" }, { "tcp_stream": 29, "frame_number": 579, "display_filter": "frame.number == 579", "timestamp_epoch": "1583961758.490133000" }, { "tcp_stream": 29, "frame_number": 581, "display_filter": "frame.number == 581", "timestamp_epoch": "1583961758.490690000" }, { "tcp_stream": 29, "frame_number": 583, "display_filter": "frame.number == 583", "timestamp_epoch": "1583961758.491084000" }, { "tcp_stream": 2, "frame_number": 1642, "display_filter": "frame.number == 1642", "timestamp_epoch": "1583961783.484902000" }, { "tcp_stream": 2, "frame_number": 1644, "display_filter": "frame.number == 1644", "timestamp_epoch": "1583961783.486617000" }, { "tcp_stream": 2, "frame_number": 1646, "display_filter": "frame.number == 1646", "timestamp_epoch": "1583961783.487532000" }, { "tcp_stream": 2, "frame_number": 1648, "display_filter": "frame.number == 1648", "timestamp_epoch": "1583961783.488212000" }, { "tcp_stream": 194, "frame_number": 4194, "display_filter": "frame.number == 4194", "timestamp_epoch": "1583961844.417123000" }, { "tcp_stream": 194, "frame_number": 4196, "display_filter": "frame.number == 4196", "timestamp_epoch": "1583961844.418233000" }, { "tcp_stream": 194, "frame_number": 4198, "display_filter": "frame.number == 4198", "timestamp_epoch": "1583961844.418921000" }, { "tcp_stream": 194, "frame_number": 4202, "display_filter": "frame.number == 4202", "timestamp_epoch": "1583961844.420494000" }, { "tcp_stream": 194, "frame_number": 4204, "display_filter": "frame.number == 4204", "timestamp_epoch": "1583961844.421326000" }, { "tcp_stream": 194, "frame_number": 4206, "display_filter": "frame.number == 4206", "timestamp_epoch": "1583961844.421661000" }, { "tcp_stream": 362, "frame_number": 14157, "display_filter": "frame.number == 14157", "timestamp_epoch": "1583962055.691210000" }, { "tcp_stream": 362, "frame_number": 14159, "display_filter": "frame.number == 14159", "timestamp_epoch": "1583962055.692021000" }, { "tcp_stream": 362, "frame_number": 14161, "display_filter": "frame.number == 14161", "timestamp_epoch": "1583962055.692441000" }, { "tcp_stream": 362, "frame_number": 14165, "display_filter": "frame.number == 14165", "timestamp_epoch": "1583962055.694161000" }, { "tcp_stream": 362, "frame_number": 14167, "display_filter": "frame.number == 14167", "timestamp_epoch": "1583962055.694740000" }, { "tcp_stream": 362, "frame_number": 14169, "display_filter": "frame.number == 14169", "timestamp_epoch": "1583962055.695115000" } ], "severity": "low", "confidence": 0.95, "finding_id": "finding-b100d7aec9d2fd912dca3be3", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "rule_version": "pcap-rules-v5" }, { "title": "Directory-service protocol activity", "status": "candidate", "metrics": { "source": "10.3.11.3", "protocol": "ldap", "destination": "10.3.11.218", "event_count": 58, "operation_numbers": [ "", "1", "4,19,19,19,5", "4,5", "5" ] }, "rule_id": "directory-service-activity", "evidence": [ { "tcp_stream": 3, "frame_number": 50, "display_filter": "frame.number == 50", "timestamp_epoch": "1583961755.355378000" }, { "tcp_stream": 3, "frame_number": 91, "display_filter": "frame.number == 91", "timestamp_epoch": "1583961755.491373000" }, { "tcp_stream": 3, "frame_number": 93, "display_filter": "frame.number == 93", "timestamp_epoch": "1583961755.493592000" }, { "tcp_stream": 3, "frame_number": 95, "display_filter": "frame.number == 95", "timestamp_epoch": "1583961755.494836000" }, { "tcp_stream": 3, "frame_number": 162, "display_filter": "frame.number == 162", "timestamp_epoch": "1583961755.635713000" }, { "tcp_stream": 18, "frame_number": 257, "display_filter": "frame.number == 257", "timestamp_epoch": "1583961755.861278000" }, { "tcp_stream": 3, "frame_number": 267, "display_filter": "frame.number == 267", "timestamp_epoch": "1583961755.886974000" }, { "tcp_stream": 3, "frame_number": 286, "display_filter": "frame.number == 286", "timestamp_epoch": "1583961755.994716000" }, { "tcp_stream": 3, "frame_number": 294, "display_filter": "frame.number == 294", "timestamp_epoch": "1583961755.996551000" }, { "tcp_stream": 3, "frame_number": 296, "display_filter": "frame.number == 296", "timestamp_epoch": "1583961755.997189000" }, { "tcp_stream": 22, "frame_number": 328, "display_filter": "frame.number == 328", "timestamp_epoch": "1583961756.518251000" }, { "tcp_stream": 22, "frame_number": 333, "display_filter": "frame.number == 333", "timestamp_epoch": "1583961756.522379000" }, { "tcp_stream": 22, "frame_number": 348, "display_filter": "frame.number == 348", "timestamp_epoch": "1583961756.588481000" }, { "tcp_stream": 24, "frame_number": 355, "display_filter": "frame.number == 355", "timestamp_epoch": "1583961756.596262000" }, { "tcp_stream": 24, "frame_number": 357, "display_filter": "frame.number == 357", "timestamp_epoch": "1583961756.597265000" }, { "tcp_stream": 24, "frame_number": 359, "display_filter": "frame.number == 359", "timestamp_epoch": "1583961756.598050000" }, { "tcp_stream": 22, "frame_number": 361, "display_filter": "frame.number == 361", "timestamp_epoch": "1583961756.599661000" }, { "tcp_stream": 30, "frame_number": 598, "display_filter": "frame.number == 598", "timestamp_epoch": "1583961758.612583000" }, { "tcp_stream": 30, "frame_number": 603, "display_filter": "frame.number == 603", "timestamp_epoch": "1583961758.615249000" }, { "tcp_stream": 30, "frame_number": 607, "display_filter": "frame.number == 607", "timestamp_epoch": "1583961758.616821000" }, { "tcp_stream": 30, "frame_number": 609, "display_filter": "frame.number == 609", "timestamp_epoch": "1583961758.618173000" }, { "tcp_stream": 30, "frame_number": 611, "display_filter": "frame.number == 611", "timestamp_epoch": "1583961758.623346000" }, { "tcp_stream": 32, "frame_number": 618, "display_filter": "frame.number == 618", "timestamp_epoch": "1583961758.627969000" }, { "tcp_stream": 32, "frame_number": 622, "display_filter": "frame.number == 622", "timestamp_epoch": "1583961758.629746000" }, { "tcp_stream": 32, "frame_number": 625, "display_filter": "frame.number == 625", "timestamp_epoch": "1583961758.632083000" }, { "tcp_stream": 45, "frame_number": 944, "display_filter": "frame.number == 944", "timestamp_epoch": "1583961764.276910000" }, { "tcp_stream": 45, "frame_number": 949, "display_filter": "frame.number == 949", "timestamp_epoch": "1583961764.280459000" }, { "tcp_stream": 45, "frame_number": 951, "display_filter": "frame.number == 951", "timestamp_epoch": "1583961764.282876000" }, { "tcp_stream": 45, "frame_number": 953, "display_filter": "frame.number == 953", "timestamp_epoch": "1583961764.283535000" }, { "tcp_stream": 45, "frame_number": 955, "display_filter": "frame.number == 955", "timestamp_epoch": "1583961764.284198000" }, { "tcp_stream": 45, "frame_number": 957, "display_filter": "frame.number == 957", "timestamp_epoch": "1583961764.284881000" }, { "tcp_stream": 45, "frame_number": 959, "display_filter": "frame.number == 959", "timestamp_epoch": "1583961764.285457000" }, { "tcp_stream": 46, "frame_number": 967, "display_filter": "frame.number == 967", "timestamp_epoch": "1583961764.308415000" }, { "tcp_stream": 46, "frame_number": 969, "display_filter": "frame.number == 969", "timestamp_epoch": "1583961764.310050000" }, { "tcp_stream": 46, "frame_number": 1001, "display_filter": "frame.number == 1001", "timestamp_epoch": "1583961764.319967000" }, { "tcp_stream": 86, "frame_number": 1767, "display_filter": "frame.number == 1767", "timestamp_epoch": "1583961783.846852000" }, { "tcp_stream": 86, "frame_number": 1769, "display_filter": "frame.number == 1769", "timestamp_epoch": "1583961783.851844000" }, { "tcp_stream": 87, "frame_number": 1776, "display_filter": "frame.number == 1776", "timestamp_epoch": "1583961783.868270000" }, { "tcp_stream": 87, "frame_number": 1779, "display_filter": "frame.number == 1779", "timestamp_epoch": "1583961783.869607000" }, { "tcp_stream": 87, "frame_number": 1781, "display_filter": "frame.number == 1781", "timestamp_epoch": "1583961783.870489000" }, { "tcp_stream": 86, "frame_number": 1783, "display_filter": "frame.number == 1783", "timestamp_epoch": "1583961783.871249000" }, { "tcp_stream": 195, "frame_number": 4212, "display_filter": "frame.number == 4212", "timestamp_epoch": "1583961844.424153000" }, { "tcp_stream": 195, "frame_number": 4217, "display_filter": "frame.number == 4217", "timestamp_epoch": "1583961844.426089000" }, { "tcp_stream": 195, "frame_number": 4219, "display_filter": "frame.number == 4219", "timestamp_epoch": "1583961844.426852000" }, { "tcp_stream": 195, "frame_number": 4221, "display_filter": "frame.number == 4221", "timestamp_epoch": "1583961844.429563000" }, { "tcp_stream": 195, "frame_number": 4223, "display_filter": "frame.number == 4223", "timestamp_epoch": "1583961844.430249000" }, { "tcp_stream": 196, "frame_number": 4230, "display_filter": "frame.number == 4230", "timestamp_epoch": "1583961844.434551000" }, { "tcp_stream": 196, "frame_number": 4234, "display_filter": "frame.number == 4234", "timestamp_epoch": "1583961844.435638000" }, { "tcp_stream": 196, "frame_number": 4237, "display_filter": "frame.number == 4237", "timestamp_epoch": "1583961844.436723000" }, { "tcp_stream": 363, "frame_number": 14175, "display_filter": "frame.number == 14175", "timestamp_epoch": "1583962055.697951000" }, { "tcp_stream": 363, "frame_number": 14180, "display_filter": "frame.number == 14180", "timestamp_epoch": "1583962055.700477000" }, { "tcp_stream": 363, "frame_number": 14182, "display_filter": "frame.number == 14182", "timestamp_epoch": "1583962055.701601000" }, { "tcp_stream": 363, "frame_number": 14184, "display_filter": "frame.number == 14184", "timestamp_epoch": "1583962055.702296000" }, { "tcp_stream": 363, "frame_number": 14186, "display_filter": "frame.number == 14186", "timestamp_epoch": "1583962055.702882000" }, { "tcp_stream": 364, "frame_number": 14193, "display_filter": "frame.number == 14193", "timestamp_epoch": "1583962055.707826000" }, { "tcp_stream": 364, "frame_number": 14197, "display_filter": "frame.number == 14197", "timestamp_epoch": "1583962055.708911000" }, { "tcp_stream": 364, "frame_number": 14200, "display_filter": "frame.number == 14200", "timestamp_epoch": "1583962055.709553000" }, { "tcp_stream": 404, "frame_number": 15675, "display_filter": "frame.number == 15675", "timestamp_epoch": "1583962386.803046000" } ], "severity": "low", "confidence": 0.95, "finding_id": "finding-0de22aef0587ad2549252439", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "rule_version": "pcap-rules-v5" }, { "title": "Directory-service protocol activity", "status": "candidate", "metrics": { "source": "10.3.11.3", "protocol": "samr", "destination": "10.3.11.218", "event_count": 30, "operation_numbers": [ "1", "16", "17", "3", "34", "36", "39", "5", "6", "64", "7" ] }, "rule_id": "directory-service-activity", "evidence": [ { "tcp_stream": 81, "frame_number": 1684, "display_filter": "frame.number == 1684", "timestamp_epoch": "1583961783.544429000" }, { "tcp_stream": 81, "frame_number": 1686, "display_filter": "frame.number == 1686", "timestamp_epoch": "1583961783.545446000" }, { "tcp_stream": 81, "frame_number": 1688, "display_filter": "frame.number == 1688", "timestamp_epoch": "1583961783.546172000" }, { "tcp_stream": 81, "frame_number": 1690, "display_filter": "frame.number == 1690", "timestamp_epoch": "1583961783.547033000" }, { "tcp_stream": 81, "frame_number": 1692, "display_filter": "frame.number == 1692", "timestamp_epoch": "1583961783.548561000" }, { "tcp_stream": 81, "frame_number": 1694, "display_filter": "frame.number == 1694", "timestamp_epoch": "1583961783.549391000" }, { "tcp_stream": 81, "frame_number": 1696, "display_filter": "frame.number == 1696", "timestamp_epoch": "1583961783.551086000" }, { "tcp_stream": 81, "frame_number": 1698, "display_filter": "frame.number == 1698", "timestamp_epoch": "1583961783.552100000" }, { "tcp_stream": 81, "frame_number": 1700, "display_filter": "frame.number == 1700", "timestamp_epoch": "1583961783.553452000" }, { "tcp_stream": 81, "frame_number": 1702, "display_filter": "frame.number == 1702", "timestamp_epoch": "1583961783.555084000" }, { "tcp_stream": 81, "frame_number": 1704, "display_filter": "frame.number == 1704", "timestamp_epoch": "1583961783.556146000" }, { "tcp_stream": 81, "frame_number": 1706, "display_filter": "frame.number == 1706", "timestamp_epoch": "1583961783.563520000" }, { "tcp_stream": 81, "frame_number": 1708, "display_filter": "frame.number == 1708", "timestamp_epoch": "1583961783.564640000" }, { "tcp_stream": 81, "frame_number": 1710, "display_filter": "frame.number == 1710", "timestamp_epoch": "1583961783.566360000" }, { "tcp_stream": 81, "frame_number": 1712, "display_filter": "frame.number == 1712", "timestamp_epoch": "1583961783.573165000" }, { "tcp_stream": 643, "frame_number": 29682, "display_filter": "frame.number == 29682", "timestamp_epoch": "1583963188.855606000" }, { "tcp_stream": 643, "frame_number": 29686, "display_filter": "frame.number == 29686", "timestamp_epoch": "1583963188.857036000" }, { "tcp_stream": 643, "frame_number": 29690, "display_filter": "frame.number == 29690", "timestamp_epoch": "1583963188.859457000" }, { "tcp_stream": 643, "frame_number": 29694, "display_filter": "frame.number == 29694", "timestamp_epoch": "1583963188.864153000" }, { "tcp_stream": 643, "frame_number": 29698, "display_filter": "frame.number == 29698", "timestamp_epoch": "1583963188.866079000" }, { "tcp_stream": 643, "frame_number": 29702, "display_filter": "frame.number == 29702", "timestamp_epoch": "1583963188.867536000" }, { "tcp_stream": 643, "frame_number": 29706, "display_filter": "frame.number == 29706", "timestamp_epoch": "1583963188.869578000" }, { "tcp_stream": 643, "frame_number": 29710, "display_filter": "frame.number == 29710", "timestamp_epoch": "1583963188.870712000" }, { "tcp_stream": 643, "frame_number": 29714, "display_filter": "frame.number == 29714", "timestamp_epoch": "1583963188.872026000" }, { "tcp_stream": 643, "frame_number": 29718, "display_filter": "frame.number == 29718", "timestamp_epoch": "1583963188.874046000" }, { "tcp_stream": 643, "frame_number": 29722, "display_filter": "frame.number == 29722", "timestamp_epoch": "1583963188.875620000" }, { "tcp_stream": 643, "frame_number": 29726, "display_filter": "frame.number == 29726", "timestamp_epoch": "1583963188.876823000" }, { "tcp_stream": 643, "frame_number": 29730, "display_filter": "frame.number == 29730", "timestamp_epoch": "1583963188.877833000" }, { "tcp_stream": 643, "frame_number": 29734, "display_filter": "frame.number == 29734", "timestamp_epoch": "1583963188.878860000" }, { "tcp_stream": 643, "frame_number": 29738, "display_filter": "frame.number == 29738", "timestamp_epoch": "1583963188.879846000" } ], "severity": "low", "confidence": 0.95, "finding_id": "finding-0ec35865f25337e67988dc69", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "rule_version": "pcap-rules-v5" }, { "title": "Sustained external TCP conversation outside decoded application coverage", "status": "candidate", "metrics": { "source": "10.3.11.194", "packets": 14, "wire_bytes": 1303, "destination": "198.23.252.135", "destination_port": 443, "duration_seconds": 116.666 }, "rule_id": "unclassified-external-tcp", "evidence": [ { "tcp_stream": 601, "frame_number": 28765, "display_filter": "tcp.stream == 601", "timestamp_epoch": "1583963050.247153" } ], "severity": "medium", "confidence": 0.7, "finding_id": "finding-4584f53617f61e54e6c4de5b", "explanation": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.", "rule_version": "pcap-rules-v5" } ], "artifacts": [ { "md5": "179345004c39336eaba39863b95f268b", "sha1": "7082e465fac0b6bb7ac2e9d9b5a72182144bf12c", "type": "http-exported-object", "sha256": "8aa9c596dd3eb7560bc7416ba181e858f1174fcbcb5432050f3f9a663ed1ffa2", "evidence": [ { "tcp_stream": 434, "frame_number": 18931, "display_filter": "frame.number == 18931", "timestamp_epoch": "1583962607.301052000" } ], "filename": "imgpaper.png", "filenames": [ "imgpaper.png" ], "transfers": [ { "url": "http://64.44.133.131/images/imgpaper.png", "client_ip": "10.3.11.194", "server_ip": "64.44.133.131", "tcp_stream": 434, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 18431, "response_frame": 18931 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/png", "size_bytes": 582656, "artifact_id": "artifact-533bfd4c90957b3cbb58a9e1", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": true, "identities": [], "inspected_bytes": 262144, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": "executable", "features": [], "content_kind": "pe", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 262144, "inspection_truncated": true }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "9dfb3952172deeddb3a5e3cafed933bc", "sha1": "f8af3d1f92be28c30c42b97d4b891b733181eb4a", "type": "http-exported-object", "sha256": "68798ccf8e2a5f9682a4e011bec288ad9b3f900244f82c6ae5e8ca538725f92e", "evidence": [ { "tcp_stream": 434, "frame_number": 19533, "display_filter": "frame.number == 19533", "timestamp_epoch": "1583962614.905262000" } ], "filename": "cursor.png", "filenames": [ "cursor.png" ], "transfers": [ { "url": "http://64.44.133.131/images/cursor.png", "client_ip": "10.3.11.194", "server_ip": "64.44.133.131", "tcp_stream": 434, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 19014, "response_frame": 19533 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/png", "size_bytes": 582144, "artifact_id": "artifact-f2042332405293c1a06baa7f", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": true, "identities": [], "inspected_bytes": 262144, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": "executable", "features": [], "content_kind": "pe", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 262144, "inspection_truncated": true }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "e40d7846eae7d8a98c0e3512e5461e4c", "sha1": "4ae71ff8059e4be68ac5d6b16189b2c3b90d83ef", "type": "http-exported-object", "sha256": "fef9b646dba5c7372fe92b6a9d227833c1d15d8cc3a73fd22be9d1869b21cd67", "evidence": [ { "tcp_stream": 450, "frame_number": 20107, "display_filter": "frame.number == 20107", "timestamp_epoch": "1583962619.254091000" } ], "filename": "cursor(1).png", "filenames": [ "cursor(1).png" ], "transfers": [ { "url": "http://64.44.133.131/images/cursor.png", "client_ip": "10.3.11.194", "server_ip": "64.44.133.131", "tcp_stream": 450, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 19562, "response_frame": 20107 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/png", "size_bytes": 582144, "artifact_id": "artifact-bdbd58f24a3993f922d9b197", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": true, "identities": [], "inspected_bytes": 262144, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": "executable", "features": [], "content_kind": "pe", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 262144, "inspection_truncated": true }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "c74656862b16f81d02c109030260245b", "sha1": "53b97a9f6b4894d99386a42ab7196d83b719e012", "type": "http-exported-object", "sha256": "02db3c6b9aff73bf8a11c41107c836b6c800c919c5d3d1304f336aee03f79f4c", "evidence": [ { "tcp_stream": 259, "frame_number": 8998, "display_filter": "frame.number == 8998", "timestamp_epoch": "1583961876.987327000" } ], "filename": "YAS20.exe", "filenames": [ "YAS20.exe" ], "transfers": [ { "url": "http://bolton-tech.com/YAS20.exe", "client_ip": "10.3.11.194", "server_ip": "50.87.248.17", "tcp_stream": 259, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 8616, "response_frame": 8998 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 466944, "artifact_id": "artifact-81ea815cbb3693b810124184", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": true, "identities": [ { "type": "account", "value": "User", "source": "referenced-profile-path" } ], "inspected_bytes": 262144, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": "executable", "features": [], "content_kind": "pe", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 262144, "inspection_truncated": true }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "55dfe78b7ea9148705ed9ae202ad90fa", "sha1": "d16e388721f7e3ede6eab7b73763c5267840e160", "type": "http-exported-object", "sha256": "5638ee72bed581aec1cf09b1e7fdeb37a23b69d8f5927ca00b84f2286a695066", "evidence": [ { "tcp_stream": 238, "frame_number": 6580, "display_filter": "frame.number == 6580", "timestamp_epoch": "1583961857.418503000" } ], "filename": "98b20fd6aed4cfc29e428d4dd8e00930%3fAccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1", "filenames": [ "98b20fd6aed4cfc29e428d4dd8e00930%3fAccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1" ], "transfers": [ { "url": "http://nebula.wsimg.com/98b20fd6aed4cfc29e428d4dd8e00930?AccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1", "client_ip": "10.3.11.119", "server_ip": "23.209.74.120", "tcp_stream": 238, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 6156, "response_frame": 6580 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 117306, "artifact_id": "artifact-d311ee99f2f4b33c0123ef22", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 117306, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [ { "offset": 20086, "excerpt": "IeX", "feature": "dynamic-evaluation" } ], "content_kind": "script-like-text", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 117306, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "1ef02cd398011e906762d0ab0c9da5a1", "sha1": "f444238560e671e29ba974c9c72b2f7d09e16f4a", "type": "http-exported-object", "sha256": "1ca2faaa4a7ba86c934c337dcb47ebd521dd5721a9f62302ef36f074c1a4c8d8", "evidence": [ { "tcp_stream": 207, "frame_number": 4616, "display_filter": "frame.number == 4616", "timestamp_epoch": "1583961855.132596000" } ], "filename": "duel.js%3fappid=O3BkA5J1", "filenames": [ "duel.js%3fappid=O3BkA5J1" ], "transfers": [ { "url": "http://img1.wsimg.com/starfield/duel/v2.5.8/duel.js?appid=O3BkA5J1", "client_ip": "10.3.11.119", "server_ip": "23.211.18.27", "tcp_stream": 207, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 4475, "response_frame": 4616 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 41029, "artifact_id": "artifact-eb62f6f700fb27f13e82e56d", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 41029, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [ { "offset": 12678, "excerpt": "eval(", "feature": "dynamic-evaluation" } ], "content_kind": "script-like-text", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 41029, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "f68d885c1a593231f8bd9f654299ea23", "sha1": "e1041ac30b171376d025bbe5e8663bc1dd5e2e6f", "type": "http-exported-object", "sha256": "a869f2e254fb5a41a1745f2ad858148a990c11f543012e43f14780a0e3b57538", "evidence": [ { "tcp_stream": 210, "frame_number": 9409, "display_filter": "frame.number == 9409", "timestamp_epoch": "1583961882.612889000" } ], "filename": "3f2de843c79e006d37fb2ff42ab0d18c%3fAccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1", "filenames": [ "3f2de843c79e006d37fb2ff42ab0d18c%3fAccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1" ], "transfers": [ { "url": "http://nebula.wsimg.com/3f2de843c79e006d37fb2ff42ab0d18c?AccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1", "client_ip": "10.3.11.119", "server_ip": "23.209.74.120", "tcp_stream": 210, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 9006, "response_frame": 9409 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 422099, "artifact_id": "artifact-0d6c86141222140e86cc744e", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": true, "identities": [], "inspected_bytes": 262144, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 262144, "inspection_truncated": true }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "087d57586210dacae99cf032af97473b", "sha1": "4cc1af1da674f98cf1cb14962471b2e86c5f3c4d", "type": "http-exported-object", "sha256": "5c06f9a4898eae08a070b18d66d2162fd031833e993d1c0bf3bd9e7e83a6c526", "evidence": [ { "tcp_stream": 210, "frame_number": 6059, "display_filter": "frame.number == 6059", "timestamp_epoch": "1583961857.208954000" } ], "filename": "d0c5998dd42685ef31a2dbd195b7220e%3fAccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1", "filenames": [ "d0c5998dd42685ef31a2dbd195b7220e%3fAccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1" ], "transfers": [ { "url": "http://nebula.wsimg.com/d0c5998dd42685ef31a2dbd195b7220e?AccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1", "client_ip": "10.3.11.119", "server_ip": "23.209.74.120", "tcp_stream": 210, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 5452, "response_frame": 6059 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 404229, "artifact_id": "artifact-552a4f446ae79900cff24f6b", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": true, "identities": [], "inspected_bytes": 262144, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 262144, "inspection_truncated": true }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "c2d4fdf72d8155f14a72f70584ebe202", "sha1": "750f6327470d60e94b48476ebd116f3ab0064681", "type": "http-exported-object", "sha256": "f0f761f95b7d8b5f5b64d8c078bb7e9274a0d248d73094d7d16581213c3fb7ef", "evidence": [ { "tcp_stream": 239, "frame_number": 6945, "display_filter": "frame.number == 6945", "timestamp_epoch": "1583961857.602983000" } ], "filename": "18385e97e118628cd32e2d0c189f6eee%3fAccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1", "filenames": [ "18385e97e118628cd32e2d0c189f6eee%3fAccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1" ], "transfers": [ { "url": "http://nebula.wsimg.com/18385e97e118628cd32e2d0c189f6eee?AccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1", "client_ip": "10.3.11.119", "server_ip": "23.209.74.120", "tcp_stream": 239, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 6158, "response_frame": 6945 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 385085, "artifact_id": "artifact-a079787ec7e5f6d0ebc90afe", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": true, "identities": [], "inspected_bytes": 262144, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 262144, "inspection_truncated": true }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "8fc1f65e0cae75aa125570c0dcc6bb91", "sha1": "76f392e43b628627c67943b93b7ca459997056c1", "type": "http-exported-object", "sha256": "626211f63483c4d5717e680816bc56119bcb9cdb3446c6d9241b119037ae724e", "evidence": [ { "tcp_stream": 210, "frame_number": 9736, "display_filter": "frame.number == 9736", "timestamp_epoch": "1583961891.422743000" } ], "filename": "21eea24a60f7c8fb7ed4dcca63aca4f5%3fAccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1", "filenames": [ "21eea24a60f7c8fb7ed4dcca63aca4f5%3fAccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1" ], "transfers": [ { "url": "http://nebula.wsimg.com/21eea24a60f7c8fb7ed4dcca63aca4f5?AccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1", "client_ip": "10.3.11.119", "server_ip": "23.209.74.120", "tcp_stream": 210, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 9419, "response_frame": 9736 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 380697, "artifact_id": "artifact-5d1212bdf4632442dae443c5", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": true, "identities": [], "inspected_bytes": 262144, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 262144, "inspection_truncated": true }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "9337d6089aff7102a378af7656d23bd0", "sha1": "f024ac7b6197c2e20d5d746ed8dee465ad25c2d4", "type": "http-exported-object", "sha256": "0e7a2be431ec48b8483bf126741dba1fc74260a35d944a1b8f0f6c2e0adfc9dd", "evidence": [ { "tcp_stream": 210, "frame_number": 8538, "display_filter": "frame.number == 8538", "timestamp_epoch": "1583961872.948085000" } ], "filename": "893e2501ed5504c59ddf5b5352855b87%3fAccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1", "filenames": [ "893e2501ed5504c59ddf5b5352855b87%3fAccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1" ], "transfers": [ { "url": "http://nebula.wsimg.com/893e2501ed5504c59ddf5b5352855b87?AccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1", "client_ip": "10.3.11.119", "server_ip": "23.209.74.120", "tcp_stream": 210, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 8195, "response_frame": 8538 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 359935, "artifact_id": "artifact-acc9956d3413978473b21b60", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": true, "identities": [], "inspected_bytes": 262144, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 262144, "inspection_truncated": true }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "8db3ba89a5dcd40bcd637ef795f8368b", "sha1": "c895f671f786fc500dcf7788a50f6421ff953843", "type": "http-exported-object", "sha256": "8c1c0d96e26bb0fe8578afd07244eae11bab36021b8484862ed81010b97a873d", "evidence": [ { "tcp_stream": 210, "frame_number": 10146, "display_filter": "frame.number == 10146", "timestamp_epoch": "1583961896.175938000" } ], "filename": "2b8f0431afda995f993087c8ec231ddf%3fAccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1", "filenames": [ "2b8f0431afda995f993087c8ec231ddf%3fAccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1" ], "transfers": [ { "url": "http://nebula.wsimg.com/2b8f0431afda995f993087c8ec231ddf?AccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1", "client_ip": "10.3.11.119", "server_ip": "23.209.74.120", "tcp_stream": 210, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 9821, "response_frame": 10146 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 354536, "artifact_id": "artifact-ae3ace9ec39894b60ca98250", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": true, "identities": [], "inspected_bytes": 262144, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 262144, "inspection_truncated": true }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "09684b74d31477ea3ff8abd2ca334b91", "sha1": "db33f2fe344b46b408aa5478a231f4e96d8e2367", "type": "http-exported-object", "sha256": "2458ec1dbcd980f7d484f0140f1d88e2088249eacf3411b2b2359afdf7774318", "evidence": [ { "tcp_stream": 210, "frame_number": 8022, "display_filter": "frame.number == 8022", "timestamp_epoch": "1583961865.090785000" } ], "filename": "c92f917c785f8c03f78b627d46aa8dc2%3fAccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1", "filenames": [ "c92f917c785f8c03f78b627d46aa8dc2%3fAccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1" ], "transfers": [ { "url": "http://nebula.wsimg.com/c92f917c785f8c03f78b627d46aa8dc2?AccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1", "client_ip": "10.3.11.119", "server_ip": "23.209.74.120", "tcp_stream": 210, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 7726, "response_frame": 8022 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 338308, "artifact_id": "artifact-1c0a0f9dbea276e30be0f84e", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": true, "identities": [], "inspected_bytes": 262144, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 262144, "inspection_truncated": true }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "9f847a7763b893615b0df694637234e4", "sha1": "a1e83e997a2fe00728169b1700e90807471d425f", "type": "http-exported-object", "sha256": "c683bc3d52a2a1a0b299fe17e0ccddf7fdc01d8b246fb1652ea258904a8bff7f", "evidence": [ { "tcp_stream": 211, "frame_number": 6900, "display_filter": "frame.number == 6900", "timestamp_epoch": "1583961857.602405000" } ], "filename": "6843f2b90530e6ec9ea7f397b0375735%3fAccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1", "filenames": [ "6843f2b90530e6ec9ea7f397b0375735%3fAccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1" ], "transfers": [ { "url": "http://nebula.wsimg.com/6843f2b90530e6ec9ea7f397b0375735?AccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1", "client_ip": "10.3.11.119", "server_ip": "23.209.74.120", "tcp_stream": 211, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 6077, "response_frame": 6900 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 302749, "artifact_id": "artifact-762cfc524a5f1b789f7a37b7", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": true, "identities": [], "inspected_bytes": 262144, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 262144, "inspection_truncated": true }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "03881e82f9ba8b00b7b251c070997227", "sha1": "06667787cfa017021b078941d9c866bde46a3911", "type": "http-exported-object", "sha256": "567b1b26bdc881dbbae6afca179ba2597c243a6a045984bb61c8138a00389792", "evidence": [ { "tcp_stream": 210, "frame_number": 7107, "display_filter": "frame.number == 7107", "timestamp_epoch": "1583961857.788551000" } ], "filename": "6e2b4120ae0b4dbcac9541ce80c5dd24%3fAccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1", "filenames": [ "6e2b4120ae0b4dbcac9541ce80c5dd24%3fAccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1" ], "transfers": [ { "url": "http://nebula.wsimg.com/6e2b4120ae0b4dbcac9541ce80c5dd24?AccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1", "client_ip": "10.3.11.119", "server_ip": "23.209.74.120", "tcp_stream": 210, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 6075, "response_frame": 7107 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 285252, "artifact_id": "artifact-5e7f4b7633bef7d87790b0bd", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": true, "identities": [], "inspected_bytes": 262144, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 262144, "inspection_truncated": true }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "2183d05f5a0a9a3b2e8cb0509ca363e3", "sha1": "f2183455571b19311a235bd5aa204e694ade8e94", "type": "http-exported-object", "sha256": "c942686010e285633d77a24341c43850ccd6162fcc7e8281ae8a70c2921a9af5", "evidence": [ { "tcp_stream": 345, "frame_number": 13643, "display_filter": "frame.number == 13643", "timestamp_epoch": "1583962027.679109000" } ], "filename": "bootstrap.css", "filenames": [ "bootstrap.css" ], "transfers": [ { "url": "http://notable-quotes.com/css/bootstrap.css", "client_ip": "10.3.11.218", "server_ip": "65.254.227.240", "tcp_stream": 345, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 13326, "response_frame": 13643 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "text/css", "size_bytes": 141622, "artifact_id": "artifact-7642d4f0bb8c94aa2c07d8f2", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 141622, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 141622, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "1274f782fe475e8540678e9cdf10fcdb", "sha1": "cddab9612b8a4444948e236dc47a4072356a75e9", "type": "http-exported-object", "sha256": "95562c2db2cc4094800540ee79790996a5e1fab12a5a3a99432545af45eb2be8", "evidence": [ { "tcp_stream": 237, "frame_number": 6254, "display_filter": "frame.number == 6254", "timestamp_epoch": "1583961857.339599000" } ], "filename": "widgets.js", "filenames": [ "widgets.js" ], "transfers": [ { "url": "http://platform.twitter.com/widgets.js", "client_ip": "10.3.11.119", "server_ip": "72.21.91.66", "tcp_stream": 237, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 6154, "response_frame": 6254 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "text/javascript", "size_bytes": 98387, "artifact_id": "artifact-0cf4dafb9da5d82486b7817f", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 98387, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 98387, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "219073097031d9c1a95a1291d66f3a10", "sha1": "2b7996b01d90b7f424f2a2e6063947461db4b2b2", "type": "http-exported-object", "sha256": "232066e3f6f1351afdaee1acb70c409766641fd5669e0b55ce7c77fac0a857ef", "evidence": [ { "tcp_stream": 358, "frame_number": 13891, "display_filter": "frame.number == 13891", "timestamp_epoch": "1583962031.543194000" } ], "filename": "jquery.min.js", "filenames": [ "jquery.min.js" ], "transfers": [ { "url": "http://ajax.googleapis.com/ajax/libs/jquery/1.6.4/jquery.min.js", "client_ip": "10.3.11.218", "server_ip": "172.217.12.74", "tcp_stream": 358, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 13836, "response_frame": 13891 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "text/javascript", "size_bytes": 91668, "artifact_id": "artifact-0b9c6ba7b8c57543c38bd3e4", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 91668, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 91668, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "4d7ee74246750024abf9e32c49497839", "sha1": "7197008c00ccbd7feb1e20a06f72394be47e6c4d", "type": "http-exported-object", "sha256": "85c54a570e292f19e17fc817bdfdd11f501a95534b8e483629d91c605f38c896", "evidence": [ { "tcp_stream": 231, "frame_number": 5791, "display_filter": "frame.number == 5791", "timestamp_epoch": "1583961856.703926000" } ], "filename": "sf.core.pkg.js", "filenames": [ "sf.core.pkg.js" ], "transfers": [ { "url": "http://img4.wsimg.com/starfield/duel/v2.5.8/sf.core/sf.core.pkg.js", "client_ip": "10.3.11.119", "server_ip": "23.211.18.27", "tcp_stream": 231, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 5551, "response_frame": 5791 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "text/javascript", "size_bytes": 79901, "artifact_id": "artifact-7a5fe2557e809b9000c00183", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 79901, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 79901, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "36c1cfbb9d29f230e41b25fd66529dff", "sha1": "7b02847140dd432186ec1847c8ea2fed21cd78d6", "type": "http-exported-object", "sha256": "fe4428ffba8707caf8541a0ca37cfc96234012a10d051e3362d9d05fbbd9e659", "evidence": [ { "tcp_stream": 232, "frame_number": 5911, "display_filter": "frame.number == 5911", "timestamp_epoch": "1583961856.806925000" } ], "filename": "app.css", "filenames": [ "app.css" ], "transfers": [ { "url": "http://img2.wsimg.com/starfield/duel/v2.5.8/sf.core/app.css", "client_ip": "10.3.11.119", "server_ip": "23.211.18.27", "tcp_stream": 232, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 5856, "response_frame": 5911 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "text/css", "size_bytes": 77910, "artifact_id": "artifact-9aaacfda8380cffb96ef5cfd", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 77910, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 77910, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "cda5b2e6ad0a8aeee53cc12917c95f0f", "sha1": "e1146920b69851fc67077ba5556816958868a945", "type": "http-exported-object", "sha256": "4a0ba027a8859545d3caf300e4c8293248c6e878758cacb14f34e1cdc3d2e24d", "evidence": [ { "tcp_stream": 354, "frame_number": 13821, "display_filter": "frame.number == 13821", "timestamp_epoch": "1583962027.862565000" } ], "filename": "wedding_quote.jpg", "filenames": [ "wedding_quote.jpg" ], "transfers": [ { "url": "http://www.notable-quotes.com/w/wedding_quote.jpg", "client_ip": "10.3.11.218", "server_ip": "65.254.227.240", "tcp_stream": 354, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 13477, "response_frame": 13821 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/jpeg", "size_bytes": 74590, "artifact_id": "artifact-c9bedc61191e0d4f5ce6d9e0", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 74590, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 74590, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "afabb0267a2c56567118685daa8fa78d", "sha1": "0dc02b7637208803f60c5ce19b61302a508a8280", "type": "http-exported-object", "sha256": "be8eb05fd0a2321d069099b171050e5b03effc735dcb43da10d0751ca721a026", "evidence": [ { "tcp_stream": 353, "frame_number": 13774, "display_filter": "frame.number == 13774", "timestamp_epoch": "1583962027.775653000" } ], "filename": "wisdom_quote.jpg", "filenames": [ "wisdom_quote.jpg" ], "transfers": [ { "url": "http://www.notable-quotes.com/w/wisdom_quote.jpg", "client_ip": "10.3.11.218", "server_ip": "65.254.227.240", "tcp_stream": 353, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 13468, "response_frame": 13774 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/jpeg", "size_bytes": 69439, "artifact_id": "artifact-c46d215784eb3143ba03f7d3", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 69439, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 69439, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "03da69d861702a33226567d659b3bbb4", "sha1": "6e6b99d7eff3a7bbf7b81afaf5eb81074a2dee32", "type": "http-exported-object", "sha256": "0e687e2d9d394d7247d63b61aa33895b436f347eb73d8d1d1f99c199d2a0486e", "evidence": [ { "tcp_stream": 355, "frame_number": 13749, "display_filter": "frame.number == 13749", "timestamp_epoch": "1583962027.772280000" } ], "filename": "apocalypse_quote_3.jpg", "filenames": [ "apocalypse_quote_3.jpg" ], "transfers": [ { "url": "http://www.notable-quotes.com/a/apocalypse_quote_3.jpg", "client_ip": "10.3.11.218", "server_ip": "65.254.227.240", "tcp_stream": 355, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 13473, "response_frame": 13749 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/jpeg", "size_bytes": 68850, "artifact_id": "artifact-cad4bbb1104558c386acfff2", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 68850, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 68850, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "c589abad023039f1aa4491292317fed0", "sha1": "d08524c8c69a770212e263d1b4a60b86cd4b65b8", "type": "http-exported-object", "sha256": "974ec9b1a263ff7658a88da7dc41e55989ff284562111577e0b1fd36144c8bd7", "evidence": [ { "tcp_stream": 220, "frame_number": 5056, "display_filter": "frame.number == 5056", "timestamp_epoch": "1583961856.172337000" } ], "filename": "R70EjzUBlOqPeouhFDfR80-0FhOqJubN-BeL9Xxd.woff2", "filenames": [ "R70EjzUBlOqPeouhFDfR80-0FhOqJubN-BeL9Xxd.woff2" ], "transfers": [ { "url": "http://fonts.gstatic.com/s/loveyalikeasister/v10/R70EjzUBlOqPeouhFDfR80-0FhOqJubN-BeL9Xxd.woff2", "client_ip": "10.3.11.119", "server_ip": "216.58.194.131", "tcp_stream": 220, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 4956, "response_frame": 5056 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 68540, "artifact_id": "artifact-a4ff88423b6ec9a9e7a10f6a", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 68540, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 68540, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "0d10cea6b04b6d0fc6b0c9278390cc32", "sha1": "675be7de72f142ca0f5ee09df5d4b536e49391bc", "type": "http-exported-object", "sha256": "d34dc64266e873c506a07bb00c46b2eef77d812e9c312bd12717fbb67b9740c2", "evidence": [ { "tcp_stream": 351, "frame_number": 13981, "display_filter": "frame.number == 13981", "timestamp_epoch": "1583962031.731453000" } ], "filename": "toolbar.cdn.min.js", "filenames": [ "toolbar.cdn.min.js" ], "transfers": [ { "url": "http://files.markerly.com/toolbar.cdn.min.js", "client_ip": "10.3.11.218", "server_ip": "172.217.6.144", "tcp_stream": 351, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 13902, "response_frame": 13981 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "text/javascript", "size_bytes": 61214, "artifact_id": "artifact-4842eb3fd96dc4d8e628db31", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 61214, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 61214, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "484fbfa634fc00217f2f927907734eca", "sha1": "112b6d2c93ef6e11874d29b866d77f2bf83f1a1f", "type": "http-exported-object", "sha256": "876adf01df542fb8b0f263b3c41b1bf5b0c928f5b8a1205f5cb116b650843906", "evidence": [ { "tcp_stream": 352, "frame_number": 13819, "display_filter": "frame.number == 13819", "timestamp_epoch": "1583962027.862506000" } ], "filename": "america_quote_8.jpg", "filenames": [ "america_quote_8.jpg" ], "transfers": [ { "url": "http://www.notable-quotes.com/a/america_quote_8.jpg", "client_ip": "10.3.11.218", "server_ip": "65.254.227.240", "tcp_stream": 352, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 13467, "response_frame": 13819 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/jpeg", "size_bytes": 59314, "artifact_id": "artifact-f86115ef0ccaf00537826253", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 59314, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 59314, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "346c622eac644d3e223b452f85ff705d", "sha1": "616371c53cdfc9cf2c2f569b75c99f3625412f0d", "type": "http-exported-object", "sha256": "088111ecdfb3a045b7d594f7c4632561d30b72e15bc771d79812c172ea77e0de", "evidence": [ { "tcp_stream": 200, "frame_number": 4381, "display_filter": "frame.number == 4381", "timestamp_epoch": "1583961854.711681000" } ], "filename": "%2f", "filenames": [ "%2f" ], "transfers": [ { "url": "http://www.tuscaloosabarnyard.com/", "client_ip": "10.3.11.119", "server_ip": "72.167.191.69", "tcp_stream": 200, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 4366, "response_frame": 4381 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 45927, "artifact_id": "artifact-f5a0685a3ee3886fa1b31ae9", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 45927, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 45927, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "c109622564ee23360f712ac2e17077bd", "sha1": "7630b50217bd600f9195c2ea0fdcda350ba54766", "type": "http-exported-object", "sha256": "c4015f58592d68396095b177ad8dd20f7c3910e2e08c0c81b24a9efd0f40c0c8", "evidence": [ { "tcp_stream": 200, "frame_number": 4453, "display_filter": "frame.number == 4453", "timestamp_epoch": "1583961854.848373000" } ], "filename": "site.css%3fv=", "filenames": [ "site.css%3fv=" ], "transfers": [ { "url": "http://www.tuscaloosabarnyard.com/site.css?v=", "client_ip": "10.3.11.119", "server_ip": "72.167.191.69", "tcp_stream": 200, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 4398, "response_frame": 4453 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 36818, "artifact_id": "artifact-0e7b39c5533a860e7ff30783", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 36818, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 36818, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "ff1115b75eb4a529cc005729359a9438", "sha1": "6ff0d81acd606849d3d8692a859ef0d4a77464fb", "type": "http-exported-object", "sha256": "5adbad4e799ade940d96f6f293fc1ea535b504a6151555c879c5e183aeac1018", "evidence": [ { "tcp_stream": 222, "frame_number": 5029, "display_filter": "frame.number == 5029", "timestamp_epoch": "1583961856.132430000" } ], "filename": "ga6XaxZG_G5OvCf_rt7FH3B6BHLMEdVOEoI.woff2", "filenames": [ "ga6XaxZG_G5OvCf_rt7FH3B6BHLMEdVOEoI.woff2" ], "transfers": [ { "url": "http://fonts.gstatic.com/s/averiasanslibre/v8/ga6XaxZG_G5OvCf_rt7FH3B6BHLMEdVOEoI.woff2", "client_ip": "10.3.11.119", "server_ip": "216.58.194.131", "tcp_stream": 222, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 4958, "response_frame": 5029 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 36608, "artifact_id": "artifact-61b5952712c43cf904ae4bd8", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 36608, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 36608, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "8c237312864d2e4c4f03544cd4f9b195", "sha1": "253711c6d825de55a8360552573be950da180614", "type": "http-exported-object", "sha256": "d5fd173d00d9733900834e0e1083de86b532e048b15c0420ba5c2db0623644b8", "evidence": [ { "tcp_stream": 344, "frame_number": 13559, "display_filter": "frame.number == 13559", "timestamp_epoch": "1583962027.622723000" } ], "filename": "bootstrap.min.js", "filenames": [ "bootstrap.min.js" ], "transfers": [ { "url": "http://notable-quotes.com/js/bootstrap.min.js", "client_ip": "10.3.11.218", "server_ip": "65.254.227.240", "tcp_stream": 344, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 13453, "response_frame": 13559 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "text/javascript", "size_bytes": 35951, "artifact_id": "artifact-4138de730147075c275dbccf", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 35951, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 35951, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "e2ea67e80b95334da4768bffdf3d4f9d", "sha1": "338258c45b90016ba5c691802b70c9dbbf0f9e90", "type": "http-exported-object", "sha256": "06cb95758d706e8359a137118c05fb38af14616f870a0448d327c3203ee69973", "evidence": [ { "tcp_stream": 224, "frame_number": 5161, "display_filter": "frame.number == 5161", "timestamp_epoch": "1583961856.325688000" } ], "filename": "vm8vdRfvXFLG3OLnsO15WYS5DG74wNI.woff2", "filenames": [ "vm8vdRfvXFLG3OLnsO15WYS5DG74wNI.woff2" ], "transfers": [ { "url": "http://fonts.gstatic.com/s/kaushanscript/v8/vm8vdRfvXFLG3OLnsO15WYS5DG74wNI.woff2", "client_ip": "10.3.11.119", "server_ip": "216.58.194.131", "tcp_stream": 224, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 5071, "response_frame": 5161 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 34792, "artifact_id": "artifact-3d2bc1f56e7698ebcc539384", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 34792, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 34792, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "0e8d79d5f32935808d7fcc0a460ce329", "sha1": "3db8de3fbd01b55559c241393c8dc8b16ddc251e", "type": "http-exported-object", "sha256": "2e8b2448de2607edfbeba46bc40bdf5ff8a97afc21e36e0f2a8faaeb7802651d", "evidence": [ { "tcp_stream": 344, "frame_number": 13350, "display_filter": "frame.number == 13350", "timestamp_epoch": "1583962027.488200000" } ], "filename": "%2f(1)", "filenames": [ "%2f(1)" ], "transfers": [ { "url": "http://notable-quotes.com/", "client_ip": "10.3.11.218", "server_ip": "65.254.227.240", "tcp_stream": 344, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 13309, "response_frame": 13350 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 27226, "artifact_id": "artifact-8713f38093c40f8807f3f8b7", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 27226, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 27226, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "4f95a7d5181cecbd9d7ebf7aae5d7526", "sha1": "007327747ae81767330a959824996afc10c8fe42", "type": "http-exported-object", "sha256": "7c41a77c81ad105a586ea655d38846277c13e59341f0d572b8f0eb5ce8af2000", "evidence": [ { "tcp_stream": 220, "frame_number": 5141, "display_filter": "frame.number == 5141", "timestamp_epoch": "1583961856.294900000" } ], "filename": "TUZyzwprpvBS1izr_vOECuSf.woff2", "filenames": [ "TUZyzwprpvBS1izr_vOECuSf.woff2" ], "transfers": [ { "url": "http://fonts.gstatic.com/s/amaticsc/v13/TUZyzwprpvBS1izr_vOECuSf.woff2", "client_ip": "10.3.11.119", "server_ip": "216.58.194.131", "tcp_stream": 220, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 5066, "response_frame": 5141 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 26984, "artifact_id": "artifact-27d68efd9c1be3f96522534b", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 26984, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 26984, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "4975eacbe48a1a498b33e2c66f1568f1", "sha1": "7e93ba4aea9995766187db5a61371b784c20818a", "type": "http-exported-object", "sha256": "8c426b04cd3debee6a21646f14d72a09db7ad335d1cf348484a654a7905760f5", "evidence": [ { "tcp_stream": 347, "frame_number": 13528, "display_filter": "frame.number == 13528", "timestamp_epoch": "1583962027.621691000" } ], "filename": "nqlogo2.png", "filenames": [ "nqlogo2.png" ], "transfers": [ { "url": "http://notable-quotes.com/images/nqlogo2.png", "client_ip": "10.3.11.218", "server_ip": "65.254.227.240", "tcp_stream": 347, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 13371, "response_frame": 13528 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/png", "size_bytes": 21518, "artifact_id": "artifact-d96e27f2da929238cc5be232", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 21518, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 21518, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "b3ba8a148967a46f73deb6a51da802af", "sha1": "d34e916a6628a81d176e6a2e1084c4582327e384", "type": "http-exported-object", "sha256": "3fd2858003c32f1542e7f330cfd1ef2dcd578f20c39bfdd22d70c57a801502b0", "evidence": [ { "tcp_stream": 215, "frame_number": 5088, "display_filter": "frame.number == 5088", "timestamp_epoch": "1583961856.225481000" } ], "filename": "FeVQS0BTqb0h60ACH55Q2A.woff2", "filenames": [ "FeVQS0BTqb0h60ACH55Q2A.woff2" ], "transfers": [ { "url": "http://fonts.gstatic.com/s/bangers/v12/FeVQS0BTqb0h60ACH55Q2A.woff2", "client_ip": "10.3.11.119", "server_ip": "216.58.194.131", "tcp_stream": 215, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 5062, "response_frame": 5088 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 21160, "artifact_id": "artifact-7fe7174048890db8b5435052", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 21160, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 21160, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "fcd2248d517dc2b4a8a7321f5944c74b", "sha1": "40ec915794fc83e2acf01a047a5db5df9cc798c4", "type": "http-exported-object", "sha256": "4b2f13582e24aa18d80a7efd5ca0862cbb68b414a3d9d37a9138c3873bdbbba8", "evidence": [ { "tcp_stream": 205, "frame_number": 4490, "display_filter": "frame.number == 4490", "timestamp_epoch": "1583961854.860477000" } ], "filename": "css%3ffamily=Fredericka+the+Great%7cAllura%7cAmatic+SC%7cArizonia%7cAveria+Sans+Libre%7cCabin+Sketch%7cFrancois+One%7cJacques+Francois+Shadow%7cJosefin+Slab%7cKaushan+Script%7cLove+Ya+Like+A+Sister%7cMerriweather%7cOffside%7cOpen+Sans%7cOpen+Sans+Condense", "filenames": [ "css%3ffamily=Fredericka+the+Great%7cAllura%7cAmatic+SC%7cArizonia%7cAveria+Sans+Libre%7cCabin+Sketch%7cFrancois+One%7cJacques+Francois+Shadow%7cJosefin+Slab%7cKaushan+Script%7cLove+Ya+Like+A+Sister%7cMerriweather%7cOffside%7cOpen+Sans%7cOpen+Sans+Condense" ], "transfers": [ { "url": "http://fonts.googleapis.com/css?family=Fredericka+the+Great|Allura|Amatic+SC|Arizonia|Averia+Sans+Libre|Cabin+Sketch|Francois+One|Jacques+Francois+Shadow|Josefin+Slab|Kaushan+Script|Love+Ya+Like+A+Sister|Merriweather|Offside|Open+Sans|Open+Sans+Condensed|Oswald|Over+the+Rainbow|Pacifico|Romanesco|Sacramento|Seaweed+Script|Special+Elite", "client_ip": "10.3.11.119", "server_ip": "216.58.194.42", "tcp_stream": 205, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 4433, "response_frame": 4490 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 20209, "artifact_id": "artifact-80c22b8f63edea560eae1c7b", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 20209, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 20209, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "33543c5cc5d88f5695dd08c87d280dfd", "sha1": "600db9374e47e4f73a59ccc0a99bcc42f4a3e02a", "type": "http-exported-object", "sha256": "9c50a96c859b9beea47b71740bd14e7f69a4df586d015f47434037f8def53b52", "evidence": [ { "tcp_stream": 215, "frame_number": 4962, "display_filter": "frame.number == 4962", "timestamp_epoch": "1583961856.090996000" } ], "filename": "mem8YaGs126MiZpBA-UFVZ0b.woff2", "filenames": [ "mem8YaGs126MiZpBA-UFVZ0b.woff2" ], "transfers": [ { "url": "http://fonts.gstatic.com/s/opensans/v17/mem8YaGs126MiZpBA-UFVZ0b.woff2", "client_ip": "10.3.11.119", "server_ip": "216.58.194.131", "tcp_stream": 215, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 4917, "response_frame": 4962 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 14380, "artifact_id": "artifact-1483191623b62b211ac2d361", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 14380, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 14380, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "8d42d80b17ef06dd7a6f33c6651ac43b", "sha1": "6aa998151cf7fd9bd2480c45d8a4fe467fbd4e93", "type": "http-exported-object", "sha256": "c3bdfe5de3424f3d07872f6ecb6de79015e4301a4eb72803fbff251c41311f88", "evidence": [ { "tcp_stream": 211, "frame_number": 4694, "display_filter": "frame.number == 4694", "timestamp_epoch": "1583961855.208494000" } ], "filename": "1a4f5564116de9920433f700c2a9c20c%3fAccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1", "filenames": [ "1a4f5564116de9920433f700c2a9c20c%3fAccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1" ], "transfers": [ { "url": "http://nebula.wsimg.com/1a4f5564116de9920433f700c2a9c20c?AccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1", "client_ip": "10.3.11.119", "server_ip": "23.209.74.120", "tcp_stream": 211, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 4640, "response_frame": 4694 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 13710, "artifact_id": "artifact-619d6516f72b41213990cb03", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 13710, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 13710, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "040faae9f93b143eda18261d5d87e989", "sha1": "f1619ceb1204eb7606a385fdf869b4d918c8e422", "type": "http-exported-object", "sha256": "361c9f80feaefdda9eb1bb7ee61de56d922188898f69af4cf8a76c64fb0183ad", "evidence": [ { "tcp_stream": 222, "frame_number": 5123, "display_filter": "frame.number == 5123", "timestamp_epoch": "1583961856.293967000" } ], "filename": "CSR64z1Qlv-GDxkbKVQ_fOAKTQ.woff2", "filenames": [ "CSR64z1Qlv-GDxkbKVQ_fOAKTQ.woff2" ], "transfers": [ { "url": "http://fonts.gstatic.com/s/newscycle/v16/CSR64z1Qlv-GDxkbKVQ_fOAKTQ.woff2", "client_ip": "10.3.11.119", "server_ip": "216.58.194.131", "tcp_stream": 222, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 5065, "response_frame": 5123 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 13224, "artifact_id": "artifact-32df8c259dd5855b60982ed4", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 13224, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 13224, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "aedf40180b4bbdaedaf29e0270a5b01c", "sha1": "4452ba80159e4f3bb8dfe03350631c4b436a1a6a", "type": "http-exported-object", "sha256": "2ac97370caeb512780c9e407128aaa48e9ea92e34acfb427888e1a8027aa7723", "evidence": [ { "tcp_stream": 351, "frame_number": 13996, "display_filter": "frame.number == 13996", "timestamp_epoch": "1583962031.764341000" } ], "filename": "main_toolbar_cdn.min.css", "filenames": [ "main_toolbar_cdn.min.css" ], "transfers": [ { "url": "http://files.markerly.com/main_toolbar_cdn.min.css", "client_ip": "10.3.11.218", "server_ip": "172.217.6.144", "tcp_stream": 351, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 13984, "response_frame": 13996 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "text/css", "size_bytes": 12418, "artifact_id": "artifact-cba4ae69010d60535d9bc7b7", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 12418, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 12418, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "13fe078f3f8dc29e220f8bc71c7423e2", "sha1": "6ca1175f5bb50b30eb1664f61d200d22ca4a1c41", "type": "http-exported-object", "sha256": "b6c573fcecf8b4204abd88d9076ae381da57f8969c241e9f08215d3016adc612", "evidence": [ { "tcp_stream": 210, "frame_number": 4512, "display_filter": "frame.number == 4512", "timestamp_epoch": "1583961854.881864000" } ], "filename": "90d173a36db4dc5268be43fbed9cde77%3fAccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1", "filenames": [ "90d173a36db4dc5268be43fbed9cde77%3fAccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1" ], "transfers": [ { "url": "http://nebula.wsimg.com/90d173a36db4dc5268be43fbed9cde77?AccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1", "client_ip": "10.3.11.119", "server_ip": "23.209.74.120", "tcp_stream": 210, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 4481, "response_frame": 4512 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 12245, "artifact_id": "artifact-6855843b8d50461262a3305d", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 12245, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 12245, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "ef68c72350e7a86b9ff41ed45f35510c", "sha1": "c9fc3b9a81a2bb7347650895168ef0924ff8affc", "type": "http-exported-object", "sha256": "9b7024bd4a97fed7a3823a6d98653f66ec959b8e5b73aa533f7e78d0900f9e6d", "evidence": [ { "tcp_stream": 211, "frame_number": 4522, "display_filter": "frame.number == 4522", "timestamp_epoch": "1583961854.882228000" } ], "filename": "25a1c16c05755eb2ec17846b91efa5fe%3fAccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1", "filenames": [ "25a1c16c05755eb2ec17846b91efa5fe%3fAccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1" ], "transfers": [ { "url": "http://nebula.wsimg.com/25a1c16c05755eb2ec17846b91efa5fe?AccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1", "client_ip": "10.3.11.119", "server_ip": "23.209.74.120", "tcp_stream": 211, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 4477, "response_frame": 4522 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 8133, "artifact_id": "artifact-e67b7e1c7988a7d744ef663f", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 8133, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 8133, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "578c37eeee1f4d1e9ce957a7133d166c", "sha1": "11533d8047b5b6369783b09b96f429d8d911490b", "type": "http-exported-object", "sha256": "d774beebaea68f3e3be399e441d6f5bf073ce036a8cce8a90b444c60d2985f04", "evidence": [ { "tcp_stream": 207, "frame_number": 4679, "display_filter": "frame.number == 4679", "timestamp_epoch": "1583961855.206585000" } ], "filename": "tcc_l.combined.1.0.5.min.js", "filenames": [ "tcc_l.combined.1.0.5.min.js" ], "transfers": [ { "url": "http://img1.wsimg.com/tcc/tcc_l.combined.1.0.5.min.js", "client_ip": "10.3.11.119", "server_ip": "23.211.18.27", "tcp_stream": 207, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 4638, "response_frame": 4679 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "text/javascript", "size_bytes": 5969, "artifact_id": "artifact-5c299e396aedbea0f2d4e71f", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 5969, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 5969, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "f09673ad745e39470708028f7431f6d6", "sha1": "0b5a9d716bfe5f8167de567fbf319c536f838ae7", "type": "http-exported-object", "sha256": "f1d535264c136ef79dcbc92b30a25b313ed312dc611c92cd70d6470a1609ee88", "evidence": [], "filename": "90", "filenames": [ "90" ], "transfers": [], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 5366, "artifact_id": "artifact-2fff8b58a46d56203fa79e46", "occurrences": 1, "completeness": "unknown", "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 5366, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "8f4a2ba46a7ed3853ef2e946e3b4ec02", "sha1": "fe08b0b0ae99731e513abf4ce61b174c5986ab75", "type": "http-exported-object", "sha256": "1e7a8021a029a0b1b97d9df2c059ad4fe80ff8d9db9564c593bdde97df48f5ff", "evidence": [ { "tcp_stream": 349, "frame_number": 13460, "display_filter": "frame.number == 13460", "timestamp_epoch": "1583962027.549563000" } ], "filename": "googleplus.png", "filenames": [ "googleplus.png" ], "transfers": [ { "url": "http://notable-quotes.com/images/googleplus.png", "client_ip": "10.3.11.218", "server_ip": "65.254.227.240", "tcp_stream": 349, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 13384, "response_frame": 13460 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/png", "size_bytes": 3869, "artifact_id": "artifact-9bc7d818bc2d39e87f5a349a", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 3869, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 3869, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "c65574840a08aa38cee83459810dfdf0", "sha1": "7f0f25f951eb7eafb843ec053c60ec5375af3e57", "type": "http-exported-object", "sha256": "49c45399074a6af07b176d55bb85b3de42b2c2889bf9efa37310b4e71cf14f43", "evidence": [ { "tcp_stream": 348, "frame_number": 13457, "display_filter": "frame.number == 13457", "timestamp_epoch": "1583962027.549369000" } ], "filename": "twitter.png", "filenames": [ "twitter.png" ], "transfers": [ { "url": "http://notable-quotes.com/images/twitter.png", "client_ip": "10.3.11.218", "server_ip": "65.254.227.240", "tcp_stream": 348, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 13383, "response_frame": 13457 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/png", "size_bytes": 3644, "artifact_id": "artifact-35a04a83193c6108cb0ffcdc", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 3644, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 3644, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "78b7f6751312da2e37f53ac07c419d16", "sha1": "aaa496420ac09bd3a0c6024d96560224f22c1a66", "type": "http-exported-object", "sha256": "b42b0d8a915682fe8b49af799d072001ddc761191069bd18b2f2974c77a8cf65", "evidence": [ { "tcp_stream": 207, "frame_number": 5506, "display_filter": "frame.number == 5506", "timestamp_epoch": "1583961856.604272000" } ], "filename": "wsb-slideshow-arrows.png", "filenames": [ "wsb-slideshow-arrows.png" ], "transfers": [ { "url": "http://img1.wsimg.com/wst/v7/WSB7_J_20200225_2323_DEP-18389_2679/v1/images/wsb-slideshow-arrows.png", "client_ip": "10.3.11.119", "server_ip": "23.211.18.27", "tcp_stream": 207, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 5450, "response_frame": 5506 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/png", "size_bytes": 3427, "artifact_id": "artifact-0ff3ca96cbef2f07ba01c17e", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 3427, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 3427, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "6a46d2278f751d882bee1ec883f568f9", "sha1": "b214cd510459f20a0a0146b287fef0f1f400126d", "type": "http-exported-object", "sha256": "89c5625aa0ecfeaa47ae9da990cda5ab80fe8088ab1cd55ee7394e870de5eafa", "evidence": [ { "tcp_stream": 346, "frame_number": 13436, "display_filter": "frame.number == 13436", "timestamp_epoch": "1583962027.544358000" } ], "filename": "facebook.png", "filenames": [ "facebook.png" ], "transfers": [ { "url": "http://notable-quotes.com/images/facebook.png", "client_ip": "10.3.11.218", "server_ip": "65.254.227.240", "tcp_stream": 346, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 13369, "response_frame": 13436 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/png", "size_bytes": 3394, "artifact_id": "artifact-6ed3e30c51b727c1fd914350", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 3394, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 3394, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "41d4d2bc37085e8368fc0237a9866b69", "sha1": "dfbb0e48be142df52ecd52c06856bbb4ccaad668", "type": "http-exported-object", "sha256": "00b3e28e084717e5fb9ba1f8a9cf7e9a854ded1b7b4721ed31110513013461dc", "evidence": [ { "tcp_stream": 206, "frame_number": 4496, "display_filter": "frame.number == 4496", "timestamp_epoch": "1583961854.864183000" } ], "filename": "css%3ffamily=News+Cycle%7cBangers%7cRaleway%3a200", "filenames": [ "css%3ffamily=News+Cycle%7cBangers%7cRaleway%3a200" ], "transfers": [ { "url": "http://fonts.googleapis.com/css?family=News+Cycle|Bangers|Raleway:200", "client_ip": "10.3.11.119", "server_ip": "216.58.194.42", "tcp_stream": 206, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 4439, "response_frame": 4496 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 2741, "artifact_id": "artifact-e05484322509b4e72908c1da", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 2741, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 2741, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "249b96dd177b84862baccacb6a2f6ed6", "sha1": "40573ce89668a1fd1555d65afeb0c8af940f6e1d", "type": "http-exported-object", "sha256": "2aa0809ab9f586e743514b0ef60ece6f30dc7d5583d64c1d90cfb87c7019a2bf", "evidence": [ { "tcp_stream": 273, "frame_number": 10503, "display_filter": "frame.number == 10503", "timestamp_epoch": "1583961955.863202000" } ], "filename": "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D", "filenames": [ "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D" ], "transfers": [ { "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D", "client_ip": "10.3.11.194", "server_ip": "72.21.91.29", "tcp_stream": 273, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 10500, "response_frame": 10503 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 1507, "artifact_id": "artifact-5e9d458f73278cc245134195", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 1507, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 1507, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "2dc4140f2e908bfb4dc98c48001ca2de", "sha1": "6fc5b32d6d283c647a138926594c3b8ae5f8af62", "type": "http-exported-object", "sha256": "a219ef1a0091feb8ab30c92f4a25833c4f431001bdec691af31878cdcaa1e43d", "evidence": [ { "tcp_stream": 351, "frame_number": 13389, "display_filter": "frame.number == 13389", "timestamp_epoch": "1583962027.518133000" } ], "filename": "markerly-cdn.js", "filenames": [ "markerly-cdn.js" ], "transfers": [ { "url": "http://files.markerly.com/markerly-cdn.js", "client_ip": "10.3.11.218", "server_ip": "172.217.6.144", "tcp_stream": 351, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 13377, "response_frame": 13389 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "text/javascript", "size_bytes": 1292, "artifact_id": "artifact-fef05fa90c9dfb4777ad8a93", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 1292, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 1292, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "6101bbce3c654be9fcb64d45763fbd9b", "sha1": "c7c6b9f0b16c45774ef458be845e17fb9844f4e8", "type": "http-exported-object", "sha256": "5b0d6fc1a80187419cfcc2340e6bf1a3e7704e8d65b44bee45a1caaab91138d2", "evidence": [ { "tcp_stream": 210, "frame_number": 4693, "display_filter": "frame.number == 4693", "timestamp_epoch": "1583961855.208478000" } ], "filename": "eea2577ebdcc219fe1962915e163ee72%3fAccessKeyId=531592D248B589D87A56&disposition=0&alloworigin=1", "filenames": [ "eea2577ebdcc219fe1962915e163ee72%3fAccessKeyId=531592D248B589D87A56&disposition=0&alloworigin=1" ], "transfers": [ { "url": "http://nebula.wsimg.com/eea2577ebdcc219fe1962915e163ee72?AccessKeyId=531592D248B589D87A56&disposition=0&alloworigin=1", "client_ip": "10.3.11.119", "server_ip": "23.209.74.120", "tcp_stream": 210, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 4642, "response_frame": 4693 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 1268, "artifact_id": "artifact-4b6ae6e72cee434d2b4ab99e", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 1268, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 1268, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "3579895a66ea85424254005233f27531", "sha1": "653e8f27819259d835508c7b82365b4b9cef1ed2", "type": "http-exported-object", "sha256": "c623c1144c540ad5f5ee378220c6237026df828fa5d63c95e072de454aa1113a", "evidence": [ { "tcp_stream": 200, "frame_number": 7679, "display_filter": "frame.number == 7679", "timestamp_epoch": "1583961859.636723000" } ], "filename": "favicon.ico", "filenames": [ "favicon.ico" ], "transfers": [ { "url": "http://www.tuscaloosabarnyard.com/favicon.ico", "client_ip": "10.3.11.119", "server_ip": "72.167.191.69", "tcp_stream": 200, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "404", "completeness": "matches-declared-content-length", "request_frame": 7675, "response_frame": 7679 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/vnd.microsoft.icon", "size_bytes": 964, "artifact_id": "artifact-a9c0185fe5b307e36ad0d86d", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 964, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 964, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "130956569608d27fb7b7f000f708ac2e", "sha1": "8e8b6a157030869630ed867d87f98a3459a2eb3a", "type": "http-exported-object", "sha256": "3ddb722a10d4664abeb93659beefa009255d6cda0975a47944665976ad9e64cd", "evidence": [ { "tcp_stream": 344, "frame_number": 13433, "display_filter": "frame.number == 13433", "timestamp_epoch": "1583962027.544281000" } ], "filename": "style.css", "filenames": [ "style.css" ], "transfers": [ { "url": "http://notable-quotes.com/css/style.css", "client_ip": "10.3.11.218", "server_ip": "65.254.227.240", "tcp_stream": 344, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 13363, "response_frame": 13433 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "text/css", "size_bytes": 934, "artifact_id": "artifact-f8065142fd8a63ab4a1c6cbf", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 934, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 934, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "cf4379c5eab6e8159bcb860f6e791faa", "sha1": "c1359b399f37d2bda962ae19ec39ff0a1e062359", "type": "http-exported-object", "sha256": "34efd2a999616fb13ef5fadece4481e978c68f2f3416713a4364a21fe81d3243", "evidence": [ { "tcp_stream": 491, "frame_number": 21914, "display_filter": "frame.number == 21914", "timestamp_epoch": "1583962651.474729000" } ], "filename": "STCA.crl", "filenames": [ "STCA.crl" ], "transfers": [ { "url": "http://crl.securetrust.com/STCA.crl", "client_ip": "10.3.11.119", "server_ip": "23.63.253.208", "tcp_stream": 491, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 21909, "response_frame": 21914 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 758, "artifact_id": "artifact-e139ac475249da32946d4549", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 758, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 758, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "82517b88972261be6dbc514854697234", "sha1": "58a3d1dab136e13dfe99c1a2c8b31a65349b55b6", "type": "http-exported-object", "sha256": "f1a04b0b791b515d66978d2f6d2980bec1455795486bb71b19e7ad8a84aab865", "evidence": [ { "tcp_stream": 210, "frame_number": 4819, "display_filter": "frame.number == 4819", "timestamp_epoch": "1583961855.691441000" } ], "filename": "5e2ea9aae9a1ca943046a6868cb3002b%3fAccessKeyId=531592D248B589D87A56&alloworigin=1", "filenames": [ "5e2ea9aae9a1ca943046a6868cb3002b%3fAccessKeyId=531592D248B589D87A56&alloworigin=1" ], "transfers": [ { "url": "http://nebula.wsimg.com/5e2ea9aae9a1ca943046a6868cb3002b?AccessKeyId=531592D248B589D87A56&alloworigin=1", "client_ip": "10.3.11.119", "server_ip": "23.209.74.120", "tcp_stream": 210, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 4815, "response_frame": 4819 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 617, "artifact_id": "artifact-e175b9d470bec5c0c5dabf92", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 617, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 617, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "5baf5e34a2924d3ab654837f1badef89", "sha1": "4b325c14e2ab53c90209d69aafcdff7cf4954f86", "type": "http-exported-object", "sha256": "34fc3b82e17c69e3cefd908d8e85848f2cdfcb180ba5c05a84ccd2c65e943e09", "evidence": [], "filename": "81(2)", "filenames": [ "81(2)" ], "transfers": [], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 551, "artifact_id": "artifact-1ca72175c08e6acf2de4c827", "occurrences": 1, "completeness": "unknown", "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 551, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "82a12e8bf6b396c3c5c71286a41eebeb", "sha1": "27c6a0b9cc10890f73294dd86ff95802a236229d", "type": "http-exported-object", "sha256": "01428897745e7b37849d922e35e28ad8585aca2a254d55f3b5adaecb0b3cb526", "evidence": [], "filename": "81", "filenames": [ "81" ], "transfers": [], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 274, "artifact_id": "artifact-076dd8000fa956bed20f0ab2", "occurrences": 1, "completeness": "unknown", "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 274, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "b2bc7a9a1b086bf7b7ba6c121f11a534", "sha1": "418e1f29098e4162db2c7acd7ec34141cf94b907", "type": "http-exported-object", "sha256": "3291b96690178e55e4114c78a6241d3a6bd18aa7361626ff803b54064d178122", "evidence": [], "filename": "81(4)", "filenames": [ "81(4)" ], "transfers": [], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 219, "artifact_id": "artifact-dafb124d92d0915affd04298", "occurrences": 1, "completeness": "unknown", "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 219, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "d8f7098175c9941069a9b4960e3ea2c6", "sha1": "73dab20a7f19c74ba87ebf2bd805995b10516ac9", "type": "http-exported-object", "sha256": "cf0d2bf5ac3284cc068e414be2a74d56bc5c1543413d3965aa96075114817a7a", "evidence": [], "filename": "81(6)", "filenames": [ "81(6)" ], "transfers": [], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 210, "artifact_id": "artifact-16d5adc6186c5f39f5970eda", "occurrences": 1, "completeness": "unknown", "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 210, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "3c417e9efbcaeb3bf7e7df75cf3b22fd", "sha1": "00465aec6b8ec302eae8abb99678fc5c09c3f343", "type": "http-exported-object", "sha256": "21bd143d38dbbae427615a7266a86a18dc95c417f3e510632d7a9180d98d3571", "evidence": [ { "tcp_stream": 216, "frame_number": 4568, "display_filter": "frame.number == 4568", "timestamp_epoch": "1583961855.033448000" } ], "filename": "addthis_widget.js", "filenames": [ "addthis_widget.js" ], "transfers": [ { "url": "http://s7.addthis.com/js/300/addthis_widget.js", "client_ip": "10.3.11.119", "server_ip": "72.246.84.150", "tcp_stream": 216, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "308", "completeness": "matches-declared-content-length", "request_frame": 4559, "response_frame": 4568 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "text/javascript", "size_bytes": 171, "artifact_id": "artifact-06f3e0931adcb2be2e4453b3", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 171, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 171, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "bcb8cf3f858e5e33c319860f4b813e3b", "sha1": "d5d01816258491ab74798f0407cbb3924a08a34c", "type": "http-exported-object", "sha256": "855a518348bdb64df2ac2fc743b2f2479d4b6fb69d9f87dcdc740ee5d5e03a40", "evidence": [ { "tcp_stream": 389, "frame_number": 14988, "display_filter": "frame.number == 14988", "timestamp_epoch": "1583962320.294784000" } ], "filename": "%2f(2)", "filenames": [ "%2f(2)" ], "transfers": [ { "url": "http://checkip.amazonaws.com/", "client_ip": "10.3.11.194", "server_ip": "18.235.112.207", "tcp_stream": 389, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 14981, "response_frame": 14988 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 16, "artifact_id": "artifact-bae7bc4bd3205bd3094bfa3f", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 16, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 16, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "fa06d89c65fb808240e37f4c9e128955", "sha1": "ff0288c119791fc13a51965eb3a0e61be2c06338", "type": "http-exported-object", "sha256": "c76ea8b0db60dcccfdc0217059e37eb5b10d10940e649f9bc1d07d4ddcc797d1", "evidence": [ { "tcp_stream": 448, "frame_number": 19486, "display_filter": "frame.number == 19486", "timestamp_epoch": "1583962614.758515000" }, { "tcp_stream": 449, "frame_number": 19553, "display_filter": "frame.number == 19553", "timestamp_epoch": "1583962616.819267000" }, { "tcp_stream": 459, "frame_number": 20667, "display_filter": "frame.number == 20667", "timestamp_epoch": "1583962620.967231000" }, { "tcp_stream": 465, "frame_number": 21101, "display_filter": "frame.number == 21101", "timestamp_epoch": "1583962640.726486000" }, { "tcp_stream": 555, "frame_number": 26675, "display_filter": "frame.number == 26675", "timestamp_epoch": "1583962673.814886000" } ], "filename": "81(1)", "filenames": [ "81(1)", "81(3)", "81(5)", "81(7)", "90(1)" ], "transfers": [ { "url": "http://203.176.135.102:8082/yas20/LAPTOP-7XMV2SN_W10018363.CF3A0EAB425F1927835EF064A69CAED6/81/", "client_ip": "10.3.11.194", "server_ip": "203.176.135.102", "tcp_stream": 448, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 19116, "response_frame": 19486 }, { "url": "http://203.176.135.102:8082/yas20/LAPTOP-7XMV2SN_W10018363.CF3A0EAB425F1927835EF064A69CAED6/81/", "client_ip": "10.3.11.194", "server_ip": "203.176.135.102", "tcp_stream": 449, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 19547, "response_frame": 19553 }, { "url": "http://203.176.135.102:8082/yas20/LAPTOP-7XMV2SN_W10018363.CF3A0EAB425F1927835EF064A69CAED6/90", "client_ip": "10.3.11.194", "server_ip": "203.176.135.102", "tcp_stream": 459, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 20660, "response_frame": 20667 }, { "url": "http://203.176.135.102:8082/yas20/LAPTOP-7XMV2SN_W10018363.CF3A0EAB425F1927835EF064A69CAED6/81/", "client_ip": "10.3.11.194", "server_ip": "203.176.135.102", "tcp_stream": 465, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 21096, "response_frame": 21101 }, { "url": "http://203.176.135.102:8082/yas20/LAPTOP-7XMV2SN_W10018363.CF3A0EAB425F1927835EF064A69CAED6/81/", "client_ip": "10.3.11.194", "server_ip": "203.176.135.102", "tcp_stream": 555, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 26673, "response_frame": 26675 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 3, "artifact_id": "artifact-fd9fb045ae882d404f0f852c", "occurrences": 5, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 3, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 3, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false } ], "endpoints": [ { "ip": "10.3.11.1", "bytes_sent": 108, "ip_version": 4, "is_private": true, "endpoint_id": "endpoint-3fc9cbcaf9deb4b92b1dec1e", "packets_sent": 2, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 132, "evidence_frames": [ 18934, 18935, 18989, 18990 ], "last_seen_epoch": "1583962607.829015", "first_seen_epoch": "1583962607.303647", "packets_received": 2 }, { "ip": "10.3.11.119", "bytes_sent": 773642, "ip_version": 4, "is_private": true, "endpoint_id": "endpoint-5174daf63a2b6c2bb6ebc971", "packets_sent": 4880, "mac_addresses": [ "10:98:36:59:9d:cc" ], "bytes_received": 9688738, "evidence_frames": [ 2476, 2477, 2478, 2479, 2480 ], "last_seen_epoch": "1583964372.959813", "first_seen_epoch": "1583961810.313484", "packets_received": 9343 }, { "ip": "10.3.11.131", "bytes_sent": 0, "ip_version": 4, "is_private": true, "endpoint_id": "endpoint-4bd1b5c957c1d558ace11211", "packets_sent": 0, "mac_addresses": [ "00:0c:29:06:5a:ed" ], "bytes_received": 66, "evidence_frames": [ 18984 ], "last_seen_epoch": "1583962607.337749", "first_seen_epoch": "1583962607.337749", "packets_received": 1 }, { "ip": "10.3.11.194", "bytes_sent": 930787, "ip_version": 4, "is_private": true, "endpoint_id": "endpoint-8a98d16ead56aaf0ea618572", "packets_sent": 3840, "mac_addresses": [ "b8:ca:3a:ec:3b:8f" ], "bytes_received": 7642547, "evidence_frames": [ 1049, 1050, 1051, 1052, 1053 ], "last_seen_epoch": "1583963995.521211", "first_seen_epoch": "1583961775.448389", "packets_received": 7432 }, { "ip": "10.3.11.218", "bytes_sent": 454125, "ip_version": 4, "is_private": true, "endpoint_id": "endpoint-f390cb369c3c1937a8347d4e", "packets_sent": 2104, "mac_addresses": [ "00:1d:60:b5:5e:94" ], "bytes_received": 1838400, "evidence_frames": [ 1, 2, 3, 4, 5 ], "last_seen_epoch": "1583964400.899336", "first_seen_epoch": "1583961754.987241", "packets_received": 2682 }, { "ip": "10.3.11.254", "bytes_sent": 0, "ip_version": 4, "is_private": true, "endpoint_id": "endpoint-d48c950ca77e05972805a5fe", "packets_sent": 0, "mac_addresses": [ "00:50:56:f2:3a:ae" ], "bytes_received": 66, "evidence_frames": [ 18985 ], "last_seen_epoch": "1583962607.355615", "first_seen_epoch": "1583962607.355615", "packets_received": 1 }, { "ip": "10.3.11.255", "bytes_sent": 0, "ip_version": 4, "is_private": true, "endpoint_id": "endpoint-b76dfc36e541e79386ff715e", "packets_sent": 0, "mac_addresses": [ "ff:ff:ff:ff:ff:ff" ], "bytes_received": 19685, "evidence_frames": [ 1, 2, 219, 220, 277 ], "last_seen_epoch": "1583963972.84086", "first_seen_epoch": "1583961754.987241", "packets_received": 154 }, { "ip": "10.3.11.3", "bytes_sent": 1208108, "ip_version": 4, "is_private": true, "endpoint_id": "endpoint-2c1e9ccbe07c6d02f0af1711", "packets_sent": 2675, "mac_addresses": [ "a4:1f:72:c2:09:6a" ], "bytes_received": 611801, "evidence_frames": [ 3, 4, 5, 6, 7 ], "last_seen_epoch": "1583964312.292695", "first_seen_epoch": "1583961755.128744", "packets_received": 2691 }, { "ip": "104.117.242.71", "bytes_sent": 70074, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-dd01690f84ec9d39bbe54c6d", "packets_sent": 60, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2525, "evidence_frames": [ 21553, 21617, 21625, 21630, 21632 ], "last_seen_epoch": "1583962694.357915", "first_seen_epoch": "1583962651.154497", "packets_received": 23 }, { "ip": "104.244.42.8", "bytes_sent": 6078, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-78c22f3a17bc8f3ec035844a", "packets_sent": 26, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 3045, "evidence_frames": [ 7143, 7198, 7200, 7201, 7202 ], "last_seen_epoch": "1583962436.425174", "first_seen_epoch": "1583961857.790499", "packets_received": 25 }, { "ip": "104.254.148.166", "bytes_sent": 8667, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-508a9fdc1ba7586f2e398fd7", "packets_sent": 16, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 4745, "evidence_frames": [ 26086, 26171, 26179, 26185, 26186 ], "last_seen_epoch": "1583962694.356653", "first_seen_epoch": "1583962657.127662", "packets_received": 16 }, { "ip": "104.26.9.32", "bytes_sent": 33644, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-1cb2aa271404c9ff17f94b46", "packets_sent": 43, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2547, "evidence_frames": [ 4441, 4478, 4480, 4483, 4484 ], "last_seen_epoch": "1583962255.261746", "first_seen_epoch": "1583961854.841276", "packets_received": 28 }, { "ip": "104.36.113.17", "bytes_sent": 5494, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-0d4cad77dbc9997ad4a603cd", "packets_sent": 11, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 1825, "evidence_frames": [ 26262, 26333, 26336, 26337, 26338 ], "last_seen_epoch": "1583962694.408573", "first_seen_epoch": "1583962657.369788", "packets_received": 9 }, { "ip": "111.221.29.40", "bytes_sent": 19238, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-8e2de5b9722d3d1a7c6e2331", "packets_sent": 74, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 38831, "evidence_frames": [ 15316, 15317, 15318, 15319, 15320 ], "last_seen_epoch": "1583962421.035383", "first_seen_epoch": "1583962360.863942", "packets_received": 70 }, { "ip": "13.107.136.254", "bytes_sent": 13669, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-1e9b85c196d25ad337c80b1d", "packets_sent": 28, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2701, "evidence_frames": [ 4064, 4076, 4077, 4078, 4079 ], "last_seen_epoch": "1583962141.613497", "first_seen_epoch": "1583961837.217374", "packets_received": 24 }, { "ip": "13.107.18.254", "bytes_sent": 19528, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-cc678de9db6c03451461297b", "packets_sent": 40, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 3804, "evidence_frames": [ 1861, 1863, 1864, 1865, 1866 ], "last_seen_epoch": "1583962142.591133", "first_seen_epoch": "1583961789.192896", "packets_received": 30 }, { "ip": "13.107.21.200", "bytes_sent": 24401, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-37309314f8cc4d1eccb7fe08", "packets_sent": 73, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 21997, "evidence_frames": [ 2282, 2283, 2284, 2285, 2286 ], "last_seen_epoch": "1583963172.120019", "first_seen_epoch": "1583961806.125889", "packets_received": 71 }, { "ip": "13.107.246.10", "bytes_sent": 28606, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-d42c591cb52026f3691d5b67", "packets_sent": 62, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 9509, "evidence_frames": [ 1869, 1874, 1875, 1892, 1893 ], "last_seen_epoch": "1583962320.254337", "first_seen_epoch": "1583961789.226472", "packets_received": 47 }, { "ip": "13.107.246.254", "bytes_sent": 11152, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-08c68a8c112399b226371807", "packets_sent": 24, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2181, "evidence_frames": [ 2331, 2341, 2343, 2345, 2347 ], "last_seen_epoch": "1583961928.784285", "first_seen_epoch": "1583961806.448232", "packets_received": 22 }, { "ip": "13.107.3.128", "bytes_sent": 251580, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-06394b5ea46bc4b7e4c1308f", "packets_sent": 222, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 13193, "evidence_frames": [ 4343, 4344, 4345, 4346, 4347 ], "last_seen_epoch": "1583962737.836399", "first_seen_epoch": "1583961854.519862", "packets_received": 90 }, { "ip": "13.107.3.254", "bytes_sent": 5576, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-a0bb8b856169a0d6716ad7fb", "packets_sent": 12, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 1086, "evidence_frames": [ 2330, 2342, 2344, 2373, 2374 ], "last_seen_epoch": "1583961933.18488", "first_seen_epoch": "1583961806.431558", "packets_received": 11 }, { "ip": "13.107.42.254", "bytes_sent": 5297, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-0b35c148dc1645a7411d978d", "packets_sent": 12, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 1086, "evidence_frames": [ 2302, 2306, 2308, 2309, 2310 ], "last_seen_epoch": "1583961929.585689", "first_seen_epoch": "1583961806.273402", "packets_received": 11 }, { "ip": "13.107.43.14", "bytes_sent": 4675, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-00c7690711af10630f8a9e49", "packets_sent": 11, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 1038, "evidence_frames": [ 2368, 2377, 2379, 2397, 2398 ], "last_seen_epoch": "1583961934.661607", "first_seen_epoch": "1583961806.619489", "packets_received": 10 }, { "ip": "13.107.5.80", "bytes_sent": 27113, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-6aa14ad18f9767bcb2707a24", "packets_sent": 84, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 9802, "evidence_frames": [ 13134, 13135, 13136, 13137, 13138 ], "last_seen_epoch": "1583962039.248946", "first_seen_epoch": "1583962020.825554", "packets_received": 83 }, { "ip": "13.107.6.158", "bytes_sent": 15587, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-206ae74f9ab27a7ec26b4887", "packets_sent": 32, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 5098, "evidence_frames": [ 10213, 10214, 10215, 10216, 10217 ], "last_seen_epoch": "1583962694.367972", "first_seen_epoch": "1583961911.739899", "packets_received": 23 }, { "ip": "13.107.6.254", "bytes_sent": 5576, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-2dcc20c4f47ec6f6a360379e", "packets_sent": 12, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 1086, "evidence_frames": [ 2337, 2346, 2348, 2371, 2372 ], "last_seen_epoch": "1583961933.257733", "first_seen_epoch": "1583961806.498387", "packets_received": 11 }, { "ip": "13.249.26.99", "bytes_sent": 368089, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-b558ae6cc6b50190e44d83e1", "packets_sent": 284, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 9001, "evidence_frames": [ 5090, 5091, 5092, 5093, 5163 ], "last_seen_epoch": "1583962096.484873", "first_seen_epoch": "1583961856.234647", "packets_received": 92 }, { "ip": "13.68.93.109", "bytes_sent": 3880, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-9f746d90c9d5ed03256a1737", "packets_sent": 13, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 1296, "evidence_frames": [ 10457, 10458, 10459, 10460, 10461 ], "last_seen_epoch": "1583961955.39263", "first_seen_epoch": "1583961954.785969", "packets_received": 11 }, { "ip": "13.78.168.230", "bytes_sent": 7753, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-207e5a2fea579d2b75dc6a63", "packets_sent": 26, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2590, "evidence_frames": [ 15552, 15553, 15554, 15555, 15556 ], "last_seen_epoch": "1583962905.129383", "first_seen_epoch": "1583962385.53633", "packets_received": 22 }, { "ip": "13.78.177.144", "bytes_sent": 7847, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-035790508ab16ed06a6c291b", "packets_sent": 29, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 3778, "evidence_frames": [ 864, 878, 881, 883, 884 ], "last_seen_epoch": "1583963701.827062", "first_seen_epoch": "1583961760.453887", "packets_received": 24 }, { "ip": "13.78.186.254", "bytes_sent": 3849, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-753d7cadc48eb0979cbc9727", "packets_sent": 15, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 1951, "evidence_frames": [ 3513, 3525, 3530, 3532, 3533 ], "last_seen_epoch": "1583961928.523681", "first_seen_epoch": "1583961818.50059", "packets_received": 13 }, { "ip": "13.78.187.58", "bytes_sent": 7593, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-1a6ce5b336c1d2eed7fe8c3a", "packets_sent": 28, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 3838, "evidence_frames": [ 3305, 3320, 3321, 3324, 3325 ], "last_seen_epoch": "1583963797.780461", "first_seen_epoch": "1583961817.729089", "packets_received": 25 }, { "ip": "130.211.21.54", "bytes_sent": 6503, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-eb7dd4d601f0e9cd050cb76e", "packets_sent": 16, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 1917, "evidence_frames": [ 26008, 26018, 26019, 26020, 26021 ], "last_seen_epoch": "1583962694.356064", "first_seen_epoch": "1583962656.958958", "packets_received": 12 }, { "ip": "130.211.28.134", "bytes_sent": 5839, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-558d657497f2915be71cb912", "packets_sent": 18, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2400, "evidence_frames": [ 26218, 26253, 26255, 26258, 26259 ], "last_seen_epoch": "1583962694.362688", "first_seen_epoch": "1583962657.349198", "packets_received": 14 }, { "ip": "139.178.81.9", "bytes_sent": 8625, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-bfe3548d8f62624ee655a318", "packets_sent": 17, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2096, "evidence_frames": [ 25931, 25955, 25960, 25965, 25966 ], "last_seen_epoch": "1583962694.358895", "first_seen_epoch": "1583962656.834918", "packets_received": 13 }, { "ip": "151.101.50.208", "bytes_sent": 23334, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-18313d4c9dd2fffed3db6a2a", "packets_sent": 36, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2590, "evidence_frames": [ 6021, 6064, 6066, 6072, 6073 ], "last_seen_epoch": "1583962436.382276", "first_seen_epoch": "1583961857.069077", "packets_received": 27 }, { "ip": "152.199.4.210", "bytes_sent": 34777, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-de54874ba652394e20a5b13c", "packets_sent": 46, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 3946, "evidence_frames": [ 21319, 21440, 21455, 21484, 21485 ], "last_seen_epoch": "1583962694.358724", "first_seen_epoch": "1583962650.987599", "packets_received": 28 }, { "ip": "152.199.4.33", "bytes_sent": 70983, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-89bae76eeb061833783ea3a6", "packets_sent": 62, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2755, "evidence_frames": [ 12661, 12662, 12727, 12728, 12729 ], "last_seen_epoch": "1583962016.7879", "first_seen_epoch": "1583962015.539236", "packets_received": 30 }, { "ip": "169.46.74.216", "bytes_sent": 11218, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-e6e959021521c407301d8c19", "packets_sent": 27, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 6390, "evidence_frames": [ 26434, 26435, 26436, 26437, 26438 ], "last_seen_epoch": "1583962661.672971", "first_seen_epoch": "1583962658.985967", "packets_received": 22 }, { "ip": "169.60.140.161", "bytes_sent": 7061, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-e6f8159436c5f5bf42c06c5c", "packets_sent": 11, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 1567, "evidence_frames": [ 26617, 26618, 26619, 26620, 26621 ], "last_seen_epoch": "1583962663.791465", "first_seen_epoch": "1583962663.611536", "packets_received": 8 }, { "ip": "169.60.153.61", "bytes_sent": 9993, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-c936a0cd2d7320832cee8c0a", "packets_sent": 13, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 1602, "evidence_frames": [ 25250, 25266, 25269, 25270, 25271 ], "last_seen_epoch": "1583962655.804663", "first_seen_epoch": "1583962655.498797", "packets_received": 8 }, { "ip": "172.217.1.142", "bytes_sent": 6547, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-0a1c1f99bb8012643158a526", "packets_sent": 16, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 3236, "evidence_frames": [ 25135, 25137, 25138, 25139, 25140 ], "last_seen_epoch": "1583962694.36208", "first_seen_epoch": "1583962655.291586", "packets_received": 13 }, { "ip": "172.217.12.74", "bytes_sent": 78155, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-6913aa8e299b678d2a57a5f9", "packets_sent": 72, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 3381, "evidence_frames": [ 13829, 13830, 13831, 13832, 13833 ], "last_seen_epoch": "1583962039.250341", "first_seen_epoch": "1583962031.453804", "packets_received": 36 }, { "ip": "172.217.12.84", "bytes_sent": 31694, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-c0e40f890a50fbe0151ca482", "packets_sent": 32, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 1902, "evidence_frames": [ 25246, 25264, 25267, 25274, 25275 ], "last_seen_epoch": "1583962694.358174", "first_seen_epoch": "1583962655.497765", "packets_received": 16 }, { "ip": "172.217.14.161", "bytes_sent": 7968, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-ff32ef126ccca1edfce93a7c", "packets_sent": 16, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 1741, "evidence_frames": [ 24532, 24550, 24551, 24552, 24553 ], "last_seen_epoch": "1583962694.362023", "first_seen_epoch": "1583962654.504868", "packets_received": 12 }, { "ip": "172.217.14.162", "bytes_sent": 36346, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-325337cfa38244420d70719a", "packets_sent": 53, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 8735, "evidence_frames": [ 24067, 24108, 24110, 24114, 24117 ], "last_seen_epoch": "1583962694.361545", "first_seen_epoch": "1583962652.906972", "packets_received": 37 }, { "ip": "172.217.2.226", "bytes_sent": 21719, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-14b44007fd12fd2e910f8cf9", "packets_sent": 37, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 3698, "evidence_frames": [ 25172, 25181, 25182, 25183, 25184 ], "last_seen_epoch": "1583962694.362743", "first_seen_epoch": "1583962655.349363", "packets_received": 26 }, { "ip": "172.217.6.142", "bytes_sent": 68704, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-175ef3045363be6a6577df13", "packets_sent": 63, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 8277, "evidence_frames": [ 24524, 24533, 24534, 24535, 24536 ], "last_seen_epoch": "1583962694.361964", "first_seen_epoch": "1583962654.493678", "packets_received": 42 }, { "ip": "172.217.6.144", "bytes_sent": 80392, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-e2a7f460e649f686b5bdf9b5", "packets_sent": 61, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2326, "evidence_frames": [ 13335, 13336, 13373, 13374, 13375 ], "last_seen_epoch": "1583962039.249859", "first_seen_epoch": "1583962027.474539", "packets_received": 26 }, { "ip": "172.217.6.174", "bytes_sent": 6502, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-5fa4e9fffda2aa6dec4f109c", "packets_sent": 15, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 1688, "evidence_frames": [ 24102, 24109, 24111, 24112, 24113 ], "last_seen_epoch": "1583962694.361634", "first_seen_epoch": "1583962652.9086", "packets_received": 12 }, { "ip": "172.217.9.4", "bytes_sent": 122131, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-9ebc98e4e4b681d378561955", "packets_sent": 111, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 12570, "evidence_frames": [ 24234, 24238, 24242, 24246, 24247 ], "last_seen_epoch": "1583962694.356481", "first_seen_epoch": "1583962653.15038", "packets_received": 68 }, { "ip": "172.245.249.117", "bytes_sent": 3010, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-301e6b67f1e97eacc97768fa", "packets_sent": 52, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 3783, "evidence_frames": [ 27615, 27618, 27620, 27621, 27635 ], "last_seen_epoch": "1583963125.358352", "first_seen_epoch": "1583962937.855653", "packets_received": 52 }, { "ip": "173.194.223.154", "bytes_sent": 5940, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-c1ccb101adf74f48dd0aafe6", "packets_sent": 17, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2191, "evidence_frames": [ 24821, 24876, 24877, 24879, 24880 ], "last_seen_epoch": "1583962694.367959", "first_seen_epoch": "1583962654.708389", "packets_received": 14 }, { "ip": "18.213.117.209", "bytes_sent": 5122, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-a8ad51ff3af409d04c3acf0e", "packets_sent": 13, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 1777, "evidence_frames": [ 26011, 26037, 26040, 26041, 26042 ], "last_seen_epoch": "1583962694.38795", "first_seen_epoch": "1583962656.961539", "packets_received": 11 }, { "ip": "18.235.112.207", "bytes_sent": 415, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-1db3961f4ea045d7d48010e7", "packets_sent": 5, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 535, "evidence_frames": [ 14975, 14978, 14980, 14981, 14982 ], "last_seen_epoch": "1583962380.340263", "first_seen_epoch": "1583962320.199294", "packets_received": 6 }, { "ip": "185.14.31.98", "bytes_sent": 2259887, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-4164a315d013cf4473ec9c88", "packets_sent": 1547, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 17375, "evidence_frames": [ 16620, 16621, 16622, 16623, 16624 ], "last_seen_epoch": "1583963108.982225", "first_seen_epoch": "1583962553.328219", "packets_received": 265 }, { "ip": "185.141.27.238", "bytes_sent": 486, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-db99756f3d52b61696b74e74", "packets_sent": 9, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 990, "evidence_frames": [ 14593, 14594, 14595, 14596, 14599 ], "last_seen_epoch": "1583962316.747074", "first_seen_epoch": "1583962196.854388", "packets_received": 15 }, { "ip": "185.180.198.50", "bytes_sent": 54, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-99ee7c4cbd7d0a23999642af", "packets_sent": 1, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 330, "evidence_frames": [ 16322, 16323, 16325, 16326, 16486 ], "last_seen_epoch": "1583962606.481851", "first_seen_epoch": "1583962531.249089", "packets_received": 5 }, { "ip": "190.214.13.2", "bytes_sent": 35994, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-e75914fd21af70a5f2483ff0", "packets_sent": 219, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 49288, "evidence_frames": [ 15088, 15089, 15090, 15091, 15092 ], "last_seen_epoch": "1583963166.92032", "first_seen_epoch": "1583962327.886727", "packets_received": 209 }, { "ip": "192.243.232.58", "bytes_sent": 3850, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-a33629b03c7a546bf73e2ed7", "packets_sent": 10, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 1890, "evidence_frames": [ 23891, 24016, 24018, 24019, 24020 ], "last_seen_epoch": "1583962694.419259", "first_seen_epoch": "1583962652.657453", "packets_received": 9 }, { "ip": "195.123.242.48", "bytes_sent": 2548, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-78d33a2fd28251c5ad8103db", "packets_sent": 46, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 3492, "evidence_frames": [ 27677, 27679, 27681, 27682, 27687 ], "last_seen_epoch": "1583963150.631213", "first_seen_epoch": "1583962975.00924", "packets_received": 48 }, { "ip": "198.23.252.130", "bytes_sent": 2532, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-07fca577eaa774d9b5b3a31b", "packets_sent": 46, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 3438, "evidence_frames": [ 27731, 27732, 27733, 27734, 27735 ], "last_seen_epoch": "1583963166.91368", "first_seen_epoch": "1583963000.073303", "packets_received": 47 }, { "ip": "198.23.252.135", "bytes_sent": 390, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-f6e331bfb555d86f81f0d1f3", "packets_sent": 7, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 913, "evidence_frames": [ 28765, 28779, 28780, 28781, 28782 ], "last_seen_epoch": "1583963166.913222", "first_seen_epoch": "1583963050.247153", "packets_received": 7 }, { "ip": "199.187.193.166", "bytes_sent": 8682, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-80904db4d4c8d280d882d39d", "packets_sent": 22, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2960, "evidence_frames": [ 26199, 26241, 26242, 26246, 26247 ], "last_seen_epoch": "1583962694.391259", "first_seen_epoch": "1583962657.280223", "packets_received": 19 }, { "ip": "199.247.13.144", "bytes_sent": 561871, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-c6fd1e15cef848befaa87552", "packets_sent": 384, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 7796, "evidence_frames": [ 27776, 27778, 27779, 27780, 27781 ], "last_seen_epoch": "1583963026.215", "first_seen_epoch": "1583963020.431617", "packets_received": 134 }, { "ip": "20.44.86.43", "bytes_sent": 5319, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-aac9b8a52a1ab14062c840db", "packets_sent": 15, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 6434, "evidence_frames": [ 26767, 26768, 26769, 26770, 26771 ], "last_seen_epoch": "1583962684.742262", "first_seen_epoch": "1583962684.334984", "packets_received": 12 }, { "ip": "203.176.135.102", "bytes_sent": 2262, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-b13358e23497ea597d158aff", "packets_sent": 29, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 10251, "evidence_frames": [ 19029, 19111, 19113, 19114, 19115 ], "last_seen_epoch": "1583962729.520584", "first_seen_epoch": "1583962612.816786", "packets_received": 34 }, { "ip": "204.79.197.200", "bytes_sent": 51676, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-c4e87b30ed67c8799b672ce2", "packets_sent": 109, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 27575, "evidence_frames": [ 1805, 1806, 1807, 1808, 1809 ], "last_seen_epoch": "1583963188.477616", "first_seen_epoch": "1583961788.786049", "packets_received": 102 }, { "ip": "204.79.197.222", "bytes_sent": 13355, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-ad404c7daec750270370ead3", "packets_sent": 27, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2963, "evidence_frames": [ 1889, 1894, 1895, 1896, 1897 ], "last_seen_epoch": "1583962141.446591", "first_seen_epoch": "1583961789.26784", "packets_received": 22 }, { "ip": "204.79.197.254", "bytes_sent": 11774, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-be70079332b70052d5124d8f", "packets_sent": 27, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2693, "evidence_frames": [ 1839, 1844, 1846, 1848, 1849 ], "last_seen_epoch": "1583962140.186295", "first_seen_epoch": "1583961789.156001", "packets_received": 23 }, { "ip": "205.185.216.42", "bytes_sent": 763, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-eca360855fb6a7255108a14d", "packets_sent": 7, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 959, "evidence_frames": [ 27388, 27389, 27390, 27391, 27392 ], "last_seen_epoch": "1583962804.589919", "first_seen_epoch": "1583962744.518646", "packets_received": 7 }, { "ip": "209.97.130.197", "bytes_sent": 542849, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-161f75485ac94fdc9fbe600c", "packets_sent": 518, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 31573, "evidence_frames": [ 28322, 28323, 28324, 28325, 28326 ], "last_seen_epoch": "1583963123.597399", "first_seen_epoch": "1583963031.226347", "packets_received": 265 }, { "ip": "216.58.193.142", "bytes_sent": 32273, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-733e8d06e1f1725d9e9c05f1", "packets_sent": 41, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 7502, "evidence_frames": [ 6022, 6023, 6024, 6025, 6026 ], "last_seen_epoch": "1583962654.701329", "first_seen_epoch": "1583961857.069348", "packets_received": 29 }, { "ip": "216.58.194.104", "bytes_sent": 35281, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-46db6461911df311a864e35d", "packets_sent": 35, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 1856, "evidence_frames": [ 25257, 25258, 25259, 25260, 25261 ], "last_seen_epoch": "1583962694.362841", "first_seen_epoch": "1583962655.508725", "packets_received": 15 }, { "ip": "216.58.194.112", "bytes_sent": 5046, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-78dde4dc04e596e4c042b26b", "packets_sent": 14, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 1632, "evidence_frames": [ 25500, 25501, 25502, 25503, 25504 ], "last_seen_epoch": "1583962694.360141", "first_seen_epoch": "1583962655.864646", "packets_received": 11 }, { "ip": "216.58.194.131", "bytes_sent": 310114, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-0fe858c8c009950850c4b69f", "packets_sent": 309, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 25431, "evidence_frames": [ 4393, 4404, 4405, 4406, 4407 ], "last_seen_epoch": "1583962694.354725", "first_seen_epoch": "1583961854.759856", "packets_received": 184 }, { "ip": "216.58.194.42", "bytes_sent": 9469, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-fea7023b38ec149d670142fb", "packets_sent": 40, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 4049, "evidence_frames": [ 4392, 4400, 4401, 4402, 4403 ], "last_seen_epoch": "1583962436.365266", "first_seen_epoch": "1583961854.758733", "packets_received": 44 }, { "ip": "216.58.194.98", "bytes_sent": 102355, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-81010a1911241a9ea29cc84e", "packets_sent": 82, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 6751, "evidence_frames": [ 24233, 24237, 24241, 24248, 24249 ], "last_seen_epoch": "1583962694.358102", "first_seen_epoch": "1583962653.149151", "packets_received": 34 }, { "ip": "224.0.0.22", "bytes_sent": 0, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-e556895d6dcc0da864dc12f2", "packets_sent": 0, "mac_addresses": [ "01:00:5e:00:00:16" ], "bytes_received": 2094, "evidence_frames": [ 515, 517, 1051, 1052, 1053 ], "last_seen_epoch": "1583962545.700989", "first_seen_epoch": "1583961757.015636", "packets_received": 37 }, { "ip": "224.0.0.251", "bytes_sent": 0, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-beecc5c1978f143117884706", "packets_sent": 0, "mac_addresses": [ "01:00:5e:00:00:fb" ], "bytes_received": 4751, "evidence_frames": [ 1055, 1057, 1060, 1061, 1084 ], "last_seen_epoch": "1583962651.29314", "first_seen_epoch": "1583961778.958984", "packets_received": 62 }, { "ip": "224.0.0.252", "bytes_sent": 0, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-cc6eb7fcda30aa2aa2ce480b", "packets_sent": 0, "mac_addresses": [ "01:00:5e:00:00:fc" ], "bytes_received": 3418, "evidence_frames": [ 1056, 1062, 1086, 1087, 1088 ], "last_seen_epoch": "1583962650.696699", "first_seen_epoch": "1583961778.962152", "packets_received": 51 }, { "ip": "23.199.252.214", "bytes_sent": 609, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-9a7bc8ceab6fbb3b27f01d85", "packets_sent": 8, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 986, "evidence_frames": [ 21134, 21135, 21150, 21151, 21152 ], "last_seen_epoch": "1583962694.366382", "first_seen_epoch": "1583962650.350628", "packets_received": 10 }, { "ip": "23.199.253.39", "bytes_sent": 5295, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-903a3eaccf935cf20419b90f", "packets_sent": 9, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 1041, "evidence_frames": [ 21295, 21323, 21330, 21340, 21343 ], "last_seen_epoch": "1583962661.166591", "first_seen_epoch": "1583962650.95892", "packets_received": 8 }, { "ip": "23.199.253.53", "bytes_sent": 8493, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-42bb9e8ec256e74ca427e017", "packets_sent": 14, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2601, "evidence_frames": [ 26152, 26177, 26184, 26187, 26188 ], "last_seen_epoch": "1583962694.366533", "first_seen_epoch": "1583962657.209155", "packets_received": 12 }, { "ip": "23.204.16.227", "bytes_sent": 8971, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-2910e4437bb2ee2853fb95af", "packets_sent": 15, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2318, "evidence_frames": [ 21493, 21588, 21592, 21606, 21618 ], "last_seen_epoch": "1583962694.372905", "first_seen_epoch": "1583962651.137754", "packets_received": 12 }, { "ip": "23.206.208.173", "bytes_sent": 9104, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-ef23cedbd4333a5f86ad5eea", "packets_sent": 37, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 4993, "evidence_frames": [ 7614, 7620, 7622, 7633, 7634 ], "last_seen_epoch": "1583962436.367051", "first_seen_epoch": "1583961859.234595", "packets_received": 43 }, { "ip": "23.206.213.111", "bytes_sent": 21873, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-63c7444ebcaf2413d28c4c67", "packets_sent": 39, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 3108, "evidence_frames": [ 15572, 15573, 15574, 15575, 15576 ], "last_seen_epoch": "1583962861.464", "first_seen_epoch": "1583962385.664542", "packets_received": 25 }, { "ip": "23.209.74.120", "bytes_sent": 3422761, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-f30e2c2e4d93c25169a06acd", "packets_sent": 2361, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 38718, "evidence_frames": [ 4428, 4429, 4430, 4461, 4462 ], "last_seen_epoch": "1583962436.36665", "first_seen_epoch": "1583961854.811192", "packets_received": 590 }, { "ip": "23.211.18.27", "bytes_sent": 138513, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-56707a16293940d7d426e9e0", "packets_sent": 174, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 12781, "evidence_frames": [ 4397, 4408, 4409, 4410, 4411 ], "last_seen_epoch": "1583962436.366222", "first_seen_epoch": "1583961854.767615", "packets_received": 120 }, { "ip": "23.211.36.128", "bytes_sent": 10566, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-76f1f4969a4d4d1ec68a8216", "packets_sent": 16, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2065, "evidence_frames": [ 12481, 12482, 12483, 12484, 12485 ], "last_seen_epoch": "1583962016.787264", "first_seen_epoch": "1583962014.098217", "packets_received": 17 }, { "ip": "23.4.97.247", "bytes_sent": 188198, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-a815bf9bae048f80c3fd43de", "packets_sent": 312, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 32226, "evidence_frames": [ 605, 634, 635, 636, 637 ], "last_seen_epoch": "1583961819.163252", "first_seen_epoch": "1583961758.616386", "packets_received": 210 }, { "ip": "23.44.170.27", "bytes_sent": 6490, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-6cdc927b16d42d8cb485a724", "packets_sent": 13, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 1620, "evidence_frames": [ 5248, 5255, 5256, 5257, 5258 ], "last_seen_epoch": "1583961896.519772", "first_seen_epoch": "1583961856.365321", "packets_received": 11 }, { "ip": "23.46.28.16", "bytes_sent": 5358, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-810bdabf6c08e01690f45e5a", "packets_sent": 12, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 1110, "evidence_frames": [ 1825, 1828, 1829, 1830, 1831 ], "last_seen_epoch": "1583961832.734922", "first_seen_epoch": "1583961789.116252", "packets_received": 12 }, { "ip": "23.63.253.208", "bytes_sent": 1179, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-790bd772268a0e6a8a23bc2e", "packets_sent": 3, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 410, "evidence_frames": [ 21900, 21905, 21906, 21909, 21910 ], "last_seen_epoch": "1583962694.383465", "first_seen_epoch": "1583962651.379048", "packets_received": 5 }, { "ip": "239.255.255.250", "bytes_sent": 0, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-aa377adbba1189ca9b46077f", "packets_sent": 0, "mac_addresses": [ "01:00:5e:7f:ff:fa" ], "bytes_received": 17391, "evidence_frames": [ 516, 518, 521, 522, 523 ], "last_seen_epoch": "1583963092.293061", "first_seen_epoch": "1583961757.053472", "packets_received": 91 }, { "ip": "3.215.9.190", "bytes_sent": 6510, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-5c2356a5bb22327be859408f", "packets_sent": 16, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 1999, "evidence_frames": [ 26100, 26175, 26182, 26191, 26192 ], "last_seen_epoch": "1583962694.39105", "first_seen_epoch": "1583962657.137965", "packets_received": 12 }, { "ip": "3.219.244.74", "bytes_sent": 16248, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-d62015010cbf8d55238c63c2", "packets_sent": 47, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 12553, "evidence_frames": [ 21386, 21565, 21567, 21568, 21569 ], "last_seen_epoch": "1583962662.763181", "first_seen_epoch": "1583962651.093461", "packets_received": 39 }, { "ip": "3.225.102.19", "bytes_sent": 7931, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-b158a14db496f8682fd0ed26", "packets_sent": 19, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2504, "evidence_frames": [ 26009, 26036, 26039, 26043, 26044 ], "last_seen_epoch": "1583962694.391322", "first_seen_epoch": "1583962656.959164", "packets_received": 16 }, { "ip": "31.13.65.36", "bytes_sent": 5414, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-423f373f3585e3b19e639813", "packets_sent": 19, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 3513, "evidence_frames": [ 25888, 25889, 25890, 25891, 25892 ], "last_seen_epoch": "1583962694.369899", "first_seen_epoch": "1583962656.669662", "packets_received": 16 }, { "ip": "31.13.65.7", "bytes_sent": 289420, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-010a76af937b60bb8e072f60", "packets_sent": 233, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 7227, "evidence_frames": [ 6000, 6037, 6060, 6061, 6063 ], "last_seen_epoch": "1583962694.366395", "first_seen_epoch": "1583961856.975874", "packets_received": 65 }, { "ip": "31.13.93.35", "bytes_sent": 397931, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-dab6cc70626a8cf9e066919d", "packets_sent": 327, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 22439, "evidence_frames": [ 7213, 7214, 7215, 7216, 7217 ], "last_seen_epoch": "1583961985.473662", "first_seen_epoch": "1583961858.000198", "packets_received": 107 }, { "ip": "34.102.147.248", "bytes_sent": 30192, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-225e5bdb22515f0707a5b562", "packets_sent": 31, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2055, "evidence_frames": [ 25249, 25265, 25268, 25272, 25273 ], "last_seen_epoch": "1583962694.357987", "first_seen_epoch": "1583962655.498632", "packets_received": 18 }, { "ip": "34.208.131.21", "bytes_sent": 8970, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-3595b5979e5c24613a4fb7c6", "packets_sent": 19, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 4911, "evidence_frames": [ 21916, 22134, 22137, 22169, 22173 ], "last_seen_epoch": "1583962694.412958", "first_seen_epoch": "1583962651.476057", "packets_received": 17 }, { "ip": "34.209.127.1", "bytes_sent": 7323, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-3ce397da47ffab404a12eb83", "packets_sent": 13, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 1792, "evidence_frames": [ 23808, 23812, 23813, 23814, 23815 ], "last_seen_epoch": "1583962694.415653", "first_seen_epoch": "1583962652.423622", "packets_received": 9 }, { "ip": "34.211.22.199", "bytes_sent": 16210, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-6614ab892674f1244fde922a", "packets_sent": 44, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 8070, "evidence_frames": [ 24103, 24143, 24146, 24150, 24151 ], "last_seen_epoch": "1583962694.354309", "first_seen_epoch": "1583962652.915907", "packets_received": 41 }, { "ip": "34.231.157.146", "bytes_sent": 7439, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-2055c10aa2e12f9198d9263c", "packets_sent": 16, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2047, "evidence_frames": [ 26143, 26176, 26183, 26189, 26190 ], "last_seen_epoch": "1583962694.391973", "first_seen_epoch": "1583962657.186673", "packets_received": 12 }, { "ip": "34.234.197.182", "bytes_sent": 7385, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-1448bf33a3b5489e87d30d9f", "packets_sent": 15, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2461, "evidence_frames": [ 26536, 26547, 26548, 26549, 26550 ], "last_seen_epoch": "1583962694.354803", "first_seen_epoch": "1583962661.465247", "packets_received": 13 }, { "ip": "34.98.67.3", "bytes_sent": 45425, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-9560f56277c21a9f5c2fda66", "packets_sent": 53, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 3633, "evidence_frames": [ 25545, 25701, 25705, 25720, 25721 ], "last_seen_epoch": "1583962694.358327", "first_seen_epoch": "1583962655.937995", "packets_received": 28 }, { "ip": "35.190.72.21", "bytes_sent": 7675, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-cff500f4437edc96452224a4", "packets_sent": 21, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2499, "evidence_frames": [ 25913, 25917, 25918, 25920, 25921 ], "last_seen_epoch": "1583962694.355957", "first_seen_epoch": "1583962656.791323", "packets_received": 17 }, { "ip": "35.241.23.116", "bytes_sent": 34984, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-e97b4864e11d501f122c0d00", "packets_sent": 101, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 13229, "evidence_frames": [ 25543, 25546, 25547, 25548, 25553 ], "last_seen_epoch": "1583962694.361852", "first_seen_epoch": "1583962655.937741", "packets_received": 81 }, { "ip": "35.244.140.139", "bytes_sent": 4845, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-fbb3e50be2c6baf04825b5bc", "packets_sent": 17, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2175, "evidence_frames": [ 26099, 26105, 26106, 26107, 26108 ], "last_seen_epoch": "1583962694.362795", "first_seen_epoch": "1583962657.137742", "packets_received": 14 }, { "ip": "40.119.2.214", "bytes_sent": 35983, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-efbb915a367e7a971d0def9c", "packets_sent": 94, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 8782, "evidence_frames": [ 3700, 3701, 3702, 3703, 3704 ], "last_seen_epoch": "1583962551.248878", "first_seen_epoch": "1583961823.77447", "packets_received": 75 }, { "ip": "40.126.0.67", "bytes_sent": 5996, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-5b4bae1e8094184f8e69158d", "packets_sent": 10, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 1483, "evidence_frames": [ 8137, 8140, 8141, 8142, 8143 ], "last_seen_epoch": "1583961870.718012", "first_seen_epoch": "1583961870.478405", "packets_received": 10 }, { "ip": "40.69.218.62", "bytes_sent": 7593, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-1b15ce1fe0873756f4ae30f2", "packets_sent": 26, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2481, "evidence_frames": [ 527, 528, 529, 530, 531 ], "last_seen_epoch": "1583961816.128317", "first_seen_epoch": "1583961757.846735", "packets_received": 23 }, { "ip": "40.90.22.185", "bytes_sent": 50214, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-dbdfa9d25ca5614a64394b31", "packets_sent": 70, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 18757, "evidence_frames": [ 8551, 8557, 8558, 8559, 8560 ], "last_seen_epoch": "1583962094.004988", "first_seen_epoch": "1583961873.977039", "packets_received": 42 }, { "ip": "40.90.22.187", "bytes_sent": 39071, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-876ba1101a1b9d367a881b4f", "packets_sent": 57, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 12911, "evidence_frames": [ 15442, 15443, 15444, 15445, 15446 ], "last_seen_epoch": "1583962794.153337", "first_seen_epoch": "1583962381.382733", "packets_received": 33 }, { "ip": "40.90.22.191", "bytes_sent": 19989, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-caca394562cd7c4f6ca645b1", "packets_sent": 29, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 6580, "evidence_frames": [ 10483, 10484, 10485, 10486, 10487 ], "last_seen_epoch": "1583961956.214532", "first_seen_epoch": "1583961955.609469", "packets_received": 17 }, { "ip": "40.91.76.238", "bytes_sent": 764892, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-66b6cc28c02d6f405c94047e", "packets_sent": 1091, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 351740, "evidence_frames": [ 10541, 10542, 10543, 10544, 10545 ], "last_seen_epoch": "1583962858.346465", "first_seen_epoch": "1583961956.381264", "packets_received": 689 }, { "ip": "45.148.120.153", "bytes_sent": 60594, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-b67334c884080ea10178d9d4", "packets_sent": 46, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 1736, "evidence_frames": [ 14834, 14835, 14836, 14837, 14838 ], "last_seen_epoch": "1583962319.415409", "first_seen_epoch": "1583962318.213276", "packets_received": 22 }, { "ip": "50.87.248.17", "bytes_sent": 484881, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-eb13423a04ddf53c295aff3b", "packets_sent": 325, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 3626, "evidence_frames": [ 8613, 8614, 8615, 8616, 8617 ], "last_seen_epoch": "1583961877.065453", "first_seen_epoch": "1583961876.446849", "packets_received": 64 }, { "ip": "51.254.164.244", "bytes_sent": 9226, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-b4cd02e1e7495e25c049783d", "packets_sent": 57, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 52312, "evidence_frames": [ 14902, 14903, 14904, 14905, 14906 ], "last_seen_epoch": "1583962390.165012", "first_seen_epoch": "1583962319.417356", "packets_received": 50 }, { "ip": "52.109.12.19", "bytes_sent": 21819, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-399e659c5c02790519574385", "packets_sent": 39, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 4894, "evidence_frames": [ 3123, 3124, 3125, 3126, 3127 ], "last_seen_epoch": "1583962046.219517", "first_seen_epoch": "1583961816.74346", "packets_received": 28 }, { "ip": "52.109.8.30", "bytes_sent": 7429, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-146d5e8092c52526a052748f", "packets_sent": 12, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 1322, "evidence_frames": [ 14422, 14423, 14424, 14425, 14426 ], "last_seen_epoch": "1583962237.925912", "first_seen_epoch": "1583962114.660986", "packets_received": 8 }, { "ip": "52.109.88.36", "bytes_sent": 7273, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-f23da3c1bff5e10630f66d02", "packets_sent": 13, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 1614, "evidence_frames": [ 29847, 29848, 29849, 29850, 29851 ], "last_seen_epoch": "1583963597.791841", "first_seen_epoch": "1583963487.7326", "packets_received": 9 }, { "ip": "52.114.132.73", "bytes_sent": 25768, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-6a928e5c0b1a07ba9932461d", "packets_sent": 63, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 24592, "evidence_frames": [ 3707, 3708, 3709, 3710, 3711 ], "last_seen_epoch": "1583962253.65866", "first_seen_epoch": "1583961824.006906", "packets_received": 56 }, { "ip": "52.114.77.34", "bytes_sent": 29613, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-f8fae0873849fd5994eee962", "packets_sent": 66, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 19133, "evidence_frames": [ 1020, 1021, 1022, 1023, 1024 ], "last_seen_epoch": "1583962222.365609", "first_seen_epoch": "1583961766.606521", "packets_received": 55 }, { "ip": "52.161.15.246", "bytes_sent": 53523, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-395353acd295d4de045c0b85", "packets_sent": 203, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 26876, "evidence_frames": [ 754, 758, 760, 763, 765 ], "last_seen_epoch": "1583964372.959813", "first_seen_epoch": "1583961759.736052", "packets_received": 175 }, { "ip": "52.173.134.115", "bytes_sent": 232106, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-1d89d739f2582890c3632c26", "packets_sent": 202, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 15876, "evidence_frames": [ 12514, 12515, 12516, 12517, 12518 ], "last_seen_epoch": "1583962016.787738", "first_seen_epoch": "1583962014.307668", "packets_received": 93 }, { "ip": "52.179.129.229", "bytes_sent": 11449, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-6a1de93144f5e94b32ac6c05", "packets_sent": 26, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 5998, "evidence_frames": [ 4010, 4011, 4012, 4013, 4014 ], "last_seen_epoch": "1583961849.475435", "first_seen_epoch": "1583961833.294232", "packets_received": 26 }, { "ip": "52.230.220.159", "bytes_sent": 73247, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-399b5a500f524f5c73c3cf70", "packets_sent": 161, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 94321, "evidence_frames": [ 15205, 15206, 15207, 15208, 15209 ], "last_seen_epoch": "1583962418.282803", "first_seen_epoch": "1583962359.663942", "packets_received": 128 }, { "ip": "52.230.222.68", "bytes_sent": 41632, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-6e039f8aef26e4c7d61c4b4b", "packets_sent": 129, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 21333, "evidence_frames": [ 14922, 14930, 14934, 14936, 14937 ], "last_seen_epoch": "1583964317.350369", "first_seen_epoch": "1583962319.966128", "packets_received": 103 }, { "ip": "52.242.211.89", "bytes_sent": 18018, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-78f67ba9730ef1fb3a4f7108", "packets_sent": 56, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 9217, "evidence_frames": [ 12358, 12359, 12360, 12361, 12362 ], "last_seen_epoch": "1583964400.899336", "first_seen_epoch": "1583961994.714835", "packets_received": 45 }, { "ip": "52.45.33.138", "bytes_sent": 6683, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-5565c3eca8557f284f156757", "packets_sent": 13, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2760, "evidence_frames": [ 26393, 26404, 26405, 26406, 26407 ], "last_seen_epoch": "1583962661.16739", "first_seen_epoch": "1583962657.789109", "packets_received": 13 }, { "ip": "52.9.108.55", "bytes_sent": 44511, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-26fd760cd90fe5659ab8cd9c", "packets_sent": 58, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 4223, "evidence_frames": [ 4546, 4561, 4562, 4563, 4564 ], "last_seen_epoch": "1583962436.425363", "first_seen_epoch": "1583961854.928008", "packets_received": 39 }, { "ip": "52.98.73.226", "bytes_sent": 4334, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-e2359576fe06a286211a5a81", "packets_sent": 8, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 695, "evidence_frames": [ 1899, 1938, 1939, 1940, 1941 ], "last_seen_epoch": "1583961914.886707", "first_seen_epoch": "1583961789.287366", "packets_received": 6 }, { "ip": "54.153.98.238", "bytes_sent": 9598, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-ebfe1fcd8224565716cd36d0", "packets_sent": 22, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2455, "evidence_frames": [ 16285, 16286, 16287, 16288, 16289 ], "last_seen_epoch": "1583962694.394186", "first_seen_epoch": "1583962457.872733", "packets_received": 19 }, { "ip": "54.244.36.123", "bytes_sent": 7032, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-9adf2475c31a90e41f465082", "packets_sent": 14, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 1801, "evidence_frames": [ 26578, 26579, 26580, 26581, 26582 ], "last_seen_epoch": "1583962694.413599", "first_seen_epoch": "1583962661.874568", "packets_received": 11 }, { "ip": "63.148.46.76", "bytes_sent": 29183, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-0a7456bbaa581f635be56ab1", "packets_sent": 36, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 3425, "evidence_frames": [ 25245, 25297, 25307, 25314, 25315 ], "last_seen_epoch": "1583962694.397992", "first_seen_epoch": "1583962655.497573", "packets_received": 22 }, { "ip": "64.4.54.254", "bytes_sent": 35430, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-e0b7817f1b593b337bbea4dc", "packets_sent": 66, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 19356, "evidence_frames": [ 12951, 12952, 12953, 12954, 12955 ], "last_seen_epoch": "1583962016.788304", "first_seen_epoch": "1583962015.941477", "packets_received": 67 }, { "ip": "64.44.133.131", "bytes_sent": 1813153, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-6e4c07517f3ef0d94e1ea879", "packets_sent": 1216, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 16778, "evidence_frames": [ 18428, 18429, 18430, 18431, 18432 ], "last_seen_epoch": "1583962675.107561", "first_seen_epoch": "1583962605.617067", "packets_received": 303 }, { "ip": "65.254.227.240", "bytes_sent": 534888, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-bd87b54380dc2eead2c63542", "packets_sent": 380, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 11662, "evidence_frames": [ 13303, 13304, 13305, 13306, 13307 ], "last_seen_epoch": "1583962039.250137", "first_seen_epoch": "1583962027.253624", "packets_received": 139 }, { "ip": "72.167.191.69", "bytes_sent": 21424, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-0100e807de655c75de88acd8", "packets_sent": 24, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2160, "evidence_frames": [ 4349, 4350, 4364, 4365, 4366 ], "last_seen_epoch": "1583961864.903457", "first_seen_epoch": "1583961854.573113", "packets_received": 16 }, { "ip": "72.21.81.200", "bytes_sent": 10258, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-6b10b2977f675235f43bf88a", "packets_sent": 16, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 1065, "evidence_frames": [ 4069, 4080, 4082, 4084, 4085 ], "last_seen_epoch": "1583963202.19958", "first_seen_epoch": "1583961837.231292", "packets_received": 11 }, { "ip": "72.21.91.29", "bytes_sent": 2164, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-1b94c9d037596dfae2725c88", "packets_sent": 6, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 685, "evidence_frames": [ 10497, 10498, 10499, 10500, 10501 ], "last_seen_epoch": "1583962016.142298", "first_seen_epoch": "1583961955.806692", "packets_received": 6 }, { "ip": "72.21.91.66", "bytes_sent": 60637, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-7d303d6916a7b3f9918e7485", "packets_sent": 77, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 6228, "evidence_frames": [ 6074, 6082, 6124, 6130, 6151 ], "last_seen_epoch": "1583962436.367306", "first_seen_epoch": "1583961857.235086", "packets_received": 54 }, { "ip": "72.246.84.150", "bytes_sent": 249066, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-ff2cd99b43794b86eb246ef7", "packets_sent": 206, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 8517, "evidence_frames": [ 4545, 4556, 4558, 4559, 4560 ], "last_seen_epoch": "1583962690.728097", "first_seen_epoch": "1583961854.927665", "packets_received": 72 }, { "ip": "72.246.84.229", "bytes_sent": 2791401, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-9363d96f23692ca624b065d0", "packets_sent": 2196, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 79391, "evidence_frames": [ 21196, 21200, 21201, 21202, 21203 ], "last_seen_epoch": "1583962694.366486", "first_seen_epoch": "1583962650.528623", "packets_received": 692 }, { "ip": "8.253.164.248", "bytes_sent": 1045, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-8a500aa27d444ecfcbf4b235", "packets_sent": 7, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 959, "evidence_frames": [ 10326, 10327, 10328, 10329, 10330 ], "last_seen_epoch": "1583961994.357508", "first_seen_epoch": "1583961934.212345", "packets_received": 7 }, { "ip": "8.43.72.97", "bytes_sent": 4475, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-31a05bf3fda416d07e5d9e62", "packets_sent": 11, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 1973, "evidence_frames": [ 26084, 26145, 26149, 26150, 26151 ], "last_seen_epoch": "1583962694.355144", "first_seen_epoch": "1583962657.126544", "packets_received": 9 }, { "ip": "89.187.164.37", "bytes_sent": 5019, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-e12cdd9b412b1fd4cf51f78c", "packets_sent": 13, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 1786, "evidence_frames": [ 26091, 26113, 26115, 26116, 26117 ], "last_seen_epoch": "1583962694.364885", "first_seen_epoch": "1583962657.13217", "packets_received": 11 } ], "identities": [ { "type": "account", "value": "dominga.mcdowell", "bindings": [ { "account": "", "owner_ip": "10.3.11.218", "frame_number": 1586, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.3.11.3", "conversation_src": "10.3.11.218" }, { "account": "", "owner_ip": "10.3.11.218", "frame_number": 1594, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.3.11.3", "conversation_src": "10.3.11.218" }, { "account": "", "owner_ip": "10.3.11.218", "frame_number": 1596, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.3.11.218", "conversation_src": "10.3.11.3" }, { "account": "", "owner_ip": "10.3.11.218", "frame_number": 1608, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.3.11.218", "conversation_src": "10.3.11.3" }, { "account": "", "owner_ip": "10.3.11.218", "frame_number": 1630, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.3.11.218", "conversation_src": "10.3.11.3" }, { "account": "", "owner_ip": "10.3.11.218", "frame_number": 1668, "relationship": "client-asserted", "source_field": "ntlmssp.auth.username", "conversation_dst": "10.3.11.3", "conversation_src": "10.3.11.218" }, { "account": "dominga.mcdowell", "owner_ip": null, "frame_number": 1698, "relationship": "directory-subject-returned-to-client", "source_field": "samr.samr_UserInfo21.account_name", "conversation_dst": "10.3.11.218", "conversation_src": "10.3.11.3" }, { "account": "", "owner_ip": "10.3.11.218", "frame_number": 1731, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.3.11.218", "conversation_src": "10.3.11.3" }, { "account": "", "owner_ip": "10.3.11.218", "frame_number": 1743, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.3.11.218", "conversation_src": "10.3.11.3" }, { "account": "", "owner_ip": "10.3.11.218", "frame_number": 29657, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.3.11.218", "conversation_src": "10.3.11.3" }, { "account": "dominga.mcdowell", "owner_ip": null, "frame_number": 29710, "relationship": "directory-subject-returned-to-client", "source_field": "samr.samr_UserInfo21.account_name", "conversation_dst": "10.3.11.218", "conversation_src": "10.3.11.3" } ], "evidence": [ { "tcp_stream": 76, "frame_number": 1586, "display_filter": "frame.number == 1586", "timestamp_epoch": "1583961783.076689000" }, { "tcp_stream": 77, "frame_number": 1594, "display_filter": "frame.number == 1594", "timestamp_epoch": "1583961783.090540000" }, { "tcp_stream": 77, "frame_number": 1596, "display_filter": "frame.number == 1596", "timestamp_epoch": "1583961783.091267000" }, { "tcp_stream": 78, "frame_number": 1608, "display_filter": "frame.number == 1608", "timestamp_epoch": "1583961783.094118000" }, { "tcp_stream": 80, "frame_number": 1630, "display_filter": "frame.number == 1630", "timestamp_epoch": "1583961783.481403000" }, { "tcp_stream": 81, "frame_number": 1668, "display_filter": "frame.number == 1668", "timestamp_epoch": "1583961783.523575000" }, { "tcp_stream": 81, "frame_number": 1698, "display_filter": "frame.number == 1698", "timestamp_epoch": "1583961783.552100000" }, { "tcp_stream": 84, "frame_number": 1731, "display_filter": "frame.number == 1731", "timestamp_epoch": "1583961783.705651000" }, { "tcp_stream": 85, "frame_number": 1743, "display_filter": "frame.number == 1743", "timestamp_epoch": "1583961783.707718000" }, { "tcp_stream": 644, "frame_number": 29657, "display_filter": "frame.number == 29657", "timestamp_epoch": "1583963188.844857000" }, { "tcp_stream": 643, "frame_number": 29710, "display_filter": "frame.number == 29710", "timestamp_epoch": "1583963188.870712000" } ], "raw_values": [ "dominga.mcdowell" ], "identity_id": "identity-6a0b891e51b985dd21e63acf", "ip_addresses": [ "10.3.11.218" ], "mac_addresses": [ "00:1d:60:b5:5e:94" ] }, { "type": "account", "value": "dorian.neff", "bindings": [ { "account": "", "owner_ip": "10.3.11.119", "frame_number": 3774, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.3.11.3", "conversation_src": "10.3.11.119" }, { "account": "", "owner_ip": "10.3.11.119", "frame_number": 3782, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.3.11.3", "conversation_src": "10.3.11.119" }, { "account": "", "owner_ip": "10.3.11.119", "frame_number": 3784, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.3.11.119", "conversation_src": "10.3.11.3" }, { "account": "", "owner_ip": "10.3.11.119", "frame_number": 3796, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.3.11.119", "conversation_src": "10.3.11.3" }, { "account": "", "owner_ip": "10.3.11.119", "frame_number": 3810, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.3.11.119", "conversation_src": "10.3.11.3" }, { "account": "", "owner_ip": "10.3.11.119", "frame_number": 3851, "relationship": "client-asserted", "source_field": "ntlmssp.auth.username", "conversation_dst": "10.3.11.3", "conversation_src": "10.3.11.119" }, { "account": "dorian.neff", "owner_ip": null, "frame_number": 3881, "relationship": "directory-subject-returned-to-client", "source_field": "samr.samr_UserInfo21.account_name", "conversation_dst": "10.3.11.119", "conversation_src": "10.3.11.3" }, { "account": "", "owner_ip": "10.3.11.119", "frame_number": 3913, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.3.11.119", "conversation_src": "10.3.11.3" }, { "account": "", "owner_ip": "10.3.11.119", "frame_number": 3923, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.3.11.119", "conversation_src": "10.3.11.3" }, { "account": "", "owner_ip": "10.3.11.119", "frame_number": 29771, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.3.11.119", "conversation_src": "10.3.11.3" }, { "account": "dorian.neff", "owner_ip": null, "frame_number": 29808, "relationship": "directory-subject-returned-to-client", "source_field": "samr.samr_UserInfo21.account_name", "conversation_dst": "10.3.11.119", "conversation_src": "10.3.11.3" } ], "evidence": [ { "tcp_stream": 176, "frame_number": 3774, "display_filter": "frame.number == 3774", "timestamp_epoch": "1583961831.211778000" }, { "tcp_stream": 177, "frame_number": 3782, "display_filter": "frame.number == 3782", "timestamp_epoch": "1583961831.218489000" }, { "tcp_stream": 177, "frame_number": 3784, "display_filter": "frame.number == 3784", "timestamp_epoch": "1583961831.219139000" }, { "tcp_stream": 178, "frame_number": 3796, "display_filter": "frame.number == 3796", "timestamp_epoch": "1583961831.221374000" }, { "tcp_stream": 179, "frame_number": 3810, "display_filter": "frame.number == 3810", "timestamp_epoch": "1583961831.471997000" }, { "tcp_stream": 180, "frame_number": 3851, "display_filter": "frame.number == 3851", "timestamp_epoch": "1583961831.521451000" }, { "tcp_stream": 180, "frame_number": 3881, "display_filter": "frame.number == 3881", "timestamp_epoch": "1583961831.548512000" }, { "tcp_stream": 183, "frame_number": 3913, "display_filter": "frame.number == 3913", "timestamp_epoch": "1583961831.665581000" }, { "tcp_stream": 184, "frame_number": 3923, "display_filter": "frame.number == 3923", "timestamp_epoch": "1583961831.667240000" }, { "tcp_stream": 646, "frame_number": 29771, "display_filter": "frame.number == 29771", "timestamp_epoch": "1583963206.448708000" }, { "tcp_stream": 645, "frame_number": 29808, "display_filter": "frame.number == 29808", "timestamp_epoch": "1583963206.462085000" } ], "raw_values": [ "dorian.neff" ], "identity_id": "identity-3b363a48dffc55c0c9ab1e63", "ip_addresses": [ "10.3.11.119" ], "mac_addresses": [ "10:98:36:59:9d:cc" ] }, { "type": "account", "value": "laptop-7xmv2sn$", "bindings": [ { "account": "", "owner_ip": "10.3.11.194", "frame_number": 1130, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.3.11.3", "conversation_src": "10.3.11.194" }, { "account": "", "owner_ip": "10.3.11.194", "frame_number": 1139, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.3.11.3", "conversation_src": "10.3.11.194" }, { "account": "", "owner_ip": "10.3.11.194", "frame_number": 1141, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.3.11.194", "conversation_src": "10.3.11.3" }, { "account": "", "owner_ip": "10.3.11.194", "frame_number": 1157, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.3.11.194", "conversation_src": "10.3.11.3" }, { "account": "", "owner_ip": "10.3.11.194", "frame_number": 1169, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.3.11.3", "conversation_src": "10.3.11.194" }, { "account": "", "owner_ip": "10.3.11.194", "frame_number": 1183, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.3.11.3", "conversation_src": "10.3.11.194" }, { "account": "", "owner_ip": "10.3.11.194", "frame_number": 1185, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.3.11.194", "conversation_src": "10.3.11.3" }, { "account": "", "owner_ip": "10.3.11.194", "frame_number": 1205, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.3.11.194", "conversation_src": "10.3.11.3" }, { "account": "", "owner_ip": "10.3.11.194", "frame_number": 1288, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.3.11.194", "conversation_src": "10.3.11.3" }, { "account": "", "owner_ip": "10.3.11.194", "frame_number": 1300, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.3.11.194", "conversation_src": "10.3.11.3" }, { "account": "", "owner_ip": "10.3.11.194", "frame_number": 1407, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.3.11.194", "conversation_src": "10.3.11.3" }, { "account": "", "owner_ip": "10.3.11.194", "frame_number": 1439, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.3.11.194", "conversation_src": "10.3.11.3" }, { "account": "", "owner_ip": "10.3.11.194", "frame_number": 1451, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.3.11.194", "conversation_src": "10.3.11.3" }, { "account": "", "owner_ip": "10.3.11.194", "frame_number": 1978, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.3.11.3", "conversation_src": "10.3.11.194" }, { "account": "", "owner_ip": "10.3.11.194", "frame_number": 1986, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.3.11.3", "conversation_src": "10.3.11.194" }, { "account": "", "owner_ip": "10.3.11.194", "frame_number": 1988, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.3.11.194", "conversation_src": "10.3.11.3" }, { "account": "", "owner_ip": "10.3.11.194", "frame_number": 2000, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.3.11.194", "conversation_src": "10.3.11.3" } ], "evidence": [ { "tcp_stream": 55, "frame_number": 1130, "display_filter": "frame.number == 1130", "timestamp_epoch": "1583961781.185267000" }, { "tcp_stream": 56, "frame_number": 1139, "display_filter": "frame.number == 1139", "timestamp_epoch": "1583961781.200487000" }, { "tcp_stream": 56, "frame_number": 1141, "display_filter": "frame.number == 1141", "timestamp_epoch": "1583961781.201495000" }, { "tcp_stream": 57, "frame_number": 1157, "display_filter": "frame.number == 1157", "timestamp_epoch": "1583961781.226373000" }, { "tcp_stream": 59, "frame_number": 1169, "display_filter": "frame.number == 1169", "timestamp_epoch": "1583961781.230257000" }, { "tcp_stream": 60, "frame_number": 1183, "display_filter": "frame.number == 1183", "timestamp_epoch": "1583961781.242751000" }, { "tcp_stream": 60, "frame_number": 1185, "display_filter": "frame.number == 1185", "timestamp_epoch": "1583961781.243510000" }, { "tcp_stream": 62, "frame_number": 1205, "display_filter": "frame.number == 1205", "timestamp_epoch": "1583961781.250902000" }, { "tcp_stream": 66, "frame_number": 1288, "display_filter": "frame.number == 1288", "timestamp_epoch": "1583961781.470704000" }, { "tcp_stream": 67, "frame_number": 1300, "display_filter": "frame.number == 1300", "timestamp_epoch": "1583961781.471999000" }, { "tcp_stream": 72, "frame_number": 1407, "display_filter": "frame.number == 1407", "timestamp_epoch": "1583961782.253307000" }, { "tcp_stream": 74, "frame_number": 1439, "display_filter": "frame.number == 1439", "timestamp_epoch": "1583961782.406705000" }, { "tcp_stream": 75, "frame_number": 1451, "display_filter": "frame.number == 1451", "timestamp_epoch": "1583961782.408253000" }, { "tcp_stream": 96, "frame_number": 1978, "display_filter": "frame.number == 1978", "timestamp_epoch": "1583961789.925749000" }, { "tcp_stream": 97, "frame_number": 1986, "display_filter": "frame.number == 1986", "timestamp_epoch": "1583961789.927399000" }, { "tcp_stream": 97, "frame_number": 1988, "display_filter": "frame.number == 1988", "timestamp_epoch": "1583961789.928682000" }, { "tcp_stream": 98, "frame_number": 2000, "display_filter": "frame.number == 2000", "timestamp_epoch": "1583961789.931037000" } ], "raw_values": [ "LAPTOP-7XMV2SN$", "laptop-7xmv2sn$" ], "identity_id": "identity-5ee7b3c510b063752632194c", "ip_addresses": [ "10.3.11.194" ], "mac_addresses": [ "b8:ca:3a:ec:3b:8f" ] }, { "type": "account", "value": "laptop-i9zpi04$", "bindings": [ { "account": "", "owner_ip": "10.3.11.218", "frame_number": 61, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.3.11.3", "conversation_src": "10.3.11.218" }, { "account": "", "owner_ip": "10.3.11.218", "frame_number": 69, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.3.11.3", "conversation_src": "10.3.11.218" }, { "account": "", "owner_ip": "10.3.11.218", "frame_number": 71, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.3.11.218", "conversation_src": "10.3.11.3" }, { "account": "", "owner_ip": "10.3.11.218", "frame_number": 83, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.3.11.218", "conversation_src": "10.3.11.3" }, { "account": "", "owner_ip": "10.3.11.218", "frame_number": 103, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.3.11.3", "conversation_src": "10.3.11.218" }, { "account": "", "owner_ip": "10.3.11.218", "frame_number": 111, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.3.11.3", "conversation_src": "10.3.11.218" }, { "account": "", "owner_ip": "10.3.11.218", "frame_number": 113, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.3.11.218", "conversation_src": "10.3.11.3" }, { "account": "", "owner_ip": "10.3.11.218", "frame_number": 167, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.3.11.3", "conversation_src": "10.3.11.218" }, { "account": "", "owner_ip": "10.3.11.218", "frame_number": 175, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.3.11.3", "conversation_src": "10.3.11.218" }, { "account": "", "owner_ip": "10.3.11.218", "frame_number": 177, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.3.11.218", "conversation_src": "10.3.11.3" }, { "account": "", "owner_ip": "10.3.11.218", "frame_number": 189, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.3.11.218", "conversation_src": "10.3.11.3" }, { "account": "", "owner_ip": "10.3.11.218", "frame_number": 201, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.3.11.218", "conversation_src": "10.3.11.3" }, { "account": "", "owner_ip": "10.3.11.218", "frame_number": 227, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.3.11.3", "conversation_src": "10.3.11.218" }, { "account": "", "owner_ip": "10.3.11.218", "frame_number": 235, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.3.11.3", "conversation_src": "10.3.11.218" }, { "account": "", "owner_ip": "10.3.11.218", "frame_number": 237, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.3.11.218", "conversation_src": "10.3.11.3" }, { "account": "", "owner_ip": "10.3.11.218", "frame_number": 249, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.3.11.218", "conversation_src": "10.3.11.3" }, { "account": "", "owner_ip": "10.3.11.218", "frame_number": 342, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.3.11.218", "conversation_src": "10.3.11.3" }, { "account": "", "owner_ip": "10.3.11.218", "frame_number": 372, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.3.11.218", "conversation_src": "10.3.11.3" }, { "account": "", "owner_ip": "10.3.11.218", "frame_number": 384, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.3.11.218", "conversation_src": "10.3.11.3" }, { "account": "", "owner_ip": "10.3.11.218", "frame_number": 973, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.3.11.3", "conversation_src": "10.3.11.218" } ], "evidence": [ { "tcp_stream": 4, "frame_number": 61, "display_filter": "frame.number == 61", "timestamp_epoch": "1583961755.452893000" }, { "tcp_stream": 5, "frame_number": 69, "display_filter": "frame.number == 69", "timestamp_epoch": "1583961755.470258000" }, { "tcp_stream": 5, "frame_number": 71, "display_filter": "frame.number == 71", "timestamp_epoch": "1583961755.471000000" }, { "tcp_stream": 6, "frame_number": 83, "display_filter": "frame.number == 83", "timestamp_epoch": "1583961755.488695000" }, { "tcp_stream": 7, "frame_number": 103, "display_filter": "frame.number == 103", "timestamp_epoch": "1583961755.529870000" }, { "tcp_stream": 8, "frame_number": 111, "display_filter": "frame.number == 111", "timestamp_epoch": "1583961755.531579000" }, { "tcp_stream": 8, "frame_number": 113, "display_filter": "frame.number == 113", "timestamp_epoch": "1583961755.532443000" }, { "tcp_stream": 11, "frame_number": 167, "display_filter": "frame.number == 167", "timestamp_epoch": "1583961755.683879000" }, { "tcp_stream": 12, "frame_number": 175, "display_filter": "frame.number == 175", "timestamp_epoch": "1583961755.693307000" }, { "tcp_stream": 12, "frame_number": 177, "display_filter": "frame.number == 177", "timestamp_epoch": "1583961755.694410000" }, { "tcp_stream": 13, "frame_number": 189, "display_filter": "frame.number == 189", "timestamp_epoch": "1583961755.700892000" }, { "tcp_stream": 14, "frame_number": 201, "display_filter": "frame.number == 201", "timestamp_epoch": "1583961755.702258000" }, { "tcp_stream": 15, "frame_number": 227, "display_filter": "frame.number == 227", "timestamp_epoch": "1583961755.852836000" }, { "tcp_stream": 16, "frame_number": 235, "display_filter": "frame.number == 235", "timestamp_epoch": "1583961755.855356000" }, { "tcp_stream": 16, "frame_number": 237, "display_filter": "frame.number == 237", "timestamp_epoch": "1583961755.856211000" }, { "tcp_stream": 17, "frame_number": 249, "display_filter": "frame.number == 249", "timestamp_epoch": "1583961755.859063000" }, { "tcp_stream": 23, "frame_number": 342, "display_filter": "frame.number == 342", "timestamp_epoch": "1583961756.580274000" }, { "tcp_stream": 25, "frame_number": 372, "display_filter": "frame.number == 372", "timestamp_epoch": "1583961756.723910000" }, { "tcp_stream": 26, "frame_number": 384, "display_filter": "frame.number == 384", "timestamp_epoch": "1583961756.725906000" }, { "tcp_stream": 47, "frame_number": 973, "display_filter": "frame.number == 973", "timestamp_epoch": "1583961764.313051000" } ], "raw_values": [ "LAPTOP-I9ZPI04$", "laptop-i9zpi04$" ], "identity_id": "identity-9e258cfaf9cca61fd37cced4", "ip_addresses": [ "10.3.11.218" ], "mac_addresses": [ "00:1d:60:b5:5e:94" ] }, { "type": "account", "value": "laptop-sqsa42o$", "bindings": [ { "account": "", "owner_ip": "10.3.11.119", "frame_number": 2573, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.3.11.3", "conversation_src": "10.3.11.119" }, { "account": "", "owner_ip": "10.3.11.119", "frame_number": 2581, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.3.11.3", "conversation_src": "10.3.11.119" }, { "account": "", "owner_ip": "10.3.11.119", "frame_number": 2589, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.3.11.3", "conversation_src": "10.3.11.119" }, { "account": "", "owner_ip": "10.3.11.119", "frame_number": 2592, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.3.11.119", "conversation_src": "10.3.11.3" }, { "account": "", "owner_ip": "10.3.11.119", "frame_number": 2596, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.3.11.3", "conversation_src": "10.3.11.119" }, { "account": "", "owner_ip": "10.3.11.119", "frame_number": 2600, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.3.11.119", "conversation_src": "10.3.11.3" }, { "account": "", "owner_ip": "10.3.11.119", "frame_number": 2615, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.3.11.119", "conversation_src": "10.3.11.3" }, { "account": "", "owner_ip": "10.3.11.119", "frame_number": 2630, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.3.11.119", "conversation_src": "10.3.11.3" }, { "account": "", "owner_ip": "10.3.11.119", "frame_number": 2713, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.3.11.119", "conversation_src": "10.3.11.3" }, { "account": "", "owner_ip": "10.3.11.119", "frame_number": 2725, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.3.11.119", "conversation_src": "10.3.11.3" }, { "account": "", "owner_ip": "10.3.11.119", "frame_number": 2831, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.3.11.119", "conversation_src": "10.3.11.3" }, { "account": "", "owner_ip": "10.3.11.119", "frame_number": 2861, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.3.11.119", "conversation_src": "10.3.11.3" }, { "account": "", "owner_ip": "10.3.11.119", "frame_number": 2873, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.3.11.119", "conversation_src": "10.3.11.3" }, { "account": "", "owner_ip": "10.3.11.119", "frame_number": 3652, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.3.11.3", "conversation_src": "10.3.11.119" }, { "account": "", "owner_ip": "10.3.11.119", "frame_number": 3660, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.3.11.3", "conversation_src": "10.3.11.119" }, { "account": "", "owner_ip": "10.3.11.119", "frame_number": 3662, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.3.11.119", "conversation_src": "10.3.11.3" }, { "account": "", "owner_ip": "10.3.11.119", "frame_number": 3674, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.3.11.119", "conversation_src": "10.3.11.3" } ], "evidence": [ { "tcp_stream": 123, "frame_number": 2573, "display_filter": "frame.number == 2573", "timestamp_epoch": "1583961813.120143000" }, { "tcp_stream": 124, "frame_number": 2581, "display_filter": "frame.number == 2581", "timestamp_epoch": "1583961813.124106000" }, { "tcp_stream": 125, "frame_number": 2589, "display_filter": "frame.number == 2589", "timestamp_epoch": "1583961813.135703000" }, { "tcp_stream": 125, "frame_number": 2592, "display_filter": "frame.number == 2592", "timestamp_epoch": "1583961813.136719000" }, { "tcp_stream": 126, "frame_number": 2596, "display_filter": "frame.number == 2596", "timestamp_epoch": "1583961813.137385000" }, { "tcp_stream": 126, "frame_number": 2600, "display_filter": "frame.number == 2600", "timestamp_epoch": "1583961813.138260000" }, { "tcp_stream": 127, "frame_number": 2615, "display_filter": "frame.number == 2615", "timestamp_epoch": "1583961813.154456000" }, { "tcp_stream": 128, "frame_number": 2630, "display_filter": "frame.number == 2630", "timestamp_epoch": "1583961813.158443000" }, { "tcp_stream": 132, "frame_number": 2713, "display_filter": "frame.number == 2713", "timestamp_epoch": "1583961813.421776000" }, { "tcp_stream": 133, "frame_number": 2725, "display_filter": "frame.number == 2725", "timestamp_epoch": "1583961813.424596000" }, { "tcp_stream": 138, "frame_number": 2831, "display_filter": "frame.number == 2831", "timestamp_epoch": "1583961814.109917000" }, { "tcp_stream": 140, "frame_number": 2861, "display_filter": "frame.number == 2861", "timestamp_epoch": "1583961814.330193000" }, { "tcp_stream": 141, "frame_number": 2873, "display_filter": "frame.number == 2873", "timestamp_epoch": "1583961814.331599000" }, { "tcp_stream": 171, "frame_number": 3652, "display_filter": "frame.number == 3652", "timestamp_epoch": "1583961821.373720000" }, { "tcp_stream": 172, "frame_number": 3660, "display_filter": "frame.number == 3660", "timestamp_epoch": "1583961821.375280000" }, { "tcp_stream": 172, "frame_number": 3662, "display_filter": "frame.number == 3662", "timestamp_epoch": "1583961821.375852000" }, { "tcp_stream": 173, "frame_number": 3674, "display_filter": "frame.number == 3674", "timestamp_epoch": "1583961821.377829000" } ], "raw_values": [ "LAPTOP-SQSA42O$", "laptop-sqsa42o$" ], "identity_id": "identity-eb38330b518a7dcf66c4d6b9", "ip_addresses": [ "10.3.11.119" ], "mac_addresses": [ "10:98:36:59:9d:cc" ] }, { "type": "account", "value": "otis.witherspoon", "bindings": [ { "account": "", "owner_ip": "10.3.11.194", "frame_number": 2075, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.3.11.3", "conversation_src": "10.3.11.194" }, { "account": "", "owner_ip": "10.3.11.194", "frame_number": 2083, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.3.11.3", "conversation_src": "10.3.11.194" }, { "account": "", "owner_ip": "10.3.11.194", "frame_number": 2085, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.3.11.194", "conversation_src": "10.3.11.3" }, { "account": "", "owner_ip": "10.3.11.194", "frame_number": 2097, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.3.11.194", "conversation_src": "10.3.11.3" }, { "account": "", "owner_ip": "10.3.11.194", "frame_number": 2111, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.3.11.194", "conversation_src": "10.3.11.3" }, { "account": "", "owner_ip": "10.3.11.194", "frame_number": 2153, "relationship": "client-asserted", "source_field": "ntlmssp.auth.username", "conversation_dst": "10.3.11.3", "conversation_src": "10.3.11.194" }, { "account": "otis.witherspoon", "owner_ip": null, "frame_number": 2182, "relationship": "directory-subject-returned-to-client", "source_field": "samr.samr_UserInfo21.account_name", "conversation_dst": "10.3.11.194", "conversation_src": "10.3.11.3" }, { "account": "", "owner_ip": "10.3.11.194", "frame_number": 2214, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.3.11.194", "conversation_src": "10.3.11.3" }, { "account": "", "owner_ip": "10.3.11.194", "frame_number": 2226, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.3.11.194", "conversation_src": "10.3.11.3" }, { "account": "", "owner_ip": "10.3.11.194", "frame_number": 18401, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.3.11.3", "conversation_src": "10.3.11.194" }, { "account": "", "owner_ip": "10.3.11.194", "frame_number": 18409, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.3.11.3", "conversation_src": "10.3.11.194" }, { "account": "", "owner_ip": "10.3.11.194", "frame_number": 18411, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.3.11.194", "conversation_src": "10.3.11.3" }, { "account": "", "owner_ip": "10.3.11.194", "frame_number": 18423, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.3.11.194", "conversation_src": "10.3.11.3" }, { "account": "", "owner_ip": "10.3.11.194", "frame_number": 20118, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.3.11.3", "conversation_src": "10.3.11.194" }, { "account": "", "owner_ip": "10.3.11.194", "frame_number": 20126, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.3.11.3", "conversation_src": "10.3.11.194" }, { "account": "", "owner_ip": "10.3.11.194", "frame_number": 20128, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.3.11.194", "conversation_src": "10.3.11.3" }, { "account": "", "owner_ip": "10.3.11.194", "frame_number": 20140, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.3.11.194", "conversation_src": "10.3.11.3" }, { "account": "", "owner_ip": "10.3.11.194", "frame_number": 20179, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.3.11.194", "conversation_src": "10.3.11.3" }, { "account": "", "owner_ip": "10.3.11.194", "frame_number": 29535, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.3.11.194", "conversation_src": "10.3.11.3" }, { "account": "", "owner_ip": "10.3.11.194", "frame_number": 29547, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.3.11.194", "conversation_src": "10.3.11.3" } ], "evidence": [ { "tcp_stream": 100, "frame_number": 2075, "display_filter": "frame.number == 2075", "timestamp_epoch": "1583961800.718687000" }, { "tcp_stream": 101, "frame_number": 2083, "display_filter": "frame.number == 2083", "timestamp_epoch": "1583961800.726351000" }, { "tcp_stream": 101, "frame_number": 2085, "display_filter": "frame.number == 2085", "timestamp_epoch": "1583961800.727214000" }, { "tcp_stream": 102, "frame_number": 2097, "display_filter": "frame.number == 2097", "timestamp_epoch": "1583961800.737457000" }, { "tcp_stream": 103, "frame_number": 2111, "display_filter": "frame.number == 2111", "timestamp_epoch": "1583961800.964549000" }, { "tcp_stream": 104, "frame_number": 2153, "display_filter": "frame.number == 2153", "timestamp_epoch": "1583961801.006208000" }, { "tcp_stream": 104, "frame_number": 2182, "display_filter": "frame.number == 2182", "timestamp_epoch": "1583961801.022721000" }, { "tcp_stream": 107, "frame_number": 2214, "display_filter": "frame.number == 2214", "timestamp_epoch": "1583961801.142312000" }, { "tcp_stream": 108, "frame_number": 2226, "display_filter": "frame.number == 2226", "timestamp_epoch": "1583961801.143966000" }, { "tcp_stream": 431, "frame_number": 18401, "display_filter": "frame.number == 18401", "timestamp_epoch": "1583962605.424018000" }, { "tcp_stream": 432, "frame_number": 18409, "display_filter": "frame.number == 18409", "timestamp_epoch": "1583962605.432439000" }, { "tcp_stream": 432, "frame_number": 18411, "display_filter": "frame.number == 18411", "timestamp_epoch": "1583962605.433071000" }, { "tcp_stream": 433, "frame_number": 18423, "display_filter": "frame.number == 18423", "timestamp_epoch": "1583962605.437333000" }, { "tcp_stream": 453, "frame_number": 20118, "display_filter": "frame.number == 20118", "timestamp_epoch": "1583962619.258654000" }, { "tcp_stream": 454, "frame_number": 20126, "display_filter": "frame.number == 20126", "timestamp_epoch": "1583962619.260186000" }, { "tcp_stream": 454, "frame_number": 20128, "display_filter": "frame.number == 20128", "timestamp_epoch": "1583962619.260954000" }, { "tcp_stream": 455, "frame_number": 20140, "display_filter": "frame.number == 20140", "timestamp_epoch": "1583962619.263103000" }, { "tcp_stream": 457, "frame_number": 20179, "display_filter": "frame.number == 20179", "timestamp_epoch": "1583962619.289984000" }, { "tcp_stream": 640, "frame_number": 29535, "display_filter": "frame.number == 29535", "timestamp_epoch": "1583963172.283250000" }, { "tcp_stream": 641, "frame_number": 29547, "display_filter": "frame.number == 29547", "timestamp_epoch": "1583963172.284701000" } ], "raw_values": [ "otis.witherspoon" ], "identity_id": "identity-ad508868c750fbc13afc22c0", "ip_addresses": [ "10.3.11.194" ], "mac_addresses": [ "b8:ca:3a:ec:3b:8f" ] }, { "type": "account", "value": "User", "bindings": [ { "owner_ip": null, "frame_number": 8998, "relationship": "body-asserted-not-authenticated", "source_field": "referenced-profile-path", "conversation_dst": "10.3.11.194", "conversation_src": "50.87.248.17" } ], "evidence": [ { "tcp_stream": 259, "frame_number": 8998, "display_filter": "frame.number == 8998", "timestamp_epoch": "1583961876.987327000" } ], "raw_values": [ "User" ], "identity_id": "identity-2eb1dfb7f18f5a666cd37f4e", "ip_addresses": [], "mac_addresses": [] }, { "type": "domain", "value": "MONDOGREEK", "bindings": [ { "account": "", "owner_ip": "10.3.11.218", "frame_number": 1668, "relationship": "client-asserted", "source_field": "ntlmssp.auth.domain", "conversation_dst": "10.3.11.3", "conversation_src": "10.3.11.218" }, { "account": "", "owner_ip": "10.3.11.194", "frame_number": 2153, "relationship": "client-asserted", "source_field": "ntlmssp.auth.domain", "conversation_dst": "10.3.11.3", "conversation_src": "10.3.11.194" }, { "account": "", "owner_ip": "10.3.11.119", "frame_number": 3851, "relationship": "client-asserted", "source_field": "ntlmssp.auth.domain", "conversation_dst": "10.3.11.3", "conversation_src": "10.3.11.119" } ], "evidence": [ { "tcp_stream": 81, "frame_number": 1668, "display_filter": "frame.number == 1668", "timestamp_epoch": "1583961783.523575000" }, { "tcp_stream": 104, "frame_number": 2153, "display_filter": "frame.number == 2153", "timestamp_epoch": "1583961801.006208000" }, { "tcp_stream": 180, "frame_number": 3851, "display_filter": "frame.number == 3851", "timestamp_epoch": "1583961831.521451000" } ], "raw_values": [ "MONDOGREEK" ], "identity_id": "identity-52d8deb72f2c819387cf6f9a", "ip_addresses": [ "10.3.11.119", "10.3.11.194", "10.3.11.218" ], "mac_addresses": [ "00:1d:60:b5:5e:94", "10:98:36:59:9d:cc", "b8:ca:3a:ec:3b:8f" ] }, { "type": "full-name", "value": "Dominga McDowell", "bindings": [ { "account": "dominga.mcdowell", "owner_ip": "10.3.11.218", "frame_number": 1698, "relationship": "directory-name-correlated-with-client-principal", "source_field": "samr.samr_UserInfo21.full_name", "conversation_dst": "10.3.11.218", "conversation_src": "10.3.11.3" }, { "account": "dominga.mcdowell", "owner_ip": "10.3.11.218", "frame_number": 29710, "relationship": "directory-name-correlated-with-client-principal", "source_field": "samr.samr_UserInfo21.full_name", "conversation_dst": "10.3.11.218", "conversation_src": "10.3.11.3" } ], "evidence": [ { "tcp_stream": 81, "frame_number": 1698, "display_filter": "frame.number == 1698", "timestamp_epoch": "1583961783.552100000" }, { "tcp_stream": 643, "frame_number": 29710, "display_filter": "frame.number == 29710", "timestamp_epoch": "1583963188.870712000" } ], "raw_values": [ "Dominga McDowell" ], "identity_id": "identity-6df10b0c2ebc108d243ea6d6", "ip_addresses": [ "10.3.11.218" ], "mac_addresses": [] }, { "type": "full-name", "value": "Dorian Neff", "bindings": [ { "account": "dorian.neff", "owner_ip": "10.3.11.119", "frame_number": 3881, "relationship": "directory-name-correlated-with-client-principal", "source_field": "samr.samr_UserInfo21.full_name", "conversation_dst": "10.3.11.119", "conversation_src": "10.3.11.3" }, { "account": "dorian.neff", "owner_ip": "10.3.11.119", "frame_number": 29808, "relationship": "directory-name-correlated-with-client-principal", "source_field": "samr.samr_UserInfo21.full_name", "conversation_dst": "10.3.11.119", "conversation_src": "10.3.11.3" } ], "evidence": [ { "tcp_stream": 180, "frame_number": 3881, "display_filter": "frame.number == 3881", "timestamp_epoch": "1583961831.548512000" }, { "tcp_stream": 645, "frame_number": 29808, "display_filter": "frame.number == 29808", "timestamp_epoch": "1583963206.462085000" } ], "raw_values": [ "Dorian Neff" ], "identity_id": "identity-6233ae9d7c6fa285da580b71", "ip_addresses": [ "10.3.11.119" ], "mac_addresses": [] }, { "type": "full-name", "value": "Otis Witherspoon", "bindings": [ { "account": "otis.witherspoon", "owner_ip": "10.3.11.194", "frame_number": 2182, "relationship": "directory-name-correlated-with-client-principal", "source_field": "samr.samr_UserInfo21.full_name", "conversation_dst": "10.3.11.194", "conversation_src": "10.3.11.3" }, { "account": "otis.witherspoon", "owner_ip": "10.3.11.194", "frame_number": 29585, "relationship": "directory-name-correlated-with-client-principal", "source_field": "samr.samr_UserInfo21.full_name", "conversation_dst": "10.3.11.194", "conversation_src": "10.3.11.3" } ], "evidence": [ { "tcp_stream": 104, "frame_number": 2182, "display_filter": "frame.number == 2182", "timestamp_epoch": "1583961801.022721000" }, { "tcp_stream": 639, "frame_number": 29585, "display_filter": "frame.number == 29585", "timestamp_epoch": "1583963172.298498000" } ], "raw_values": [ "Otis Witherspoon" ], "identity_id": "identity-558550fabc6917bee8adf160", "ip_addresses": [ "10.3.11.194" ], "mac_addresses": [] }, { "type": "hostname", "value": "LAPTOP-7XMV2SN", "bindings": [ { "account": "", "owner_ip": "10.3.11.194", "frame_number": 1090, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.3.11.255", "conversation_src": "10.3.11.194" }, { "account": "", "owner_ip": "10.3.11.194", "frame_number": 1317, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.3.11.255", "conversation_src": "10.3.11.194" }, { "account": "", "owner_ip": "10.3.11.194", "frame_number": 1380, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.3.11.255", "conversation_src": "10.3.11.194" }, { "account": "", "owner_ip": "10.3.11.194", "frame_number": 1429, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.3.11.255", "conversation_src": "10.3.11.194" }, { "account": "", "owner_ip": "10.3.11.194", "frame_number": 1580, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.3.11.255", "conversation_src": "10.3.11.194" }, { "account": "", "owner_ip": "10.3.11.194", "frame_number": 1581, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.3.11.255", "conversation_src": "10.3.11.194" }, { "account": "", "owner_ip": "10.3.11.194", "frame_number": 1715, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.3.11.255", "conversation_src": "10.3.11.194" }, { "account": "", "owner_ip": "10.3.11.194", "frame_number": 1799, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.3.11.255", "conversation_src": "10.3.11.194" }, { "account": "", "owner_ip": "10.3.11.194", "frame_number": 1800, "relationship": "client-asserted", "source_field": "browser.server", "conversation_dst": "10.3.11.255", "conversation_src": "10.3.11.194" }, { "account": "", "owner_ip": "10.3.11.194", "frame_number": 2153, "relationship": "client-asserted", "source_field": "ntlmssp.auth.hostname", "conversation_dst": "10.3.11.3", "conversation_src": "10.3.11.194" }, { "account": "", "owner_ip": "10.3.11.194", "frame_number": 13207, "relationship": "client-asserted", "source_field": "browser.server", "conversation_dst": "10.3.11.255", "conversation_src": "10.3.11.194" }, { "account": "", "owner_ip": "10.3.11.194", "frame_number": 16314, "relationship": "client-asserted", "source_field": "browser.server", "conversation_dst": "10.3.11.255", "conversation_src": "10.3.11.194" }, { "account": "", "owner_ip": "10.3.11.194", "frame_number": 29836, "relationship": "client-asserted", "source_field": "browser.server", "conversation_dst": "10.3.11.255", "conversation_src": "10.3.11.194" }, { "account": "", "owner_ip": "10.3.11.194", "frame_number": 30099, "relationship": "client-asserted", "source_field": "browser.server", "conversation_dst": "10.3.11.255", "conversation_src": "10.3.11.194" }, { "owner_ip": "10.3.11.194", "frame_number": 20660, "relationship": "body-asserted-not-authenticated", "source_field": "explicit-body-label", "conversation_dst": "203.176.135.102", "conversation_src": "10.3.11.194" } ], "evidence": [ { "udp_stream": 38, "frame_number": 1090, "display_filter": "frame.number == 1090", "timestamp_epoch": "1583961780.759485000" }, { "udp_stream": 38, "frame_number": 1317, "display_filter": "frame.number == 1317", "timestamp_epoch": "1583961781.512484000" }, { "udp_stream": 38, "frame_number": 1380, "display_filter": "frame.number == 1380", "timestamp_epoch": "1583961782.084124000" }, { "udp_stream": 38, "frame_number": 1429, "display_filter": "frame.number == 1429", "timestamp_epoch": "1583961782.278241000" }, { "udp_stream": 38, "frame_number": 1580, "display_filter": "frame.number == 1580", "timestamp_epoch": "1583961782.825053000" }, { "udp_stream": 38, "frame_number": 1581, "display_filter": "frame.number == 1581", "timestamp_epoch": "1583961783.059501000" }, { "udp_stream": 38, "frame_number": 1715, "display_filter": "frame.number == 1715", "timestamp_epoch": "1583961783.575148000" }, { "udp_stream": 38, "frame_number": 1799, "display_filter": "frame.number == 1799", "timestamp_epoch": "1583961784.342626000" }, { "udp_stream": 58, "frame_number": 1800, "display_filter": "frame.number == 1800", "timestamp_epoch": "1583961785.150290000" }, { "tcp_stream": 104, "frame_number": 2153, "display_filter": "frame.number == 2153", "timestamp_epoch": "1583961801.006208000" }, { "udp_stream": 58, "frame_number": 13207, "display_filter": "frame.number == 13207", "timestamp_epoch": "1583962022.652482000" }, { "udp_stream": 58, "frame_number": 16314, "display_filter": "frame.number == 16314", "timestamp_epoch": "1583962500.192174000" }, { "udp_stream": 58, "frame_number": 29836, "display_filter": "frame.number == 29836", "timestamp_epoch": "1583963222.494585000" }, { "udp_stream": 58, "frame_number": 30099, "display_filter": "frame.number == 30099", "timestamp_epoch": "1583963944.745383000" }, { "tcp_stream": 459, "frame_number": 20660, "display_filter": "frame.number == 20660", "timestamp_epoch": "1583962620.007347000" } ], "raw_values": [ "LAPTOP-7XMV2SN", "LAPTOP-7XMV2SN<00>,LAPTOP-7XMV2SN<00> (Workstation/Redirector)", "LAPTOP-7XMV2SN<20>,LAPTOP-7XMV2SN<20> (Server service)" ], "identity_id": "identity-129af81cabbbc0ed2a747282", "ip_addresses": [ "10.3.11.194" ], "mac_addresses": [ "b8:ca:3a:ec:3b:8f" ] }, { "type": "hostname", "value": "LAPTOP-I9ZPI04", "bindings": [ { "account": "", "owner_ip": "10.3.11.218", "frame_number": 1, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.3.11.255", "conversation_src": "10.3.11.218" }, { "account": "", "owner_ip": "10.3.11.218", "frame_number": 220, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.3.11.255", "conversation_src": "10.3.11.218" }, { "account": "", "owner_ip": "10.3.11.218", "frame_number": 277, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.3.11.255", "conversation_src": "10.3.11.218" }, { "account": "", "owner_ip": "10.3.11.218", "frame_number": 322, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.3.11.255", "conversation_src": "10.3.11.218" }, { "account": "", "owner_ip": "10.3.11.218", "frame_number": 364, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.3.11.255", "conversation_src": "10.3.11.218" }, { "account": "", "owner_ip": "10.3.11.218", "frame_number": 519, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.3.11.255", "conversation_src": "10.3.11.218" }, { "account": "", "owner_ip": "10.3.11.218", "frame_number": 524, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.3.11.255", "conversation_src": "10.3.11.218" }, { "account": "", "owner_ip": "10.3.11.218", "frame_number": 537, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.3.11.255", "conversation_src": "10.3.11.218" }, { "account": "", "owner_ip": "10.3.11.218", "frame_number": 659, "relationship": "client-asserted", "source_field": "browser.server", "conversation_dst": "10.3.11.255", "conversation_src": "10.3.11.218" }, { "account": "", "owner_ip": "10.3.11.218", "frame_number": 1668, "relationship": "client-asserted", "source_field": "ntlmssp.auth.hostname", "conversation_dst": "10.3.11.3", "conversation_src": "10.3.11.218" }, { "account": "", "owner_ip": "10.3.11.218", "frame_number": 12443, "relationship": "client-asserted", "source_field": "browser.server", "conversation_dst": "10.3.11.255", "conversation_src": "10.3.11.218" }, { "account": "", "owner_ip": "10.3.11.218", "frame_number": 16311, "relationship": "client-asserted", "source_field": "browser.server", "conversation_dst": "10.3.11.255", "conversation_src": "10.3.11.218" }, { "account": "", "owner_ip": "10.3.11.218", "frame_number": 29742, "relationship": "client-asserted", "source_field": "browser.server", "conversation_dst": "10.3.11.255", "conversation_src": "10.3.11.218" }, { "account": "", "owner_ip": "10.3.11.218", "frame_number": 30098, "relationship": "client-asserted", "source_field": "browser.server", "conversation_dst": "10.3.11.255", "conversation_src": "10.3.11.218" } ], "evidence": [ { "udp_stream": 0, "frame_number": 1, "display_filter": "frame.number == 1", "timestamp_epoch": "1583961754.987241000" }, { "udp_stream": 0, "frame_number": 220, "display_filter": "frame.number == 220", "timestamp_epoch": "1583961755.742965000" }, { "udp_stream": 0, "frame_number": 277, "display_filter": "frame.number == 277", "timestamp_epoch": "1583961755.973947000" }, { "udp_stream": 0, "frame_number": 322, "display_filter": "frame.number == 322", "timestamp_epoch": "1583961756.493146000" }, { "udp_stream": 0, "frame_number": 364, "display_filter": "frame.number == 364", "timestamp_epoch": "1583961756.711779000" }, { "udp_stream": 0, "frame_number": 519, "display_filter": "frame.number == 519", "timestamp_epoch": "1583961757.258574000" }, { "udp_stream": 0, "frame_number": 524, "display_filter": "frame.number == 524", "timestamp_epoch": "1583961757.477321000" }, { "udp_stream": 0, "frame_number": 537, "display_filter": "frame.number == 537", "timestamp_epoch": "1583961758.227379000" }, { "udp_stream": 23, "frame_number": 659, "display_filter": "frame.number == 659", "timestamp_epoch": "1583961759.046463000" }, { "tcp_stream": 81, "frame_number": 1668, "display_filter": "frame.number == 1668", "timestamp_epoch": "1583961783.523575000" }, { "udp_stream": 23, "frame_number": 12443, "display_filter": "frame.number == 12443", "timestamp_epoch": "1583961996.538327000" }, { "udp_stream": 23, "frame_number": 16311, "display_filter": "frame.number == 16311", "timestamp_epoch": "1583962473.701867000" }, { "udp_stream": 23, "frame_number": 29742, "display_filter": "frame.number == 29742", "timestamp_epoch": "1583963193.251123000" }, { "udp_stream": 23, "frame_number": 30098, "display_filter": "frame.number == 30098", "timestamp_epoch": "1583963914.379710000" } ], "raw_values": [ "LAPTOP-I9ZPI04", "LAPTOP-I9ZPI04<00>,LAPTOP-I9ZPI04<00> (Workstation/Redirector)", "LAPTOP-I9ZPI04<20>,LAPTOP-I9ZPI04<20> (Server service)" ], "identity_id": "identity-7132027f79b2145ff6870075", "ip_addresses": [ "10.3.11.218" ], "mac_addresses": [ "00:1d:60:b5:5e:94" ] }, { "type": "hostname", "value": "LAPTOP-SQSA42O", "bindings": [ { "account": "", "owner_ip": "10.3.11.119", "frame_number": 2513, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.3.11.255", "conversation_src": "10.3.11.119" }, { "account": "", "owner_ip": "10.3.11.119", "frame_number": 2679, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.3.11.255", "conversation_src": "10.3.11.119" }, { "account": "", "owner_ip": "10.3.11.119", "frame_number": 2780, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.3.11.255", "conversation_src": "10.3.11.119" }, { "account": "", "owner_ip": "10.3.11.119", "frame_number": 2810, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.3.11.255", "conversation_src": "10.3.11.119" }, { "account": "", "owner_ip": "10.3.11.119", "frame_number": 2885, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.3.11.255", "conversation_src": "10.3.11.119" }, { "account": "", "owner_ip": "10.3.11.119", "frame_number": 3003, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.3.11.255", "conversation_src": "10.3.11.119" }, { "account": "", "owner_ip": "10.3.11.119", "frame_number": 3005, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.3.11.255", "conversation_src": "10.3.11.119" }, { "account": "", "owner_ip": "10.3.11.119", "frame_number": 3068, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.3.11.255", "conversation_src": "10.3.11.119" }, { "account": "", "owner_ip": "10.3.11.119", "frame_number": 3120, "relationship": "client-asserted", "source_field": "browser.server", "conversation_dst": "10.3.11.255", "conversation_src": "10.3.11.119" }, { "account": "", "owner_ip": "10.3.11.119", "frame_number": 3851, "relationship": "client-asserted", "source_field": "ntlmssp.auth.hostname", "conversation_dst": "10.3.11.3", "conversation_src": "10.3.11.119" }, { "account": "", "owner_ip": "10.3.11.119", "frame_number": 14079, "relationship": "client-asserted", "source_field": "browser.server", "conversation_dst": "10.3.11.255", "conversation_src": "10.3.11.119" }, { "account": "", "owner_ip": "10.3.11.119", "frame_number": 16324, "relationship": "client-asserted", "source_field": "browser.server", "conversation_dst": "10.3.11.255", "conversation_src": "10.3.11.119" }, { "account": "", "owner_ip": "10.3.11.119", "frame_number": 29839, "relationship": "client-asserted", "source_field": "browser.server", "conversation_dst": "10.3.11.255", "conversation_src": "10.3.11.119" }, { "account": "", "owner_ip": "10.3.11.119", "frame_number": 30104, "relationship": "client-asserted", "source_field": "browser.server", "conversation_dst": "10.3.11.255", "conversation_src": "10.3.11.119" } ], "evidence": [ { "udp_stream": 86, "frame_number": 2513, "display_filter": "frame.number == 2513", "timestamp_epoch": "1583961812.431480000" }, { "udp_stream": 86, "frame_number": 2679, "display_filter": "frame.number == 2679", "timestamp_epoch": "1583961813.182867000" }, { "udp_stream": 86, "frame_number": 2780, "display_filter": "frame.number == 2780", "timestamp_epoch": "1583961813.592694000" }, { "udp_stream": 86, "frame_number": 2810, "display_filter": "frame.number == 2810", "timestamp_epoch": "1583961813.932929000" }, { "udp_stream": 86, "frame_number": 2885, "display_filter": "frame.number == 2885", "timestamp_epoch": "1583961814.339155000" }, { "udp_stream": 86, "frame_number": 3003, "display_filter": "frame.number == 3003", "timestamp_epoch": "1583961814.729143000" }, { "udp_stream": 86, "frame_number": 3005, "display_filter": "frame.number == 3005", "timestamp_epoch": "1583961815.089175000" }, { "udp_stream": 86, "frame_number": 3068, "display_filter": "frame.number == 3068", "timestamp_epoch": "1583961815.855229000" }, { "udp_stream": 109, "frame_number": 3120, "display_filter": "frame.number == 3120", "timestamp_epoch": "1583961816.676656000" }, { "tcp_stream": 180, "frame_number": 3851, "display_filter": "frame.number == 3851", "timestamp_epoch": "1583961831.521451000" }, { "udp_stream": 109, "frame_number": 14079, "display_filter": "frame.number == 14079", "timestamp_epoch": "1583962054.155292000" }, { "udp_stream": 109, "frame_number": 16324, "display_filter": "frame.number == 16324", "timestamp_epoch": "1583962533.570997000" }, { "udp_stream": 109, "frame_number": 29839, "display_filter": "frame.number == 29839", "timestamp_epoch": "1583963250.959122000" }, { "udp_stream": 109, "frame_number": 30104, "display_filter": "frame.number == 30104", "timestamp_epoch": "1583963972.840860000" } ], "raw_values": [ "LAPTOP-SQSA42O", "LAPTOP-SQSA42O<00>,LAPTOP-SQSA42O<00> (Workstation/Redirector)", "LAPTOP-SQSA42O<20>,LAPTOP-SQSA42O<20> (Server service)" ], "identity_id": "identity-bea7509e5f279315c57f50dc", "ip_addresses": [ "10.3.11.119" ], "mac_addresses": [ "10:98:36:59:9d:cc" ] }, { "type": "netbios-group", "value": "MONDOGREEK", "bindings": [ { "account": "", "owner_ip": null, "frame_number": 2, "relationship": "group-membership-not-hostname", "source_field": "nbns.name", "conversation_dst": "10.3.11.255", "conversation_src": "10.3.11.218" }, { "account": "", "owner_ip": null, "frame_number": 219, "relationship": "group-membership-not-hostname", "source_field": "nbns.name", "conversation_dst": "10.3.11.255", "conversation_src": "10.3.11.218" }, { "account": "", "owner_ip": null, "frame_number": 321, "relationship": "group-membership-not-hostname", "source_field": "nbns.name", "conversation_dst": "10.3.11.255", "conversation_src": "10.3.11.218" }, { "account": "", "owner_ip": null, "frame_number": 520, "relationship": "group-membership-not-hostname", "source_field": "nbns.name", "conversation_dst": "10.3.11.255", "conversation_src": "10.3.11.218" }, { "account": "", "owner_ip": null, "frame_number": 1091, "relationship": "group-membership-not-hostname", "source_field": "nbns.name", "conversation_dst": "10.3.11.255", "conversation_src": "10.3.11.194" }, { "account": "", "owner_ip": null, "frame_number": 1318, "relationship": "group-membership-not-hostname", "source_field": "nbns.name", "conversation_dst": "10.3.11.255", "conversation_src": "10.3.11.194" }, { "account": "", "owner_ip": null, "frame_number": 1428, "relationship": "group-membership-not-hostname", "source_field": "nbns.name", "conversation_dst": "10.3.11.255", "conversation_src": "10.3.11.194" }, { "account": "", "owner_ip": null, "frame_number": 1582, "relationship": "group-membership-not-hostname", "source_field": "nbns.name", "conversation_dst": "10.3.11.255", "conversation_src": "10.3.11.194" }, { "account": "", "owner_ip": null, "frame_number": 2514, "relationship": "group-membership-not-hostname", "source_field": "nbns.name", "conversation_dst": "10.3.11.255", "conversation_src": "10.3.11.119" }, { "account": "", "owner_ip": null, "frame_number": 2680, "relationship": "group-membership-not-hostname", "source_field": "nbns.name", "conversation_dst": "10.3.11.255", "conversation_src": "10.3.11.119" }, { "account": "", "owner_ip": null, "frame_number": 2811, "relationship": "group-membership-not-hostname", "source_field": "nbns.name", "conversation_dst": "10.3.11.255", "conversation_src": "10.3.11.119" }, { "account": "", "owner_ip": null, "frame_number": 3004, "relationship": "group-membership-not-hostname", "source_field": "nbns.name", "conversation_dst": "10.3.11.255", "conversation_src": "10.3.11.119" } ], "evidence": [ { "udp_stream": 0, "frame_number": 2, "display_filter": "frame.number == 2", "timestamp_epoch": "1583961754.987734000" }, { "udp_stream": 0, "frame_number": 219, "display_filter": "frame.number == 219", "timestamp_epoch": "1583961755.742874000" }, { "udp_stream": 0, "frame_number": 321, "display_filter": "frame.number == 321", "timestamp_epoch": "1583961756.492941000" }, { "udp_stream": 0, "frame_number": 520, "display_filter": "frame.number == 520", "timestamp_epoch": "1583961757.258725000" }, { "udp_stream": 38, "frame_number": 1091, "display_filter": "frame.number == 1091", "timestamp_epoch": "1583961780.760115000" }, { "udp_stream": 38, "frame_number": 1318, "display_filter": "frame.number == 1318", "timestamp_epoch": "1583961781.512620000" }, { "udp_stream": 38, "frame_number": 1428, "display_filter": "frame.number == 1428", "timestamp_epoch": "1583961782.278124000" }, { "udp_stream": 38, "frame_number": 1582, "display_filter": "frame.number == 1582", "timestamp_epoch": "1583961783.059649000" }, { "udp_stream": 86, "frame_number": 2514, "display_filter": "frame.number == 2514", "timestamp_epoch": "1583961812.434381000" }, { "udp_stream": 86, "frame_number": 2680, "display_filter": "frame.number == 2680", "timestamp_epoch": "1583961813.198494000" }, { "udp_stream": 86, "frame_number": 2811, "display_filter": "frame.number == 2811", "timestamp_epoch": "1583961813.964143000" }, { "udp_stream": 86, "frame_number": 3004, "display_filter": "frame.number == 3004", "timestamp_epoch": "1583961814.729297000" } ], "raw_values": [ "MONDOGREEK<00>,MONDOGREEK<00> (Workstation/Redirector)" ], "identity_id": "identity-e5490adbf359114ccf1bc0d4", "ip_addresses": [], "mac_addresses": [] } ], "actor_leads": [], "observables": [ { "type": "domain", "roles": [ "dns-query" ], "value": "112.146.166.173.b.barracudacentral.org", "evidence": [ { "udp_stream": 231, "frame_number": 15114, "display_filter": "frame.number == 15114", "timestamp_epoch": "1583962330.620991000" }, { "udp_stream": 231, "frame_number": 15115, "display_filter": "frame.number == 15115", "timestamp_epoch": "1583962330.679154000" } ], "is_private": null, "observable_id": "observable-0ae370cb268a03b560abddcf", "last_seen_epoch": "1583962330.679154000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962330.620991000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "112.146.166.173.cbl.abuseat.org", "evidence": [ { "udp_stream": 230, "frame_number": 15111, "display_filter": "frame.number == 15111", "timestamp_epoch": "1583962330.571726000" }, { "udp_stream": 230, "frame_number": 15113, "display_filter": "frame.number == 15113", "timestamp_epoch": "1583962330.620313000" } ], "is_private": null, "observable_id": "observable-e9156ac12fe3d43eef54ec27", "last_seen_epoch": "1583962330.620313000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962330.571726000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "112.146.166.173.dnsbl-1.uceprotect.net", "evidence": [ { "udp_stream": 232, "frame_number": 15116, "display_filter": "frame.number == 15116", "timestamp_epoch": "1583962330.679973000" }, { "udp_stream": 232, "frame_number": 15117, "display_filter": "frame.number == 15117", "timestamp_epoch": "1583962330.724772000" } ], "is_private": null, "observable_id": "observable-c9d1d2a47f934606c8214c66", "last_seen_epoch": "1583962330.724772000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962330.679973000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "112.146.166.173.spam.dnsbl.sorbs.net", "evidence": [ { "udp_stream": 233, "frame_number": 15118, "display_filter": "frame.number == 15118", "timestamp_epoch": "1583962330.725520000" }, { "udp_stream": 233, "frame_number": 15119, "display_filter": "frame.number == 15119", "timestamp_epoch": "1583962330.755632000" } ], "is_private": null, "observable_id": "observable-f6f11aff95e520a1108fd336", "last_seen_epoch": "1583962330.755632000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962330.725520000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "112.146.166.173.zen.spamhaus.org", "evidence": [ { "udp_stream": 229, "frame_number": 15109, "display_filter": "frame.number == 15109", "timestamp_epoch": "1583962330.537921000" }, { "udp_stream": 229, "frame_number": 15110, "display_filter": "frame.number == 15110", "timestamp_epoch": "1583962330.571003000" } ], "is_private": null, "observable_id": "observable-05b72742a034fe11edc59623", "last_seen_epoch": "1583962330.571003000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962330.537921000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "1605158521.rsc.cdn77.org", "evidence": [ { "udp_stream": 387, "frame_number": 26089, "display_filter": "frame.number == 26089", "timestamp_epoch": "1583962657.131237000" } ], "is_private": null, "observable_id": "observable-76f59dc21699281723c0c5c3", "last_seen_epoch": "1583962657.131237000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962657.131237000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "3750657afd7bdc4d4398b8849268b8a3.nrb.footprintdns.com", "evidence": [ { "udp_stream": 66, "frame_number": 1876, "display_filter": "frame.number == 1876", "timestamp_epoch": "1583961789.240565000" }, { "udp_stream": 66, "frame_number": 1898, "display_filter": "frame.number == 1898", "timestamp_epoch": "1583961789.286717000" }, { "tcp_stream": 94, "frame_number": 1940, "display_filter": "frame.number == 1940", "timestamp_epoch": "1583961789.543776000" } ], "is_private": null, "observable_id": "observable-41204ee1d75e0b6e880227c2", "last_seen_epoch": "1583961789.543776000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961789.240565000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "3af21bab922f1a3fff13816e3eed341a.clo.footprintdns.com", "evidence": [ { "udp_stream": 203, "frame_number": 12622, "display_filter": "frame.number == 12622", "timestamp_epoch": "1583962015.215242000" }, { "udp_stream": 203, "frame_number": 12625, "display_filter": "frame.number == 12625", "timestamp_epoch": "1583962015.260881000" }, { "tcp_stream": 328, "frame_number": 12631, "display_filter": "frame.number == 12631", "timestamp_epoch": "1583962015.382586000" } ], "is_private": null, "observable_id": "observable-32208ce5507d21c89db7990e", "last_seen_epoch": "1583962015.382586000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962015.215242000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "7754def074cd4b67fe16c8cfdb10e874.clo.footprintdns.com", "evidence": [ { "udp_stream": 65, "frame_number": 1868, "display_filter": "frame.number == 1868", "timestamp_epoch": "1583961789.225566000" }, { "udp_stream": 65, "frame_number": 1888, "display_filter": "frame.number == 1888", "timestamp_epoch": "1583961789.266116000" }, { "tcp_stream": 93, "frame_number": 1896, "display_filter": "frame.number == 1896", "timestamp_epoch": "1583961789.281231000" } ], "is_private": null, "observable_id": "observable-0191862f5d2c7a51df93d6c9", "last_seen_epoch": "1583961789.281231000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961789.225566000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "a-ring.msedge.net", "evidence": [ { "udp_stream": 62, "frame_number": 1832, "display_filter": "frame.number == 1832", "timestamp_epoch": "1583961789.140910000" }, { "udp_stream": 62, "frame_number": 1838, "display_filter": "frame.number == 1838", "timestamp_epoch": "1583961789.154954000" }, { "tcp_stream": 90, "frame_number": 1848, "display_filter": "frame.number == 1848", "timestamp_epoch": "1583961789.173140000" } ], "is_private": null, "observable_id": "observable-604f3c7b82d84a07d610fc10", "last_seen_epoch": "1583961789.173140000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961789.140910000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "act-us.rd.linksynergy.com", "evidence": [ { "udp_stream": 330, "frame_number": 25994, "display_filter": "frame.number == 25994", "timestamp_epoch": "1583962656.928365000" }, { "udp_stream": 330, "frame_number": 26006, "display_filter": "frame.number == 26006", "timestamp_epoch": "1583962656.958202000" }, { "tcp_stream": 533, "frame_number": 26020, "display_filter": "frame.number == 26020", "timestamp_epoch": "1583962656.976931000" } ], "is_private": null, "observable_id": "observable-65e20b1da385060b3d5293ac", "last_seen_epoch": "1583962656.976931000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962656.928365000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "adhcinqls.mondogreek.com", "evidence": [ { "udp_stream": 269, "frame_number": 16218, "display_filter": "frame.number == 16218", "timestamp_epoch": "1583962439.873489000" }, { "udp_stream": 269, "frame_number": 16219, "display_filter": "frame.number == 16219", "timestamp_epoch": "1583962439.873745000" } ], "is_private": null, "observable_id": "observable-4a0f0cd02d740dbca8387a46", "last_seen_epoch": "1583962439.873745000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962439.873489000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "ads-bid.l.doubleclick.net", "evidence": [ { "udp_stream": 371, "frame_number": 25284, "display_filter": "frame.number == 25284", "timestamp_epoch": "1583962655.597976000" } ], "is_private": null, "observable_id": "observable-78901863fb1c158c12fb435a", "last_seen_epoch": "1583962655.597976000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962655.597976000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "adservice.google.com", "evidence": [ { "udp_stream": 354, "frame_number": 24221, "display_filter": "frame.number == 24221", "timestamp_epoch": "1583962653.095219000" }, { "udp_stream": 354, "frame_number": 24224, "display_filter": "frame.number == 24224", "timestamp_epoch": "1583962653.126042000" }, { "udp_stream": 354, "frame_number": 24232, "display_filter": "frame.number == 24232", "timestamp_epoch": "1583962653.141217000" }, { "tcp_stream": 504, "frame_number": 24244, "display_filter": "frame.number == 24244", "timestamp_epoch": "1583962653.171689000" } ], "is_private": null, "observable_id": "observable-585bd071d4dee9cd569191f3", "last_seen_epoch": "1583962653.171689000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962653.095219000" }, { "type": "domain", "roles": [ "dns-query", "http-host", "tls-sni" ], "value": "ajax.googleapis.com", "evidence": [ { "udp_stream": 210, "frame_number": 13387, "display_filter": "frame.number == 13387", "timestamp_epoch": "1583962027.497850000" }, { "udp_stream": 210, "frame_number": 13824, "display_filter": "frame.number == 13824", "timestamp_epoch": "1583962028.498159000" }, { "udp_stream": 210, "frame_number": 13825, "display_filter": "frame.number == 13825", "timestamp_epoch": "1583962029.498523000" }, { "udp_stream": 210, "frame_number": 13828, "display_filter": "frame.number == 13828", "timestamp_epoch": "1583962031.453069000" }, { "tcp_stream": 358, "frame_number": 13836, "display_filter": "frame.number == 13836", "timestamp_epoch": "1583962031.485239000" }, { "tcp_stream": 357, "frame_number": 13838, "display_filter": "frame.number == 13838", "timestamp_epoch": "1583962031.485558000" }, { "tcp_stream": 356, "frame_number": 13842, "display_filter": "frame.number == 13842", "timestamp_epoch": "1583962031.489355000" } ], "is_private": null, "observable_id": "observable-17eddbab547f394592b74c04", "last_seen_epoch": "1583962031.489355000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962027.497850000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "api.bing.com", "evidence": [ { "udp_stream": 199, "frame_number": 12475, "display_filter": "frame.number == 12475", "timestamp_epoch": "1583962013.754640000" }, { "udp_stream": 199, "frame_number": 12477, "display_filter": "frame.number == 12477", "timestamp_epoch": "1583962013.872494000" }, { "tcp_stream": 342, "frame_number": 13138, "display_filter": "frame.number == 13138", "timestamp_epoch": "1583962020.851264000" }, { "tcp_stream": 343, "frame_number": 13147, "display_filter": "frame.number == 13147", "timestamp_epoch": "1583962020.904625000" } ], "is_private": null, "observable_id": "observable-43e7c41d5fa5db1d10ab694e", "last_seen_epoch": "1583962020.904625000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962013.754640000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "apis.google.com", "evidence": [ { "udp_stream": 356, "frame_number": 24434, "display_filter": "frame.number == 24434", "timestamp_epoch": "1583962654.458457000" }, { "udp_stream": 356, "frame_number": 24522, "display_filter": "frame.number == 24522", "timestamp_epoch": "1583962654.490285000" }, { "udp_stream": 356, "frame_number": 24523, "display_filter": "frame.number == 24523", "timestamp_epoch": "1583962654.493084000" }, { "tcp_stream": 508, "frame_number": 24535, "display_filter": "frame.number == 24535", "timestamp_epoch": "1583962654.507148000" } ], "is_private": null, "observable_id": "observable-15f9c9217630fff58412e4d0", "last_seen_epoch": "1583962654.507148000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962654.458457000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "arc.msn.com", "evidence": [ { "udp_stream": 123, "frame_number": 4008, "display_filter": "frame.number == 4008", "timestamp_epoch": "1583961833.271472000" }, { "udp_stream": 123, "frame_number": 4009, "display_filter": "frame.number == 4009", "timestamp_epoch": "1583961833.292679000" }, { "udp_stream": 131, "frame_number": 4283, "display_filter": "frame.number == 4283", "timestamp_epoch": "1583961848.816890000" }, { "udp_stream": 131, "frame_number": 4284, "display_filter": "frame.number == 4284", "timestamp_epoch": "1583961848.817143000" }, { "tcp_stream": 188, "frame_number": 4013, "display_filter": "frame.number == 4013", "timestamp_epoch": "1583961833.340258000" }, { "tcp_stream": 198, "frame_number": 4288, "display_filter": "frame.number == 4288", "timestamp_epoch": "1583961848.891023000" } ], "is_private": null, "observable_id": "observable-544f05eadedd9cba76d91c5d", "last_seen_epoch": "1583961848.891023000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961833.271472000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "arc.msn.com.nsatc.net", "evidence": [ { "udp_stream": 123, "frame_number": 4009, "display_filter": "frame.number == 4009", "timestamp_epoch": "1583961833.292679000" }, { "udp_stream": 131, "frame_number": 4284, "display_filter": "frame.number == 4284", "timestamp_epoch": "1583961848.817143000" } ], "is_private": null, "observable_id": "observable-a0a89ac65764adc7f94bc1ac", "last_seen_epoch": "1583961848.817143000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961833.292679000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "array801.prod.do.dsp.mp.microsoft.com", "evidence": [ { "udp_stream": 25, "frame_number": 752, "display_filter": "frame.number == 752", "timestamp_epoch": "1583961759.710732000" }, { "udp_stream": 25, "frame_number": 753, "display_filter": "frame.number == 753", "timestamp_epoch": "1583961759.735456000" }, { "udp_stream": 113, "frame_number": 3230, "display_filter": "frame.number == 3230", "timestamp_epoch": "1583961817.509957000" }, { "udp_stream": 113, "frame_number": 3231, "display_filter": "frame.number == 3231", "timestamp_epoch": "1583961817.510251000" }, { "tcp_stream": 38, "frame_number": 763, "display_filter": "frame.number == 763", "timestamp_epoch": "1583961759.819059000" }, { "tcp_stream": 39, "frame_number": 792, "display_filter": "frame.number == 792", "timestamp_epoch": "1583961760.021836000" }, { "tcp_stream": 44, "frame_number": 904, "display_filter": "frame.number == 904", "timestamp_epoch": "1583961760.850310000" }, { "tcp_stream": 152, "frame_number": 3245, "display_filter": "frame.number == 3245", "timestamp_epoch": "1583961817.609710000" }, { "tcp_stream": 160, "frame_number": 3391, "display_filter": "frame.number == 3391", "timestamp_epoch": "1583961817.934203000" }, { "tcp_stream": 161, "frame_number": 3433, "display_filter": "frame.number == 3433", "timestamp_epoch": "1583961818.069474000" }, { "tcp_stream": 167, "frame_number": 3578, "display_filter": "frame.number == 3578", "timestamp_epoch": "1583961818.884505000" }, { "tcp_stream": 652, "frame_number": 29984, "display_filter": "frame.number == 29984", "timestamp_epoch": "1583963646.363909000" }, { "tcp_stream": 654, "frame_number": 30039, "display_filter": "frame.number == 30039", "timestamp_epoch": "1583963756.619519000" }, { "tcp_stream": 655, "frame_number": 30072, "display_filter": "frame.number == 30072", "timestamp_epoch": "1583963838.012937000" }, { "tcp_stream": 656, "frame_number": 30112, "display_filter": "frame.number == 30112", "timestamp_epoch": "1583964000.153219000" }, { "tcp_stream": 657, "frame_number": 30149, "display_filter": "frame.number == 30149", "timestamp_epoch": "1583964094.984345000" }, { "tcp_stream": 658, "frame_number": 30173, "display_filter": "frame.number == 30173", "timestamp_epoch": "1583964109.370351000" }, { "tcp_stream": 659, "frame_number": 30203, "display_filter": "frame.number == 30203", "timestamp_epoch": "1583964262.889030000" } ], "is_private": null, "observable_id": "observable-245b597dbb970839092a032e", "last_seen_epoch": "1583964262.889030000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961759.710732000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "array802.prod.do.dsp.mp.microsoft.com", "evidence": [ { "udp_stream": 114, "frame_number": 3299, "display_filter": "frame.number == 3299", "timestamp_epoch": "1583961817.708162000" }, { "udp_stream": 114, "frame_number": 3304, "display_filter": "frame.number == 3304", "timestamp_epoch": "1583961817.728584000" }, { "tcp_stream": 157, "frame_number": 3324, "display_filter": "frame.number == 3324", "timestamp_epoch": "1583961817.766377000" }, { "tcp_stream": 653, "frame_number": 30011, "display_filter": "frame.number == 30011", "timestamp_epoch": "1583963703.402183000" } ], "is_private": null, "observable_id": "observable-0a0e108c1217475396615e9a", "last_seen_epoch": "1583963703.402183000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961817.708162000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "array803.prod.do.dsp.mp.microsoft.com", "evidence": [ { "udp_stream": 115, "frame_number": 3503, "display_filter": "frame.number == 3503", "timestamp_epoch": "1583961818.470160000" }, { "udp_stream": 115, "frame_number": 3512, "display_filter": "frame.number == 3512", "timestamp_epoch": "1583961818.499999000" }, { "tcp_stream": 166, "frame_number": 3532, "display_filter": "frame.number == 3532", "timestamp_epoch": "1583961818.592581000" } ], "is_private": null, "observable_id": "observable-2a19bbce2fa3cf90d33d60ca", "last_seen_epoch": "1583961818.592581000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961818.470160000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "array807.prod.do.dsp.mp.microsoft.com", "evidence": [ { "udp_stream": 26, "frame_number": 862, "display_filter": "frame.number == 862", "timestamp_epoch": "1583961760.436616000" }, { "udp_stream": 26, "frame_number": 863, "display_filter": "frame.number == 863", "timestamp_epoch": "1583961760.453103000" }, { "tcp_stream": 43, "frame_number": 883, "display_filter": "frame.number == 883", "timestamp_epoch": "1583961760.712168000" }, { "tcp_stream": 649, "frame_number": 29900, "display_filter": "frame.number == 29900", "timestamp_epoch": "1583963577.962639000" } ], "is_private": null, "observable_id": "observable-1d67d6de284f0bdbade853f6", "last_seen_epoch": "1583963577.962639000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961760.436616000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "assets.adobedtm.com", "evidence": [ { "udp_stream": 328, "frame_number": 21274, "display_filter": "frame.number == 21274", "timestamp_epoch": "1583962650.898819000" }, { "udp_stream": 328, "frame_number": 21288, "display_filter": "frame.number == 21288", "timestamp_epoch": "1583962650.943602000" }, { "tcp_stream": 473, "frame_number": 21340, "display_filter": "frame.number == 21340", "timestamp_epoch": "1583962650.990680000" } ], "is_private": null, "observable_id": "observable-b58abbea21a98641535af6c9", "last_seen_epoch": "1583962650.990680000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962650.898819000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "az725175.vo.msecnd.net", "evidence": [ { "udp_stream": 204, "frame_number": 12659, "display_filter": "frame.number == 12659", "timestamp_epoch": "1583962015.493983000" }, { "udp_stream": 204, "frame_number": 12660, "display_filter": "frame.number == 12660", "timestamp_epoch": "1583962015.538643000" }, { "tcp_stream": 333, "frame_number": 12731, "display_filter": "frame.number == 12731", "timestamp_epoch": "1583962015.559942000" }, { "tcp_stream": 332, "frame_number": 12733, "display_filter": "frame.number == 12733", "timestamp_epoch": "1583962015.561629000" } ], "is_private": null, "observable_id": "observable-5d3e59cc7011ccb30047b5b9", "last_seen_epoch": "1583962015.561629000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962015.493983000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "b-ring.msedge.net", "evidence": [ { "udp_stream": 77, "frame_number": 2334, "display_filter": "frame.number == 2334", "timestamp_epoch": "1583961806.477891000" }, { "udp_stream": 77, "frame_number": 2336, "display_filter": "frame.number == 2336", "timestamp_epoch": "1583961806.493595000" }, { "tcp_stream": 115, "frame_number": 2371, "display_filter": "frame.number == 2371", "timestamp_epoch": "1583961806.629972000" } ], "is_private": null, "observable_id": "observable-66fcfd3b0edf7b64db4f5e0b", "last_seen_epoch": "1583961806.629972000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961806.477891000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "bid.g.doubleclick.net", "evidence": [ { "udp_stream": 371, "frame_number": 25262, "display_filter": "frame.number == 25262", "timestamp_epoch": "1583962655.531120000" }, { "udp_stream": 371, "frame_number": 25277, "display_filter": "frame.number == 25277", "timestamp_epoch": "1583962655.563393000" }, { "udp_stream": 371, "frame_number": 25284, "display_filter": "frame.number == 25284", "timestamp_epoch": "1583962655.597976000" } ], "is_private": null, "observable_id": "observable-27951bda77b95e7ec6e47c33", "last_seen_epoch": "1583962655.597976000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962655.531120000" }, { "type": "domain", "roles": [ "dns-query", "http-host" ], "value": "bolton-tech.com", "evidence": [ { "udp_stream": 179, "frame_number": 8611, "display_filter": "frame.number == 8611", "timestamp_epoch": "1583961876.384749000" }, { "udp_stream": 179, "frame_number": 8612, "display_filter": "frame.number == 8612", "timestamp_epoch": "1583961876.430841000" }, { "tcp_stream": 259, "frame_number": 8616, "display_filter": "frame.number == 8616", "timestamp_epoch": "1583961876.516400000" } ], "is_private": null, "observable_id": "observable-4cda9a6c6ae54c3360daafe8", "last_seen_epoch": "1583961876.516400000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961876.384749000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "c.storage.googleapis.com", "evidence": [ { "udp_stream": 208, "frame_number": 13334, "display_filter": "frame.number == 13334", "timestamp_epoch": "1583962027.473726000" } ], "is_private": null, "observable_id": "observable-da0310415f379e8f0dc82c7e", "last_seen_epoch": "1583962027.473726000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962027.473726000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "c1.neweggimages.com", "evidence": [ { "udp_stream": 330, "frame_number": 21282, "display_filter": "frame.number == 21282", "timestamp_epoch": "1583962650.899589000" }, { "udp_stream": 330, "frame_number": 21289, "display_filter": "frame.number == 21289", "timestamp_epoch": "1583962650.943689000" }, { "tcp_stream": 472, "frame_number": 21304, "display_filter": "frame.number == 21304", "timestamp_epoch": "1583962650.966874000" }, { "tcp_stream": 476, "frame_number": 21347, "display_filter": "frame.number == 21347", "timestamp_epoch": "1583962650.991222000" }, { "tcp_stream": 475, "frame_number": 21352, "display_filter": "frame.number == 21352", "timestamp_epoch": "1583962650.991571000" }, { "tcp_stream": 474, "frame_number": 21355, "display_filter": "frame.number == 21355", "timestamp_epoch": "1583962650.991880000" }, { "tcp_stream": 479, "frame_number": 21357, "display_filter": "frame.number == 21357", "timestamp_epoch": "1583962650.992120000" }, { "tcp_stream": 478, "frame_number": 21359, "display_filter": "frame.number == 21359", "timestamp_epoch": "1583962650.992366000" }, { "tcp_stream": 477, "frame_number": 21361, "display_filter": "frame.number == 21361", "timestamp_epoch": "1583962650.992708000" } ], "is_private": null, "observable_id": "observable-7113586740877f7bdc0118df", "last_seen_epoch": "1583962650.992708000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962650.899589000" }, { "type": "domain", "roles": [ "dns-query", "http-host" ], "value": "checkip.amazonaws.com", "evidence": [ { "udp_stream": 228, "frame_number": 14966, "display_filter": "frame.number == 14966", "timestamp_epoch": "1583962320.148514000" }, { "udp_stream": 228, "frame_number": 14974, "display_filter": "frame.number == 14974", "timestamp_epoch": "1583962320.197469000" }, { "tcp_stream": 389, "frame_number": 14981, "display_filter": "frame.number == 14981", "timestamp_epoch": "1583962320.240229000" } ], "is_private": null, "observable_id": "observable-f0382da974f4947210d0bfda", "last_seen_epoch": "1583962320.240229000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962320.148514000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "client.wns.windows.com", "evidence": [ { "udp_stream": 196, "frame_number": 12354, "display_filter": "frame.number == 12354", "timestamp_epoch": "1583961994.562581000" }, { "udp_stream": 196, "frame_number": 12357, "display_filter": "frame.number == 12357", "timestamp_epoch": "1583961994.711946000" }, { "udp_stream": 211, "frame_number": 14080, "display_filter": "frame.number == 14080", "timestamp_epoch": "1583962054.455424000" }, { "udp_stream": 211, "frame_number": 14081, "display_filter": "frame.number == 14081", "timestamp_epoch": "1583962054.581731000" }, { "udp_stream": 224, "frame_number": 14738, "display_filter": "frame.number == 14738", "timestamp_epoch": "1583962291.158736000" }, { "udp_stream": 224, "frame_number": 14739, "display_filter": "frame.number == 14739", "timestamp_epoch": "1583962291.199928000" }, { "udp_stream": 224, "frame_number": 14741, "display_filter": "frame.number == 14741", "timestamp_epoch": "1583962291.242182000" }, { "udp_stream": 226, "frame_number": 14913, "display_filter": "frame.number == 14913", "timestamp_epoch": "1583962319.845278000" }, { "udp_stream": 226, "frame_number": 14921, "display_filter": "frame.number == 14921", "timestamp_epoch": "1583962319.963750000" }, { "udp_stream": 235, "frame_number": 15134, "display_filter": "frame.number == 15134", "timestamp_epoch": "1583962351.651049000" }, { "udp_stream": 235, "frame_number": 15135, "display_filter": "frame.number == 15135", "timestamp_epoch": "1583962351.681707000" }, { "udp_stream": 235, "frame_number": 15136, "display_filter": "frame.number == 15136", "timestamp_epoch": "1583962351.740704000" }, { "udp_stream": 238, "frame_number": 15375, "display_filter": "frame.number == 15375", "timestamp_epoch": "1583962380.291791000" }, { "udp_stream": 238, "frame_number": 15376, "display_filter": "frame.number == 15376", "timestamp_epoch": "1583962380.292101000" }, { "udp_stream": 254, "frame_number": 15743, "display_filter": "frame.number == 15743", "timestamp_epoch": "1583962387.466379000" }, { "udp_stream": 254, "frame_number": 15744, "display_filter": "frame.number == 15744", "timestamp_epoch": "1583962387.466826000" }, { "udp_stream": 262, "frame_number": 16109, "display_filter": "frame.number == 16109", "timestamp_epoch": "1583962433.733151000" }, { "udp_stream": 262, "frame_number": 16110, "display_filter": "frame.number == 16110", "timestamp_epoch": "1583962433.763569000" }, { "udp_stream": 262, "frame_number": 16114, "display_filter": "frame.number == 16114", "timestamp_epoch": "1583962434.184347000" }, { "udp_stream": 290, "frame_number": 16380, "display_filter": "frame.number == 16380", "timestamp_epoch": "1583962545.186625000" } ], "is_private": null, "observable_id": "observable-f8b1236ba7d07fae4345bdd8", "last_seen_epoch": "1583962545.791547000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961994.562581000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "cm.everesttech.net", "evidence": [ { "udp_stream": 350, "frame_number": 23846, "display_filter": "frame.number == 23846", "timestamp_epoch": "1583962652.619274000" }, { "udp_stream": 350, "frame_number": 23889, "display_filter": "frame.number == 23889", "timestamp_epoch": "1583962652.649600000" }, { "udp_stream": 350, "frame_number": 23890, "display_filter": "frame.number == 23890", "timestamp_epoch": "1583962652.656673000" }, { "tcp_stream": 497, "frame_number": 24019, "display_filter": "frame.number == 24019", "timestamp_epoch": "1583962652.735242000" } ], "is_private": null, "observable_id": "observable-2544d55789420327e442a050", "last_seen_epoch": "1583962652.735242000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962652.619274000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "cm.everesttech.net.akadns.net", "evidence": [ { "udp_stream": 350, "frame_number": 23890, "display_filter": "frame.number == 23890", "timestamp_epoch": "1583962652.656673000" } ], "is_private": null, "observable_id": "observable-25d92732f145f581a9ce651a", "last_seen_epoch": "1583962652.656673000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962652.656673000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "cm.g.doubleclick.net", "evidence": [ { "udp_stream": 392, "frame_number": 26061, "display_filter": "frame.number == 26061", "timestamp_epoch": "1583962657.105888000" }, { "udp_stream": 392, "frame_number": 26090, "display_filter": "frame.number == 26090", "timestamp_epoch": "1583962657.131301000" }, { "tcp_stream": 539, "frame_number": 26103, "display_filter": "frame.number == 26103", "timestamp_epoch": "1583962657.150270000" } ], "is_private": null, "observable_id": "observable-f9a97b240d38b14d02f7925c", "last_seen_epoch": "1583962657.150270000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962657.105888000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "combsscreenprinting.com", "evidence": [ { "udp_stream": 148, "frame_number": 4916, "display_filter": "frame.number == 4916", "timestamp_epoch": "1583961856.009855000" } ], "is_private": null, "observable_id": "observable-c23ee5a2dfccf76f561af69d", "last_seen_epoch": "1583961856.009855000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961856.009855000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "config.edge.skype.com", "evidence": [ { "udp_stream": 137, "frame_number": 4339, "display_filter": "frame.number == 4339", "timestamp_epoch": "1583961854.499941000" }, { "udp_stream": 137, "frame_number": 4342, "display_filter": "frame.number == 4342", "timestamp_epoch": "1583961854.516637000" }, { "udp_stream": 406, "frame_number": 26794, "display_filter": "frame.number == 26794", "timestamp_epoch": "1583962685.572318000" }, { "udp_stream": 406, "frame_number": 26795, "display_filter": "frame.number == 26795", "timestamp_epoch": "1583962685.586418000" }, { "udp_stream": 407, "frame_number": 27313, "display_filter": "frame.number == 27313", "timestamp_epoch": "1583962732.810115000" }, { "udp_stream": 407, "frame_number": 27314, "display_filter": "frame.number == 27314", "timestamp_epoch": "1583962732.810552000" }, { "tcp_stream": 199, "frame_number": 4346, "display_filter": "frame.number == 4346", "timestamp_epoch": "1583961854.558232000" }, { "tcp_stream": 559, "frame_number": 26799, "display_filter": "frame.number == 26799", "timestamp_epoch": "1583962685.627144000" }, { "tcp_stream": 560, "frame_number": 26833, "display_filter": "frame.number == 26833", "timestamp_epoch": "1583962685.853264000" }, { "tcp_stream": 561, "frame_number": 26853, "display_filter": "frame.number == 26853", "timestamp_epoch": "1583962685.883420000" }, { "tcp_stream": 562, "frame_number": 26855, "display_filter": "frame.number == 26855", "timestamp_epoch": "1583962685.883687000" }, { "tcp_stream": 563, "frame_number": 26857, "display_filter": "frame.number == 26857", "timestamp_epoch": "1583962685.883957000" }, { "tcp_stream": 565, "frame_number": 27318, "display_filter": "frame.number == 27318", "timestamp_epoch": "1583962732.931229000" }, { "tcp_stream": 566, "frame_number": 27331, "display_filter": "frame.number == 27331", "timestamp_epoch": "1583962732.970807000" } ], "is_private": null, "observable_id": "observable-b34e47e49b9d4dca6459389b", "last_seen_epoch": "1583962732.970807000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961854.499941000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "connect.facebook.net", "evidence": [ { "udp_stream": 155, "frame_number": 5939, "display_filter": "frame.number == 5939", "timestamp_epoch": "1583961856.894261000" }, { "udp_stream": 155, "frame_number": 5989, "display_filter": "frame.number == 5989", "timestamp_epoch": "1583961856.974342000" }, { "udp_stream": 310, "frame_number": 21116, "display_filter": "frame.number == 21116", "timestamp_epoch": "1583962650.284728000" }, { "udp_stream": 310, "frame_number": 21125, "display_filter": "frame.number == 21125", "timestamp_epoch": "1583962650.316511000" }, { "udp_stream": 310, "frame_number": 21130, "display_filter": "frame.number == 21130", "timestamp_epoch": "1583962650.341046000" }, { "tcp_stream": 233, "frame_number": 6063, "display_filter": "frame.number == 6063", "timestamp_epoch": "1583961857.209451000" }, { "tcp_stream": 236, "frame_number": 6070, "display_filter": "frame.number == 6070", "timestamp_epoch": "1583961857.209880000" }, { "tcp_stream": 242, "frame_number": 6969, "display_filter": "frame.number == 6969", "timestamp_epoch": "1583961857.606073000" }, { "tcp_stream": 513, "frame_number": 25255, "display_filter": "frame.number == 25255", "timestamp_epoch": "1583962655.507108000" } ], "is_private": null, "observable_id": "observable-097426c7715099a8e7103cf4", "last_seen_epoch": "1583962655.507108000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961856.894261000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "consent.dc-storm.com", "evidence": [ { "udp_stream": 381, "frame_number": 25544, "display_filter": "frame.number == 25544", "timestamp_epoch": "1583962655.937905000" }, { "udp_stream": 381, "frame_number": 25557, "display_filter": "frame.number == 25557", "timestamp_epoch": "1583962655.958527000" }, { "tcp_stream": 525, "frame_number": 25599, "display_filter": "frame.number == 25599", "timestamp_epoch": "1583962655.996983000" } ], "is_private": null, "observable_id": "observable-76152bf96069bc445aac9ffe", "last_seen_epoch": "1583962655.996983000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962655.937905000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "consent.jrs5.com", "evidence": [ { "udp_stream": 380, "frame_number": 25512, "display_filter": "frame.number == 25512", "timestamp_epoch": "1583962655.896748000" }, { "udp_stream": 380, "frame_number": 25526, "display_filter": "frame.number == 25526", "timestamp_epoch": "1583962655.921391000" }, { "udp_stream": 380, "frame_number": 25541, "display_filter": "frame.number == 25541", "timestamp_epoch": "1583962655.936519000" }, { "tcp_stream": 520, "frame_number": 25722, "display_filter": "frame.number == 25722", "timestamp_epoch": "1583962656.143522000" } ], "is_private": null, "observable_id": "observable-036bcf14e458ef91ddbd8a0b", "last_seen_epoch": "1583962656.143522000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962655.896748000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "consent.linksynergy.com", "evidence": [ { "udp_stream": 377, "frame_number": 25509, "display_filter": "frame.number == 25509", "timestamp_epoch": "1583962655.895821000" }, { "udp_stream": 377, "frame_number": 25529, "display_filter": "frame.number == 25529", "timestamp_epoch": "1583962655.921656000" }, { "udp_stream": 377, "frame_number": 25648, "display_filter": "frame.number == 25648", "timestamp_epoch": "1583962656.140330000" }, { "tcp_stream": 527, "frame_number": 25739, "display_filter": "frame.number == 25739", "timestamp_epoch": "1583962656.160004000" }, { "tcp_stream": 528, "frame_number": 25752, "display_filter": "frame.number == 25752", "timestamp_epoch": "1583962656.163391000" } ], "is_private": null, "observable_id": "observable-7d2ae74abd75181862da750c", "last_seen_epoch": "1583962656.163391000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962655.895821000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "consent.mediaforge.com", "evidence": [ { "udp_stream": 379, "frame_number": 25511, "display_filter": "frame.number == 25511", "timestamp_epoch": "1583962655.896684000" }, { "udp_stream": 379, "frame_number": 25527, "display_filter": "frame.number == 25527", "timestamp_epoch": "1583962655.921483000" }, { "udp_stream": 379, "frame_number": 25542, "display_filter": "frame.number == 25542", "timestamp_epoch": "1583962655.936624000" }, { "tcp_stream": 524, "frame_number": 25559, "display_filter": "frame.number == 25559", "timestamp_epoch": "1583962655.959394000" } ], "is_private": null, "observable_id": "observable-80b2ac8a6e80132067fb44d4", "last_seen_epoch": "1583962655.959394000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962655.896684000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "consent.nxtck.com", "evidence": [ { "udp_stream": 378, "frame_number": 25510, "display_filter": "frame.number == 25510", "timestamp_epoch": "1583962655.895972000" }, { "udp_stream": 378, "frame_number": 25528, "display_filter": "frame.number == 25528", "timestamp_epoch": "1583962655.921556000" }, { "udp_stream": 378, "frame_number": 25540, "display_filter": "frame.number == 25540", "timestamp_epoch": "1583962655.936451000" }, { "tcp_stream": 523, "frame_number": 25718, "display_filter": "frame.number == 25718", "timestamp_epoch": "1583962656.142900000" } ], "is_private": null, "observable_id": "observable-0e61e6d1985d312211428cd4", "last_seen_epoch": "1583962656.142900000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962655.895972000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "cookie-sync-service-prod.steelhousemedia.com", "evidence": [ { "udp_stream": 402, "frame_number": 26574, "display_filter": "frame.number == 26574", "timestamp_epoch": "1583962661.807697000" }, { "udp_stream": 402, "frame_number": 26575, "display_filter": "frame.number == 26575", "timestamp_epoch": "1583962661.827699000" }, { "udp_stream": 402, "frame_number": 26577, "display_filter": "frame.number == 26577", "timestamp_epoch": "1583962661.873966000" }, { "tcp_stream": 553, "frame_number": 26581, "display_filter": "frame.number == 26581", "timestamp_epoch": "1583962661.942793000" } ], "is_private": null, "observable_id": "observable-a66273e03527b18aa0d9cf08", "last_seen_epoch": "1583962661.942793000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962661.807697000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "cookie.coreprod.west2.steelhouse.com", "evidence": [ { "udp_stream": 402, "frame_number": 26577, "display_filter": "frame.number == 26577", "timestamp_epoch": "1583962661.873966000" } ], "is_private": null, "observable_id": "observable-f4cd96e137b9d8a9477bf743", "last_seen_epoch": "1583962661.873966000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962661.873966000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "cp801.prod.do.dsp.mp.microsoft.com", "evidence": [ { "udp_stream": 22, "frame_number": 654, "display_filter": "frame.number == 654", "timestamp_epoch": "1583961758.998718000" }, { "udp_stream": 22, "frame_number": 657, "display_filter": "frame.number == 657", "timestamp_epoch": "1583961759.040026000" }, { "udp_stream": 111, "frame_number": 3162, "display_filter": "frame.number == 3162", "timestamp_epoch": "1583961817.237735000" }, { "udp_stream": 111, "frame_number": 3163, "display_filter": "frame.number == 3163", "timestamp_epoch": "1583961817.238134000" }, { "tcp_stream": 33, "frame_number": 662, "display_filter": "frame.number == 662", "timestamp_epoch": "1583961759.168742000" }, { "tcp_stream": 34, "frame_number": 687, "display_filter": "frame.number == 687", "timestamp_epoch": "1583961759.341157000" }, { "tcp_stream": 37, "frame_number": 728, "display_filter": "frame.number == 728", "timestamp_epoch": "1583961759.638476000" }, { "tcp_stream": 41, "frame_number": 794, "display_filter": "frame.number == 794", "timestamp_epoch": "1583961760.022112000" }, { "tcp_stream": 149, "frame_number": 3169, "display_filter": "frame.number == 3169", "timestamp_epoch": "1583961817.254324000" }, { "tcp_stream": 151, "frame_number": 3196, "display_filter": "frame.number == 3196", "timestamp_epoch": "1583961817.414873000" }, { "tcp_stream": 154, "frame_number": 3249, "display_filter": "frame.number == 3249", "timestamp_epoch": "1583961817.610179000" }, { "tcp_stream": 156, "frame_number": 3311, "display_filter": "frame.number == 3311", "timestamp_epoch": "1583961817.732630000" }, { "tcp_stream": 159, "frame_number": 3378, "display_filter": "frame.number == 3378", "timestamp_epoch": "1583961817.868436000" }, { "tcp_stream": 163, "frame_number": 3455, "display_filter": "frame.number == 3455", "timestamp_epoch": "1583961818.252446000" }, { "tcp_stream": 165, "frame_number": 3522, "display_filter": "frame.number == 3522", "timestamp_epoch": "1583961818.522859000" } ], "is_private": null, "observable_id": "observable-06b4160fe8f02466535caf5e", "last_seen_epoch": "1583961818.522859000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961758.998718000" }, { "type": "domain", "roles": [ "dns-query", "http-host" ], "value": "crl.securetrust.com", "evidence": [ { "udp_stream": 342, "frame_number": 21822, "display_filter": "frame.number == 21822", "timestamp_epoch": "1583962651.315788000" }, { "udp_stream": 342, "frame_number": 21890, "display_filter": "frame.number == 21890", "timestamp_epoch": "1583962651.357204000" }, { "udp_stream": 342, "frame_number": 21898, "display_filter": "frame.number == 21898", "timestamp_epoch": "1583962651.368700000" }, { "tcp_stream": 491, "frame_number": 21909, "display_filter": "frame.number == 21909", "timestamp_epoch": "1583962651.430770000" } ], "is_private": null, "observable_id": "observable-d0add20799ca79c7bb7aeda7", "last_seen_epoch": "1583962651.430770000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962651.315788000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "cs2005.wpc.alphacdn.net", "evidence": [ { "udp_stream": 332, "frame_number": 21318, "display_filter": "frame.number == 21318", "timestamp_epoch": "1583962650.986719000" } ], "is_private": null, "observable_id": "observable-943dc40f2a94a7d25cf5e991", "last_seen_epoch": "1583962650.986719000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962650.986719000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "cs22.wpc.v0cdn.net", "evidence": [ { "udp_stream": 204, "frame_number": 12660, "display_filter": "frame.number == 12660", "timestamp_epoch": "1583962015.538643000" } ], "is_private": null, "observable_id": "observable-2ea6a0128f9f1f1e08a8ce77", "last_seen_epoch": "1583962015.538643000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962015.538643000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "cs9.wac.phicdn.net", "evidence": [ { "udp_stream": 193, "frame_number": 10496, "display_filter": "frame.number == 10496", "timestamp_epoch": "1583961955.805772000" } ], "is_private": null, "observable_id": "observable-b387642262723218d7f6c8fb", "last_seen_epoch": "1583961955.805772000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961955.805772000" }, { "type": "domain", "roles": [ "dns-query", "http-host" ], "value": "ctldl.windowsupdate.com", "evidence": [ { "udp_stream": 189, "frame_number": 10324, "display_filter": "frame.number == 10324", "timestamp_epoch": "1583961934.167029000" }, { "udp_stream": 189, "frame_number": 10325, "display_filter": "frame.number == 10325", "timestamp_epoch": "1583961934.209558000" }, { "udp_stream": 408, "frame_number": 27386, "display_filter": "frame.number == 27386", "timestamp_epoch": "1583962744.495077000" }, { "udp_stream": 408, "frame_number": 27387, "display_filter": "frame.number == 27387", "timestamp_epoch": "1583962744.515705000" }, { "tcp_stream": 268, "frame_number": 10329, "display_filter": "frame.number == 10329", "timestamp_epoch": "1583961934.226577000" }, { "tcp_stream": 268, "frame_number": 10332, "display_filter": "frame.number == 10332", "timestamp_epoch": "1583961934.251616000" }, { "tcp_stream": 567, "frame_number": 27391, "display_filter": "frame.number == 27391", "timestamp_epoch": "1583962744.531400000" }, { "tcp_stream": 567, "frame_number": 27394, "display_filter": "frame.number == 27394", "timestamp_epoch": "1583962744.555361000" } ], "is_private": null, "observable_id": "observable-a5716e3c4855000d423c0b10", "last_seen_epoch": "1583962744.555361000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961934.167029000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "disc801.prod.do.dsp.mp.microsoft.com", "evidence": [ { "udp_stream": 24, "frame_number": 679, "display_filter": "frame.number == 679", "timestamp_epoch": "1583961759.292702000" }, { "udp_stream": 24, "frame_number": 683, "display_filter": "frame.number == 683", "timestamp_epoch": "1583961759.326791000" }, { "udp_stream": 112, "frame_number": 3186, "display_filter": "frame.number == 3186", "timestamp_epoch": "1583961817.390295000" }, { "udp_stream": 112, "frame_number": 3187, "display_filter": "frame.number == 3187", "timestamp_epoch": "1583961817.390606000" }, { "tcp_stream": 35, "frame_number": 697, "display_filter": "frame.number == 697", "timestamp_epoch": "1583961759.392332000" }, { "tcp_stream": 36, "frame_number": 730, "display_filter": "frame.number == 730", "timestamp_epoch": "1583961759.638656000" }, { "tcp_stream": 40, "frame_number": 799, "display_filter": "frame.number == 799", "timestamp_epoch": "1583961760.022422000" }, { "tcp_stream": 42, "frame_number": 868, "display_filter": "frame.number == 868", "timestamp_epoch": "1583961760.475144000" }, { "tcp_stream": 150, "frame_number": 3197, "display_filter": "frame.number == 3197", "timestamp_epoch": "1583961817.414916000" }, { "tcp_stream": 153, "frame_number": 3247, "display_filter": "frame.number == 3247", "timestamp_epoch": "1583961817.610058000" }, { "tcp_stream": 155, "frame_number": 3306, "display_filter": "frame.number == 3306", "timestamp_epoch": "1583961817.729255000" }, { "tcp_stream": 158, "frame_number": 3371, "display_filter": "frame.number == 3371", "timestamp_epoch": "1583961817.853953000" }, { "tcp_stream": 162, "frame_number": 3457, "display_filter": "frame.number == 3457", "timestamp_epoch": "1583961818.252809000" }, { "tcp_stream": 164, "frame_number": 3509, "display_filter": "frame.number == 3509", "timestamp_epoch": "1583961818.471038000" }, { "tcp_stream": 168, "frame_number": 3576, "display_filter": "frame.number == 3576", "timestamp_epoch": "1583961818.884193000" } ], "is_private": null, "observable_id": "observable-971b077dcad87d68e277ce9c", "last_seen_epoch": "1583961818.884193000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961759.292702000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "dns.msftncsi.com", "evidence": [ { "udp_stream": 36, "frame_number": 1079, "display_filter": "frame.number == 1079", "timestamp_epoch": "1583961779.925743000" }, { "udp_stream": 36, "frame_number": 1080, "display_filter": "frame.number == 1080", "timestamp_epoch": "1583961779.950820000" }, { "udp_stream": 84, "frame_number": 2497, "display_filter": "frame.number == 2497", "timestamp_epoch": "1583961811.168733000" }, { "udp_stream": 84, "frame_number": 2498, "display_filter": "frame.number == 2498", "timestamp_epoch": "1583961811.185698000" }, { "udp_stream": 220, "frame_number": 14614, "display_filter": "frame.number == 14614", "timestamp_epoch": "1583962215.914197000" }, { "udp_stream": 220, "frame_number": 14615, "display_filter": "frame.number == 14615", "timestamp_epoch": "1583962215.989692000" }, { "udp_stream": 223, "frame_number": 14724, "display_filter": "frame.number == 14724", "timestamp_epoch": "1583962275.915845000" }, { "udp_stream": 223, "frame_number": 14725, "display_filter": "frame.number == 14725", "timestamp_epoch": "1583962275.929534000" } ], "is_private": null, "observable_id": "observable-50a552d0927c85adb0bd6caa", "last_seen_epoch": "1583962275.929534000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961779.925743000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "dp58aslhmbcib.cloudfront.net", "evidence": [ { "udp_stream": 152, "frame_number": 5033, "display_filter": "frame.number == 5033", "timestamp_epoch": "1583961856.143539000" }, { "udp_stream": 152, "frame_number": 5064, "display_filter": "frame.number == 5064", "timestamp_epoch": "1583961856.184965000" }, { "tcp_stream": 229, "frame_number": 5234, "display_filter": "frame.number == 5234", "timestamp_epoch": "1583961856.361784000" }, { "tcp_stream": 228, "frame_number": 5236, "display_filter": "frame.number == 5236", "timestamp_epoch": "1583961856.362025000" }, { "tcp_stream": 227, "frame_number": 5238, "display_filter": "frame.number == 5238", "timestamp_epoch": "1583961856.362599000" }, { "tcp_stream": 226, "frame_number": 5240, "display_filter": "frame.number == 5240", "timestamp_epoch": "1583961856.362849000" }, { "tcp_stream": 225, "frame_number": 5242, "display_filter": "frame.number == 5242", "timestamp_epoch": "1583961856.363062000" } ], "is_private": null, "observable_id": "observable-868b982523a66112cca36b0b", "last_seen_epoch": "1583961856.363062000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961856.143539000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "dpm.demdex.net", "evidence": [ { "udp_stream": 343, "frame_number": 21903, "display_filter": "frame.number == 21903", "timestamp_epoch": "1583962651.419370000" }, { "udp_stream": 343, "frame_number": 21913, "display_filter": "frame.number == 21913", "timestamp_epoch": "1583962651.451829000" }, { "udp_stream": 343, "frame_number": 21915, "display_filter": "frame.number == 21915", "timestamp_epoch": "1583962651.475025000" }, { "tcp_stream": 492, "frame_number": 22169, "display_filter": "frame.number == 22169", "timestamp_epoch": "1583962651.577149000" } ], "is_private": null, "observable_id": "observable-5fb817e280a1925ed15c1d17", "last_seen_epoch": "1583962651.577149000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962651.419370000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "dsum-sec.casalemedia.com", "evidence": [ { "udp_stream": 393, "frame_number": 26085, "display_filter": "frame.number == 26085", "timestamp_epoch": "1583962657.127019000" }, { "udp_stream": 393, "frame_number": 26109, "display_filter": "frame.number == 26109", "timestamp_epoch": "1583962657.157861000" }, { "udp_stream": 393, "frame_number": 26147, "display_filter": "frame.number == 26147", "timestamp_epoch": "1583962657.208179000" }, { "tcp_stream": 543, "frame_number": 26187, "display_filter": "frame.number == 26187", "timestamp_epoch": "1583962657.268445000" } ], "is_private": null, "observable_id": "observable-d03ab386fad7cbafb5fbf028", "last_seen_epoch": "1583962657.268445000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962657.127019000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "dualstack.com.imgix.map.fastly.net", "evidence": [ { "udp_stream": 159, "frame_number": 6020, "display_filter": "frame.number == 6020", "timestamp_epoch": "1583961857.068008000" } ], "is_private": null, "observable_id": "observable-384e3809ea37cafc57b8af9e", "last_seen_epoch": "1583961857.068008000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961857.068008000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "dx.steelhousemedia.com", "evidence": [ { "udp_stream": 366, "frame_number": 25216, "display_filter": "frame.number == 25216", "timestamp_epoch": "1583962655.433700000" }, { "udp_stream": 366, "frame_number": 25225, "display_filter": "frame.number == 25225", "timestamp_epoch": "1583962655.464475000" }, { "udp_stream": 366, "frame_number": 25242, "display_filter": "frame.number == 25242", "timestamp_epoch": "1583962655.496520000" }, { "tcp_stream": 517, "frame_number": 25270, "display_filter": "frame.number == 25270", "timestamp_epoch": "1583962655.536065000" } ], "is_private": null, "observable_id": "observable-a6a385ab23ca13e828a5ed07", "last_seen_epoch": "1583962655.536065000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962655.433700000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "ec-apis.newegg.com", "evidence": [ { "udp_stream": 339, "frame_number": 21387, "display_filter": "frame.number == 21387", "timestamp_epoch": "1583962651.094883000" }, { "udp_stream": 339, "frame_number": 21402, "display_filter": "frame.number == 21402", "timestamp_epoch": "1583962651.125734000" }, { "udp_stream": 339, "frame_number": 21566, "display_filter": "frame.number == 21566", "timestamp_epoch": "1583962651.194645000" }, { "tcp_stream": 489, "frame_number": 21684, "display_filter": "frame.number == 21684", "timestamp_epoch": "1583962651.226524000" } ], "is_private": null, "observable_id": "observable-fbbbca3371089da6171e98db", "last_seen_epoch": "1583962651.226524000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962651.094883000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "edge.microsoft.com", "evidence": [ { "udp_stream": 186, "frame_number": 10206, "display_filter": "frame.number == 10206", "timestamp_epoch": "1583961911.711934000" }, { "udp_stream": 186, "frame_number": 10212, "display_filter": "frame.number == 10212", "timestamp_epoch": "1583961911.739107000" }, { "udp_stream": 349, "frame_number": 23844, "display_filter": "frame.number == 23844", "timestamp_epoch": "1583962652.593652000" }, { "udp_stream": 349, "frame_number": 23849, "display_filter": "frame.number == 23849", "timestamp_epoch": "1583962652.620832000" }, { "tcp_stream": 267, "frame_number": 10216, "display_filter": "frame.number == 10216", "timestamp_epoch": "1583961911.827180000" }, { "tcp_stream": 496, "frame_number": 23959, "display_filter": "frame.number == 23959", "timestamp_epoch": "1583962652.682957000" } ], "is_private": null, "observable_id": "observable-b8156b9826eb0e7ac59cfeb4", "last_seen_epoch": "1583962652.682957000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961911.711934000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "eu-u.openx.net", "evidence": [ { "udp_stream": 388, "frame_number": 26057, "display_filter": "frame.number == 26057", "timestamp_epoch": "1583962657.102978000" }, { "udp_stream": 388, "frame_number": 26094, "display_filter": "frame.number == 26094", "timestamp_epoch": "1583962657.134765000" }, { "udp_stream": 388, "frame_number": 26097, "display_filter": "frame.number == 26097", "timestamp_epoch": "1583962657.136998000" }, { "tcp_stream": 540, "frame_number": 26107, "display_filter": "frame.number == 26107", "timestamp_epoch": "1583962657.152339000" } ], "is_private": null, "observable_id": "observable-a9f3b5dee051b894dcb70668", "last_seen_epoch": "1583962657.152339000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962657.102978000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "f.monetate.net", "evidence": [ { "udp_stream": 345, "frame_number": 23645, "display_filter": "frame.number == 23645", "timestamp_epoch": "1583962652.091134000" }, { "udp_stream": 345, "frame_number": 23651, "display_filter": "frame.number == 23651", "timestamp_epoch": "1583962652.122192000" }, { "udp_stream": 345, "frame_number": 23659, "display_filter": "frame.number == 23659", "timestamp_epoch": "1583962652.155462000" }, { "tcp_stream": 501, "frame_number": 24150, "display_filter": "frame.number == 24150", "timestamp_epoch": "1583962652.979663000" }, { "tcp_stream": 507, "frame_number": 24610, "display_filter": "frame.number == 24610", "timestamp_epoch": "1583962654.547506000" }, { "tcp_stream": 506, "frame_number": 24612, "display_filter": "frame.number == 24612", "timestamp_epoch": "1583962654.547981000" }, { "tcp_stream": 505, "frame_number": 24614, "display_filter": "frame.number == 24614", "timestamp_epoch": "1583962654.548269000" } ], "is_private": null, "observable_id": "observable-11bfdbf09a08e9ab40200fd4", "last_seen_epoch": "1583962654.548269000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962652.091134000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "fareharbor.com", "evidence": [ { "udp_stream": 145, "frame_number": 4537, "display_filter": "frame.number == 4537", "timestamp_epoch": "1583961854.904733000" }, { "udp_stream": 145, "frame_number": 4543, "display_filter": "frame.number == 4543", "timestamp_epoch": "1583961854.926971000" }, { "udp_stream": 281, "frame_number": 16283, "display_filter": "frame.number == 16283", "timestamp_epoch": "1583962457.841813000" }, { "udp_stream": 281, "frame_number": 16284, "display_filter": "frame.number == 16284", "timestamp_epoch": "1583962457.871573000" }, { "udp_stream": 311, "frame_number": 21117, "display_filter": "frame.number == 21117", "timestamp_epoch": "1583962650.284771000" }, { "udp_stream": 311, "frame_number": 21126, "display_filter": "frame.number == 21126", "timestamp_epoch": "1583962650.316555000" }, { "udp_stream": 311, "frame_number": 21128, "display_filter": "frame.number == 21128", "timestamp_epoch": "1583962650.340100000" }, { "tcp_stream": 217, "frame_number": 4563, "display_filter": "frame.number == 4563", "timestamp_epoch": "1583961854.999425000" }, { "tcp_stream": 413, "frame_number": 16288, "display_filter": "frame.number == 16288", "timestamp_epoch": "1583962457.989600000" } ], "is_private": null, "observable_id": "observable-fdb5485f3b86bcc9a06dec97", "last_seen_epoch": "1583962650.340100000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961854.904733000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "fe2cr.update.microsoft.com", "evidence": [ { "udp_stream": 236, "frame_number": 15202, "display_filter": "frame.number == 15202", "timestamp_epoch": "1583962359.615054000" }, { "udp_stream": 236, "frame_number": 15203, "display_filter": "frame.number == 15203", "timestamp_epoch": "1583962359.646100000" }, { "udp_stream": 236, "frame_number": 15204, "display_filter": "frame.number == 15204", "timestamp_epoch": "1583962359.660989000" }, { "udp_stream": 245, "frame_number": 15600, "display_filter": "frame.number == 15600", "timestamp_epoch": "1583962385.972164000" }, { "udp_stream": 245, "frame_number": 15601, "display_filter": "frame.number == 15601", "timestamp_epoch": "1583962385.972448000" }, { "udp_stream": 256, "frame_number": 15922, "display_filter": "frame.number == 15922", "timestamp_epoch": "1583962416.974187000" }, { "udp_stream": 256, "frame_number": 15923, "display_filter": "frame.number == 15923", "timestamp_epoch": "1583962416.974560000" }, { "tcp_stream": 393, "frame_number": 15208, "display_filter": "frame.number == 15208", "timestamp_epoch": "1583962359.799458000" }, { "tcp_stream": 403, "frame_number": 15605, "display_filter": "frame.number == 15605", "timestamp_epoch": "1583962386.178664000" }, { "tcp_stream": 409, "frame_number": 15927, "display_filter": "frame.number == 15927", "timestamp_epoch": "1583962417.015109000" } ], "is_private": null, "observable_id": "observable-36821d46676685b73ef96232", "last_seen_epoch": "1583962417.015109000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962359.615054000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "fe2cr.update.microsoft.com.akadns.net", "evidence": [ { "udp_stream": 236, "frame_number": 15204, "display_filter": "frame.number == 15204", "timestamp_epoch": "1583962359.660989000" }, { "udp_stream": 245, "frame_number": 15601, "display_filter": "frame.number == 15601", "timestamp_epoch": "1583962385.972448000" }, { "udp_stream": 256, "frame_number": 15923, "display_filter": "frame.number == 15923", "timestamp_epoch": "1583962416.974560000" } ], "is_private": null, "observable_id": "observable-e2b873d086441fb6d3dfeb98", "last_seen_epoch": "1583962416.974560000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962359.660989000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "fe3cr.delivery.mp.microsoft.com", "evidence": [ { "udp_stream": 237, "frame_number": 15313, "display_filter": "frame.number == 15313", "timestamp_epoch": "1583962360.827395000" }, { "udp_stream": 237, "frame_number": 15314, "display_filter": "frame.number == 15314", "timestamp_epoch": "1583962360.848294000" }, { "udp_stream": 237, "frame_number": 15315, "display_filter": "frame.number == 15315", "timestamp_epoch": "1583962360.863226000" }, { "udp_stream": 252, "frame_number": 15725, "display_filter": "frame.number == 15725", "timestamp_epoch": "1583962387.327521000" }, { "udp_stream": 252, "frame_number": 15726, "display_filter": "frame.number == 15726", "timestamp_epoch": "1583962387.327849000" }, { "udp_stream": 257, "frame_number": 16027, "display_filter": "frame.number == 16027", "timestamp_epoch": "1583962418.343766000" }, { "udp_stream": 257, "frame_number": 16028, "display_filter": "frame.number == 16028", "timestamp_epoch": "1583962418.344091000" }, { "tcp_stream": 394, "frame_number": 15319, "display_filter": "frame.number == 15319", "timestamp_epoch": "1583962361.123697000" }, { "tcp_stream": 406, "frame_number": 15769, "display_filter": "frame.number == 15769", "timestamp_epoch": "1583962387.595655000" }, { "tcp_stream": 410, "frame_number": 16032, "display_filter": "frame.number == 16032", "timestamp_epoch": "1583962418.609032000" } ], "is_private": null, "observable_id": "observable-f350c583e37d4c9be78d65d4", "last_seen_epoch": "1583962418.609032000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962360.827395000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "fh-kit.com", "evidence": [ { "udp_stream": 143, "frame_number": 4415, "display_filter": "frame.number == 4415", "timestamp_epoch": "1583961854.795171000" }, { "udp_stream": 143, "frame_number": 4438, "display_filter": "frame.number == 4438", "timestamp_epoch": "1583961854.840055000" }, { "udp_stream": 314, "frame_number": 21131, "display_filter": "frame.number == 21131", "timestamp_epoch": "1583962650.341897000" }, { "udp_stream": 314, "frame_number": 21137, "display_filter": "frame.number == 21137", "timestamp_epoch": "1583962650.372744000" }, { "udp_stream": 314, "frame_number": 21145, "display_filter": "frame.number == 21145", "timestamp_epoch": "1583962650.385341000" }, { "tcp_stream": 213, "frame_number": 4483, "display_filter": "frame.number == 4483", "timestamp_epoch": "1583961854.852181000" } ], "is_private": null, "observable_id": "observable-b93bff5eb8f2a9044b5d0371", "last_seen_epoch": "1583962650.385341000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961854.795171000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "fh-sites.imgix.net", "evidence": [ { "udp_stream": 159, "frame_number": 6006, "display_filter": "frame.number == 6006", "timestamp_epoch": "1583961857.017781000" }, { "udp_stream": 159, "frame_number": 6020, "display_filter": "frame.number == 6020", "timestamp_epoch": "1583961857.068008000" }, { "tcp_stream": 234, "frame_number": 6072, "display_filter": "frame.number == 6072", "timestamp_epoch": "1583961857.210102000" } ], "is_private": null, "observable_id": "observable-746486615a0c4b39cc3c774f", "last_seen_epoch": "1583961857.210102000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961857.017781000" }, { "type": "domain", "roles": [ "dns-query", "http-host" ], "value": "files.markerly.com", "evidence": [ { "udp_stream": 208, "frame_number": 13332, "display_filter": "frame.number == 13332", "timestamp_epoch": "1583962027.442392000" }, { "udp_stream": 208, "frame_number": 13334, "display_filter": "frame.number == 13334", "timestamp_epoch": "1583962027.473726000" }, { "tcp_stream": 351, "frame_number": 13377, "display_filter": "frame.number == 13377", "timestamp_epoch": "1583962027.490893000" }, { "tcp_stream": 351, "frame_number": 13902, "display_filter": "frame.number == 13902", "timestamp_epoch": "1583962031.571744000" }, { "tcp_stream": 351, "frame_number": 13984, "display_filter": "frame.number == 13984", "timestamp_epoch": "1583962031.744315000" } ], "is_private": null, "observable_id": "observable-0b31f0b17fe65eae874a44b4", "last_seen_epoch": "1583962031.744315000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962027.442392000" }, { "type": "domain", "roles": [ "dns-query", "http-host", "tls-sni" ], "value": "fonts.googleapis.com", "evidence": [ { "udp_stream": 138, "frame_number": 4385, "display_filter": "frame.number == 4385", "timestamp_epoch": "1583961854.731137000" }, { "udp_stream": 138, "frame_number": 4390, "display_filter": "frame.number == 4390", "timestamp_epoch": "1583961854.757736000" }, { "udp_stream": 315, "frame_number": 21132, "display_filter": "frame.number == 21132", "timestamp_epoch": "1583962650.343191000" }, { "udp_stream": 315, "frame_number": 21138, "display_filter": "frame.number == 21138", "timestamp_epoch": "1583962650.373590000" }, { "udp_stream": 315, "frame_number": 21139, "display_filter": "frame.number == 21139", "timestamp_epoch": "1583962650.374617000" }, { "tcp_stream": 205, "frame_number": 4433, "display_filter": "frame.number == 4433", "timestamp_epoch": "1583961854.835217000" }, { "tcp_stream": 206, "frame_number": 4439, "display_filter": "frame.number == 4439", "timestamp_epoch": "1583961854.840436000" }, { "tcp_stream": 202, "frame_number": 4402, "display_filter": "frame.number == 4402", "timestamp_epoch": "1583961854.778012000" } ], "is_private": null, "observable_id": "observable-a4a3a1f54b8c3b40fc765aaa", "last_seen_epoch": "1583962650.374617000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961854.731137000" }, { "type": "domain", "roles": [ "dns-query", "http-host", "tls-sni" ], "value": "fonts.gstatic.com", "evidence": [ { "udp_stream": 139, "frame_number": 4386, "display_filter": "frame.number == 4386", "timestamp_epoch": "1583961854.731803000" }, { "udp_stream": 139, "frame_number": 4391, "display_filter": "frame.number == 4391", "timestamp_epoch": "1583961854.757824000" }, { "udp_stream": 316, "frame_number": 21136, "display_filter": "frame.number == 21136", "timestamp_epoch": "1583962650.352180000" }, { "udp_stream": 316, "frame_number": 21141, "display_filter": "frame.number == 21141", "timestamp_epoch": "1583962650.382634000" }, { "udp_stream": 316, "frame_number": 21142, "display_filter": "frame.number == 21142", "timestamp_epoch": "1583962650.383619000" }, { "tcp_stream": 215, "frame_number": 4917, "display_filter": "frame.number == 4917", "timestamp_epoch": "1583961856.047515000" }, { "tcp_stream": 220, "frame_number": 4956, "display_filter": "frame.number == 4956", "timestamp_epoch": "1583961856.075659000" }, { "tcp_stream": 222, "frame_number": 4958, "display_filter": "frame.number == 4958", "timestamp_epoch": "1583961856.075895000" }, { "tcp_stream": 215, "frame_number": 5062, "display_filter": "frame.number == 5062", "timestamp_epoch": "1583961856.177877000" }, { "tcp_stream": 222, "frame_number": 5065, "display_filter": "frame.number == 5065", "timestamp_epoch": "1583961856.201369000" }, { "tcp_stream": 220, "frame_number": 5066, "display_filter": "frame.number == 5066", "timestamp_epoch": "1583961856.201519000" }, { "tcp_stream": 224, "frame_number": 5071, "display_filter": "frame.number == 5071", "timestamp_epoch": "1583961856.209888000" }, { "tcp_stream": 203, "frame_number": 4406, "display_filter": "frame.number == 4406", "timestamp_epoch": "1583961854.782581000" }, { "tcp_stream": 481, "frame_number": 21370, "display_filter": "frame.number == 21370", "timestamp_epoch": "1583962651.019579000" }, { "tcp_stream": 493, "frame_number": 23124, "display_filter": "frame.number == 23124", "timestamp_epoch": "1583962651.740172000" }, { "tcp_stream": 494, "frame_number": 23172, "display_filter": "frame.number == 23172", "timestamp_epoch": "1583962651.760798000" } ], "is_private": null, "observable_id": "observable-3ce1aed19b8676ac4483f0bb", "last_seen_epoch": "1583962651.760798000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961854.731803000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "fp-afd.azureedge.net", "evidence": [ { "udp_stream": 64, "frame_number": 1862, "display_filter": "frame.number == 1862", "timestamp_epoch": "1583961789.198151000" }, { "udp_stream": 64, "frame_number": 1867, "display_filter": "frame.number == 1867", "timestamp_epoch": "1583961789.224967000" }, { "tcp_stream": 92, "frame_number": 1892, "display_filter": "frame.number == 1892", "timestamp_epoch": "1583961789.278144000" } ], "is_private": null, "observable_id": "observable-23a9781200a3890a101cffbd", "last_seen_epoch": "1583961789.278144000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961789.198151000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "fp-as.azureedge.net", "evidence": [ { "udp_stream": 61, "frame_number": 1819, "display_filter": "frame.number == 1819", "timestamp_epoch": "1583961789.054029000" }, { "udp_stream": 61, "frame_number": 1820, "display_filter": "frame.number == 1820", "timestamp_epoch": "1583961789.088257000" }, { "tcp_stream": 89, "frame_number": 1830, "display_filter": "frame.number == 1830", "timestamp_epoch": "1583961789.129686000" } ], "is_private": null, "observable_id": "observable-0f688f7f7e8ff4eb423f405c", "last_seen_epoch": "1583961789.129686000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961789.054029000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "fp-vp.azureedge.net", "evidence": [ { "udp_stream": 126, "frame_number": 4045, "display_filter": "frame.number == 4045", "timestamp_epoch": "1583961837.160541000" }, { "udp_stream": 126, "frame_number": 4063, "display_filter": "frame.number == 4063", "timestamp_epoch": "1583961837.210365000" }, { "tcp_stream": 192, "frame_number": 4084, "display_filter": "frame.number == 4084", "timestamp_epoch": "1583961837.246764000" } ], "is_private": null, "observable_id": "observable-72aea44564d9fc3480a43963", "last_seen_epoch": "1583961837.246764000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961837.160541000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "fp.msedge.net", "evidence": [ { "udp_stream": 198, "frame_number": 12451, "display_filter": "frame.number == 12451", "timestamp_epoch": "1583962012.911857000" }, { "udp_stream": 198, "frame_number": 12452, "display_filter": "frame.number == 12452", "timestamp_epoch": "1583962012.938150000" }, { "tcp_stream": 322, "frame_number": 12456, "display_filter": "frame.number == 12456", "timestamp_epoch": "1583962013.030078000" } ], "is_private": null, "observable_id": "observable-0e8573cd0b6b47b4aece50cf", "last_seen_epoch": "1583962013.030078000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962012.911857000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "geo.prod.do.dsp.mp.microsoft.com", "evidence": [ { "udp_stream": 15, "frame_number": 525, "display_filter": "frame.number == 525", "timestamp_epoch": "1583961757.819997000" }, { "udp_stream": 15, "frame_number": 526, "display_filter": "frame.number == 526", "timestamp_epoch": "1583961757.840619000" }, { "udp_stream": 102, "frame_number": 3006, "display_filter": "frame.number == 3006", "timestamp_epoch": "1583961815.246867000" }, { "udp_stream": 102, "frame_number": 3007, "display_filter": "frame.number == 3007", "timestamp_epoch": "1583961815.247099000" }, { "tcp_stream": 27, "frame_number": 530, "display_filter": "frame.number == 530", "timestamp_epoch": "1583961757.985150000" }, { "tcp_stream": 142, "frame_number": 3011, "display_filter": "frame.number == 3011", "timestamp_epoch": "1583961815.375939000" } ], "is_private": null, "observable_id": "observable-92abde5cd08edeadc2f99562", "last_seen_epoch": "1583961815.375939000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961757.819997000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "go.microsoft.com", "evidence": [ { "udp_stream": 201, "frame_number": 12479, "display_filter": "frame.number == 12479", "timestamp_epoch": "1583962013.966655000" }, { "udp_stream": 201, "frame_number": 12480, "display_filter": "frame.number == 12480", "timestamp_epoch": "1583962014.002923000" }, { "tcp_stream": 323, "frame_number": 12487, "display_filter": "frame.number == 12487", "timestamp_epoch": "1583962014.158514000" }, { "tcp_stream": 324, "frame_number": 12489, "display_filter": "frame.number == 12489", "timestamp_epoch": "1583962014.158741000" } ], "is_private": null, "observable_id": "observable-522ef96dc30c20264516468e", "last_seen_epoch": "1583962014.158741000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962013.966655000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "googleads.g.doubleclick.net", "evidence": [ { "udp_stream": 372, "frame_number": 25263, "display_filter": "frame.number == 25263", "timestamp_epoch": "1583962655.532578000" }, { "udp_stream": 372, "frame_number": 25278, "display_filter": "frame.number == 25278", "timestamp_epoch": "1583962655.564369000" }, { "udp_stream": 372, "frame_number": 25283, "display_filter": "frame.number == 25283", "timestamp_epoch": "1583962655.597916000" } ], "is_private": null, "observable_id": "observable-5dc3e8eb2540b970c0b4760e", "last_seen_epoch": "1583962655.597916000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962655.532578000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "gstaticadssl.l.google.com", "evidence": [ { "udp_stream": 139, "frame_number": 4391, "display_filter": "frame.number == 4391", "timestamp_epoch": "1583961854.757824000" }, { "udp_stream": 316, "frame_number": 21142, "display_filter": "frame.number == 21142", "timestamp_epoch": "1583962650.383619000" } ], "is_private": null, "observable_id": "observable-cce8ddf852f7735cde2f67b7", "last_seen_epoch": "1583962650.383619000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961854.757824000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "hakunamatatata.com", "evidence": [ { "udp_stream": 412, "frame_number": 27773, "display_filter": "frame.number == 27773", "timestamp_epoch": "1583963020.371821000" }, { "udp_stream": 412, "frame_number": 27774, "display_filter": "frame.number == 27774", "timestamp_epoch": "1583963020.402252000" }, { "udp_stream": 412, "frame_number": 27775, "display_filter": "frame.number == 27775", "timestamp_epoch": "1583963020.430853000" }, { "tcp_stream": 589, "frame_number": 27780, "display_filter": "frame.number == 27780", "timestamp_epoch": "1583963020.547148000" } ], "is_private": null, "observable_id": "observable-f7617f8cef59730032c2c46c", "last_seen_epoch": "1583963020.547148000", "enrichment_state": "not_requested", "first_seen_epoch": "1583963020.371821000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "help.newegg.com", "evidence": [ { "udp_stream": 337, "frame_number": 21366, "display_filter": "frame.number == 21366", "timestamp_epoch": "1583962651.002847000" }, { "udp_stream": 337, "frame_number": 21374, "display_filter": "frame.number == 21374", "timestamp_epoch": "1583962651.035144000" }, { "udp_stream": 337, "frame_number": 21385, "display_filter": "frame.number == 21385", "timestamp_epoch": "1583962651.092134000" }, { "tcp_stream": 485, "frame_number": 21487, "display_filter": "frame.number == 21487", "timestamp_epoch": "1583962651.135893000" } ], "is_private": null, "observable_id": "observable-1fd8e066886a6c8af4164897", "last_seen_epoch": "1583962651.135893000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962651.002847000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "helpforyourservice.com", "evidence": [ { "udp_stream": 413, "frame_number": 28319, "display_filter": "frame.number == 28319", "timestamp_epoch": "1583963031.180089000" }, { "udp_stream": 413, "frame_number": 28320, "display_filter": "frame.number == 28320", "timestamp_epoch": "1583963031.199448000" }, { "udp_stream": 413, "frame_number": 28321, "display_filter": "frame.number == 28321", "timestamp_epoch": "1583963031.223332000" }, { "tcp_stream": 592, "frame_number": 28325, "display_filter": "frame.number == 28325", "timestamp_epoch": "1583963031.337903000" }, { "tcp_stream": 593, "frame_number": 28568, "display_filter": "frame.number == 28568", "timestamp_epoch": "1583963032.456885000" }, { "tcp_stream": 595, "frame_number": 28593, "display_filter": "frame.number == 28593", "timestamp_epoch": "1583963038.380480000" }, { "tcp_stream": 598, "frame_number": 28731, "display_filter": "frame.number == 28731", "timestamp_epoch": "1583963044.340672000" }, { "tcp_stream": 599, "frame_number": 28754, "display_filter": "frame.number == 28754", "timestamp_epoch": "1583963050.026088000" }, { "tcp_stream": 603, "frame_number": 28800, "display_filter": "frame.number == 28800", "timestamp_epoch": "1583963055.686781000" }, { "tcp_stream": 605, "frame_number": 28824, "display_filter": "frame.number == 28824", "timestamp_epoch": "1583963061.330535000" }, { "tcp_stream": 607, "frame_number": 28851, "display_filter": "frame.number == 28851", "timestamp_epoch": "1583963066.986810000" }, { "tcp_stream": 608, "frame_number": 28874, "display_filter": "frame.number == 28874", "timestamp_epoch": "1583963072.718134000" }, { "tcp_stream": 610, "frame_number": 29109, "display_filter": "frame.number == 29109", "timestamp_epoch": "1583963076.561312000" }, { "tcp_stream": 612, "frame_number": 29140, "display_filter": "frame.number == 29140", "timestamp_epoch": "1583963082.191127000" }, { "tcp_stream": 613, "frame_number": 29157, "display_filter": "frame.number == 29157", "timestamp_epoch": "1583963082.833470000" }, { "tcp_stream": 615, "frame_number": 29188, "display_filter": "frame.number == 29188", "timestamp_epoch": "1583963088.543433000" }, { "tcp_stream": 619, "frame_number": 29237, "display_filter": "frame.number == 29237", "timestamp_epoch": "1583963094.199022000" }, { "tcp_stream": 620, "frame_number": 29254, "display_filter": "frame.number == 29254", "timestamp_epoch": "1583963099.794939000" }, { "tcp_stream": 623, "frame_number": 29297, "display_filter": "frame.number == 29297", "timestamp_epoch": "1583963105.686170000" }, { "tcp_stream": 625, "frame_number": 29330, "display_filter": "frame.number == 29330", "timestamp_epoch": "1583963111.295175000" } ], "is_private": null, "observable_id": "observable-7c3a374c518e1e8f1ce8988c", "last_seen_epoch": "1583963123.115052000", "enrichment_state": "not_requested", "first_seen_epoch": "1583963031.180089000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "idsync.rlcdn.com", "evidence": [ { "udp_stream": 383, "frame_number": 25904, "display_filter": "frame.number == 25904", "timestamp_epoch": "1583962656.769038000" }, { "udp_stream": 383, "frame_number": 25912, "display_filter": "frame.number == 25912", "timestamp_epoch": "1583962656.790277000" }, { "tcp_stream": 531, "frame_number": 25920, "display_filter": "frame.number == 25920", "timestamp_epoch": "1583962656.815217000" } ], "is_private": null, "observable_id": "observable-fadb7cd5af8afbb4e006250c", "last_seen_epoch": "1583962656.815217000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962656.769038000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "ie11welcome.microsoft.com", "evidence": [ { "udp_stream": 202, "frame_number": 12512, "display_filter": "frame.number == 12512", "timestamp_epoch": "1583962014.281442000" }, { "udp_stream": 202, "frame_number": 12513, "display_filter": "frame.number == 12513", "timestamp_epoch": "1583962014.306944000" }, { "tcp_stream": 326, "frame_number": 12520, "display_filter": "frame.number == 12520", "timestamp_epoch": "1583962014.639751000" }, { "tcp_stream": 325, "frame_number": 12521, "display_filter": "frame.number == 12521", "timestamp_epoch": "1583962014.639796000" }, { "tcp_stream": 327, "frame_number": 12582, "display_filter": "frame.number == 12582", "timestamp_epoch": "1583962015.029351000" }, { "tcp_stream": 329, "frame_number": 12708, "display_filter": "frame.number == 12708", "timestamp_epoch": "1583962015.557342000" }, { "tcp_stream": 330, "frame_number": 12717, "display_filter": "frame.number == 12717", "timestamp_epoch": "1583962015.557795000" }, { "tcp_stream": 331, "frame_number": 12721, "display_filter": "frame.number == 12721", "timestamp_epoch": "1583962015.558204000" } ], "is_private": null, "observable_id": "observable-1da897a56e11180802e489f3", "last_seen_epoch": "1583962015.558204000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962014.281442000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "image2.pubmatic.com", "evidence": [ { "udp_stream": 397, "frame_number": 26221, "display_filter": "frame.number == 26221", "timestamp_epoch": "1583962657.352782000" }, { "udp_stream": 397, "frame_number": 26254, "display_filter": "frame.number == 26254", "timestamp_epoch": "1583962657.367426000" }, { "tcp_stream": 547, "frame_number": 26337, "display_filter": "frame.number == 26337", "timestamp_epoch": "1583962657.544729000" } ], "is_private": null, "observable_id": "observable-64d001a8850bdc20ade414e4", "last_seen_epoch": "1583962657.544729000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962657.352782000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "images10.newegg.com", "evidence": [ { "udp_stream": 331, "frame_number": 21294, "display_filter": "frame.number == 21294", "timestamp_epoch": "1583962650.958089000" }, { "udp_stream": 331, "frame_number": 21321, "display_filter": "frame.number == 21321", "timestamp_epoch": "1583962650.988589000" }, { "udp_stream": 331, "frame_number": 21376, "display_filter": "frame.number == 21376", "timestamp_epoch": "1583962651.053207000" }, { "tcp_stream": 483, "frame_number": 21489, "display_filter": "frame.number == 21489", "timestamp_epoch": "1583962651.136224000" } ], "is_private": null, "observable_id": "observable-428a354cf08f0afe2889c67e", "last_seen_epoch": "1583962651.136224000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962650.958089000" }, { "type": "domain", "roles": [ "dns-query", "http-host", "tls-sni" ], "value": "img.secureserver.net", "evidence": [ { "udp_stream": 168, "frame_number": 7612, "display_filter": "frame.number == 7612", "timestamp_epoch": "1583961859.201037000" }, { "udp_stream": 168, "frame_number": 7613, "display_filter": "frame.number == 7613", "timestamp_epoch": "1583961859.233927000" }, { "tcp_stream": 247, "frame_number": 7633, "display_filter": "frame.number == 7633", "timestamp_epoch": "1583961859.275730000" }, { "tcp_stream": 248, "frame_number": 7657, "display_filter": "frame.number == 7657", "timestamp_epoch": "1583961859.434570000" } ], "is_private": null, "observable_id": "observable-3a5236bc7b03332a970ff733", "last_seen_epoch": "1583961859.434570000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961859.201037000" }, { "type": "domain", "roles": [ "dns-query", "http-host", "tls-sni" ], "value": "img1.wsimg.com", "evidence": [ { "udp_stream": 140, "frame_number": 4387, "display_filter": "frame.number == 4387", "timestamp_epoch": "1583961854.732156000" }, { "udp_stream": 140, "frame_number": 4396, "display_filter": "frame.number == 4396", "timestamp_epoch": "1583961854.766530000" }, { "udp_stream": 317, "frame_number": 21140, "display_filter": "frame.number == 21140", "timestamp_epoch": "1583962650.376392000" }, { "udp_stream": 317, "frame_number": 21156, "display_filter": "frame.number == 21156", "timestamp_epoch": "1583962650.407657000" }, { "udp_stream": 317, "frame_number": 21160, "display_filter": "frame.number == 21160", "timestamp_epoch": "1583962650.459266000" }, { "tcp_stream": 207, "frame_number": 4475, "display_filter": "frame.number == 4475", "timestamp_epoch": "1583961854.850635000" }, { "tcp_stream": 207, "frame_number": 4638, "display_filter": "frame.number == 4638", "timestamp_epoch": "1583961855.179664000" }, { "tcp_stream": 207, "frame_number": 5450, "display_filter": "frame.number == 5450", "timestamp_epoch": "1583961856.581467000" }, { "tcp_stream": 204, "frame_number": 4410, "display_filter": "frame.number == 4410", "timestamp_epoch": "1583961854.790146000" }, { "tcp_stream": 219, "frame_number": 4731, "display_filter": "frame.number == 4731", "timestamp_epoch": "1583961855.227464000" } ], "is_private": null, "observable_id": "observable-2d56ef3bc0ec648cce947c26", "last_seen_epoch": "1583962650.459266000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961854.732156000" }, { "type": "domain", "roles": [ "dns-query", "http-host", "tls-sni" ], "value": "img2.wsimg.com", "evidence": [ { "udp_stream": 144, "frame_number": 4419, "display_filter": "frame.number == 4419", "timestamp_epoch": "1583961854.800699000" }, { "udp_stream": 144, "frame_number": 4446, "display_filter": "frame.number == 4446", "timestamp_epoch": "1583961854.845638000" }, { "udp_stream": 318, "frame_number": 21148, "display_filter": "frame.number == 21148", "timestamp_epoch": "1583962650.385872000" }, { "udp_stream": 318, "frame_number": 21157, "display_filter": "frame.number == 21157", "timestamp_epoch": "1583962650.416650000" }, { "udp_stream": 318, "frame_number": 21159, "display_filter": "frame.number == 21159", "timestamp_epoch": "1583962650.459214000" }, { "tcp_stream": 232, "frame_number": 5856, "display_filter": "frame.number == 5856", "timestamp_epoch": "1583961856.754926000" }, { "tcp_stream": 214, "frame_number": 4494, "display_filter": "frame.number == 4494", "timestamp_epoch": "1583961854.862048000" } ], "is_private": null, "observable_id": "observable-637e04571d4102417d69d826", "last_seen_epoch": "1583962650.459214000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961854.800699000" }, { "type": "domain", "roles": [ "dns-query", "http-host", "tls-sni" ], "value": "img4.wsimg.com", "evidence": [ { "udp_stream": 142, "frame_number": 4395, "display_filter": "frame.number == 4395", "timestamp_epoch": "1583961854.764850000" }, { "udp_stream": 142, "frame_number": 4416, "display_filter": "frame.number == 4416", "timestamp_epoch": "1583961854.797966000" }, { "udp_stream": 319, "frame_number": 21149, "display_filter": "frame.number == 21149", "timestamp_epoch": "1583962650.387061000" }, { "udp_stream": 319, "frame_number": 21158, "display_filter": "frame.number == 21158", "timestamp_epoch": "1583962650.417627000" }, { "udp_stream": 319, "frame_number": 21161, "display_filter": "frame.number == 21161", "timestamp_epoch": "1583962650.459342000" }, { "tcp_stream": 231, "frame_number": 5551, "display_filter": "frame.number == 5551", "timestamp_epoch": "1583961856.605293000" }, { "tcp_stream": 209, "frame_number": 4473, "display_filter": "frame.number == 4473", "timestamp_epoch": "1583961854.850374000" } ], "is_private": null, "observable_id": "observable-513895eac4dd944e6f14f739", "last_seen_epoch": "1583962650.459342000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961854.764850000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "imk.neweggimages.com", "evidence": [ { "udp_stream": 334, "frame_number": 21306, "display_filter": "frame.number == 21306", "timestamp_epoch": "1583962650.967564000" }, { "udp_stream": 334, "frame_number": 21363, "display_filter": "frame.number == 21363", "timestamp_epoch": "1583962650.999518000" }, { "udp_stream": 334, "frame_number": 21479, "display_filter": "frame.number == 21479", "timestamp_epoch": "1583962651.129702000" } ], "is_private": null, "observable_id": "observable-86ad4a8bf68a516b326cb7f9", "last_seen_epoch": "1583962651.129702000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962650.967564000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "insight-760077375.us-east-1.elb.amazonaws.com", "evidence": [ { "udp_stream": 386, "frame_number": 26010, "display_filter": "frame.number == 26010", "timestamp_epoch": "1583962656.960973000" } ], "is_private": null, "observable_id": "observable-d748acea2fb2b861d4a63bb1", "last_seen_epoch": "1583962656.960973000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962656.960973000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "insight.adsrvr.org", "evidence": [ { "udp_stream": 386, "frame_number": 25998, "display_filter": "frame.number == 25998", "timestamp_epoch": "1583962656.931409000" }, { "udp_stream": 386, "frame_number": 26010, "display_filter": "frame.number == 26010", "timestamp_epoch": "1583962656.960973000" }, { "tcp_stream": 535, "frame_number": 26041, "display_filter": "frame.number == 26041", "timestamp_epoch": "1583962657.062255000" } ], "is_private": null, "observable_id": "observable-e8cbececcbc858f451f54f28", "last_seen_epoch": "1583962657.062255000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962656.931409000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "itm-efz.office.com", "evidence": [ { "udp_stream": 66, "frame_number": 1898, "display_filter": "frame.number == 1898", "timestamp_epoch": "1583961789.286717000" } ], "is_private": null, "observable_id": "observable-066115c1d1d7c67f02d74f92", "last_seen_epoch": "1583961789.286717000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961789.286717000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "k-ring.msedge.net", "evidence": [ { "udp_stream": 63, "frame_number": 1850, "display_filter": "frame.number == 1850", "timestamp_epoch": "1583961789.179554000" }, { "udp_stream": 63, "frame_number": 1860, "display_filter": "frame.number == 1860", "timestamp_epoch": "1583961789.191783000" }, { "udp_stream": 125, "frame_number": 4044, "display_filter": "frame.number == 4044", "timestamp_epoch": "1583961837.153044000" }, { "udp_stream": 125, "frame_number": 4047, "display_filter": "frame.number == 4047", "timestamp_epoch": "1583961837.170614000" }, { "tcp_stream": 91, "frame_number": 1865, "display_filter": "frame.number == 1865", "timestamp_epoch": "1583961789.206292000" }, { "tcp_stream": 190, "frame_number": 4061, "display_filter": "frame.number == 4061", "timestamp_epoch": "1583961837.193573000" }, { "tcp_stream": 334, "frame_number": 12835, "display_filter": "frame.number == 12835", "timestamp_epoch": "1583962015.720421000" } ], "is_private": null, "observable_id": "observable-756ca6657cc65b69cca4fa9e", "last_seen_epoch": "1583962015.720421000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961789.179554000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "kcvsmarszhnhqdd.mondogreek.com", "evidence": [ { "udp_stream": 96, "frame_number": 2684, "display_filter": "frame.number == 2684", "timestamp_epoch": "1583961813.264054000" }, { "udp_stream": 96, "frame_number": 2685, "display_filter": "frame.number == 2685", "timestamp_epoch": "1583961813.264308000" } ], "is_private": null, "observable_id": "observable-74fc8c4db993f08ad4ec7591", "last_seen_epoch": "1583961813.264308000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961813.264054000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "kv801.prod.do.dsp.mp.microsoft.com", "evidence": [ { "udp_stream": 21, "frame_number": 592, "display_filter": "frame.number == 592", "timestamp_epoch": "1583961758.579463000" }, { "udp_stream": 21, "frame_number": 604, "display_filter": "frame.number == 604", "timestamp_epoch": "1583961758.615654000" }, { "udp_stream": 108, "frame_number": 3115, "display_filter": "frame.number == 3115", "timestamp_epoch": "1583961816.001111000" }, { "udp_stream": 108, "frame_number": 3116, "display_filter": "frame.number == 3116", "timestamp_epoch": "1583961816.043339000" }, { "tcp_stream": 31, "frame_number": 636, "display_filter": "frame.number == 636", "timestamp_epoch": "1583961758.676091000" }, { "tcp_stream": 147, "frame_number": 3145, "display_filter": "frame.number == 3145", "timestamp_epoch": "1583961817.068136000" } ], "is_private": null, "observable_id": "observable-3441bf67bbbf6a405d3a8261", "last_seen_epoch": "1583961817.068136000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961758.579463000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "l-0005.dc-msedge.net", "evidence": [ { "udp_stream": 78, "frame_number": 2340, "display_filter": "frame.number == 2340", "timestamp_epoch": "1583961806.507845000" } ], "is_private": null, "observable_id": "observable-439d7a6fa04d5944ca678cd1", "last_seen_epoch": "1583961806.507845000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961806.507845000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "l-ring.msedge.net", "evidence": [ { "udp_stream": 74, "frame_number": 2287, "display_filter": "frame.number == 2287", "timestamp_epoch": "1583961806.215464000" }, { "udp_stream": 74, "frame_number": 2295, "display_filter": "frame.number == 2295", "timestamp_epoch": "1583961806.240830000" }, { "tcp_stream": 112, "frame_number": 2309, "display_filter": "frame.number == 2309", "timestamp_epoch": "1583961806.316069000" } ], "is_private": null, "observable_id": "observable-f70c35b771911bd9805c3cc0", "last_seen_epoch": "1583961806.316069000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961806.215464000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "laptop-7xmv2sn.mondogreek.com", "evidence": [ { "udp_stream": 56, "frame_number": 1788, "display_filter": "frame.number == 1788", "timestamp_epoch": "1583961783.982644000" }, { "udp_stream": 56, "frame_number": 1789, "display_filter": "frame.number == 1789", "timestamp_epoch": "1583961783.982972000" }, { "udp_stream": 287, "frame_number": 16352, "display_filter": "frame.number == 16352", "timestamp_epoch": "1583962544.993385000" }, { "udp_stream": 287, "frame_number": 16353, "display_filter": "frame.number == 16353", "timestamp_epoch": "1583962544.993657000" } ], "is_private": null, "observable_id": "observable-1f6a8dc39a4b04c3a70ad4a6", "last_seen_epoch": "1583962544.993657000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961783.982644000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "laptop-i9zpi04.mondogreek.com", "evidence": [ { "udp_stream": 16, "frame_number": 545, "display_filter": "frame.number == 545", "timestamp_epoch": "1583961758.337798000" }, { "udp_stream": 16, "frame_number": 546, "display_filter": "frame.number == 546", "timestamp_epoch": "1583961758.338153000" }, { "udp_stream": 249, "frame_number": 15659, "display_filter": "frame.number == 15659", "timestamp_epoch": "1583962386.740038000" }, { "udp_stream": 249, "frame_number": 15660, "display_filter": "frame.number == 15660", "timestamp_epoch": "1583962386.740438000" }, { "udp_stream": 306, "frame_number": 21063, "display_filter": "frame.number == 21063", "timestamp_epoch": "1583962637.217205000" }, { "udp_stream": 306, "frame_number": 21064, "display_filter": "frame.number == 21064", "timestamp_epoch": "1583962637.217396000" } ], "is_private": null, "observable_id": "observable-2a974af09e0f6110be713817", "last_seen_epoch": "1583962637.217396000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961758.337798000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "laptop-sqsa42o.mondogreek.com", "evidence": [ { "udp_stream": 103, "frame_number": 3013, "display_filter": "frame.number == 3013", "timestamp_epoch": "1583961815.419746000" }, { "udp_stream": 103, "frame_number": 3014, "display_filter": "frame.number == 3014", "timestamp_epoch": "1583961815.419961000" }, { "udp_stream": 258, "frame_number": 16083, "display_filter": "frame.number == 16083", "timestamp_epoch": "1583962433.370420000" }, { "udp_stream": 258, "frame_number": 16084, "display_filter": "frame.number == 16084", "timestamp_epoch": "1583962433.370632000" }, { "udp_stream": 307, "frame_number": 21070, "display_filter": "frame.number == 21070", "timestamp_epoch": "1583962637.221006000" }, { "udp_stream": 307, "frame_number": 21071, "display_filter": "frame.number == 21071", "timestamp_epoch": "1583962637.221413000" } ], "is_private": null, "observable_id": "observable-94f3dcbc41a142d880e28815", "last_seen_epoch": "1583962637.221413000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961815.419746000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "licensing.mp.microsoft.com", "evidence": [ { "udp_stream": 194, "frame_number": 10537, "display_filter": "frame.number == 10537", "timestamp_epoch": "1583961956.185076000" }, { "udp_stream": 194, "frame_number": 10540, "display_filter": "frame.number == 10540", "timestamp_epoch": "1583961956.376456000" }, { "udp_stream": 241, "frame_number": 15485, "display_filter": "frame.number == 15485", "timestamp_epoch": "1583962381.913145000" }, { "udp_stream": 241, "frame_number": 15486, "display_filter": "frame.number == 15486", "timestamp_epoch": "1583962381.942405000" }, { "udp_stream": 241, "frame_number": 15489, "display_filter": "frame.number == 15489", "timestamp_epoch": "1583962381.966088000" }, { "udp_stream": 291, "frame_number": 16384, "display_filter": "frame.number == 16384", "timestamp_epoch": "1583962545.300032000" }, { "udp_stream": 291, "frame_number": 16385, "display_filter": "frame.number == 16385", "timestamp_epoch": "1583962545.300426000" }, { "udp_stream": 409, "frame_number": 27434, "display_filter": "frame.number == 27434", "timestamp_epoch": "1583962857.458795000" }, { "udp_stream": 409, "frame_number": 27435, "display_filter": "frame.number == 27435", "timestamp_epoch": "1583962857.474997000" }, { "udp_stream": 409, "frame_number": 27436, "display_filter": "frame.number == 27436", "timestamp_epoch": "1583962857.635043000" }, { "tcp_stream": 274, "frame_number": 10544, "display_filter": "frame.number == 10544", "timestamp_epoch": "1583961956.451347000" }, { "tcp_stream": 275, "frame_number": 10579, "display_filter": "frame.number == 10579", "timestamp_epoch": "1583961956.967598000" }, { "tcp_stream": 276, "frame_number": 10619, "display_filter": "frame.number == 10619", "timestamp_epoch": "1583961957.509495000" }, { "tcp_stream": 277, "frame_number": 10654, "display_filter": "frame.number == 10654", "timestamp_epoch": "1583961957.908155000" }, { "tcp_stream": 278, "frame_number": 10693, "display_filter": "frame.number == 10693", "timestamp_epoch": "1583961958.473427000" }, { "tcp_stream": 279, "frame_number": 10731, "display_filter": "frame.number == 10731", "timestamp_epoch": "1583961958.952336000" }, { "tcp_stream": 280, "frame_number": 10770, "display_filter": "frame.number == 10770", "timestamp_epoch": "1583961959.444313000" }, { "tcp_stream": 281, "frame_number": 10806, "display_filter": "frame.number == 10806", "timestamp_epoch": "1583961959.828090000" }, { "tcp_stream": 282, "frame_number": 10847, "display_filter": "frame.number == 10847", "timestamp_epoch": "1583961960.315824000" }, { "tcp_stream": 283, "frame_number": 10885, "display_filter": "frame.number == 10885", "timestamp_epoch": "1583961960.723260000" } ], "is_private": null, "observable_id": "observable-1d2d1631961603a5a97009c9", "last_seen_epoch": "1583962857.819657000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961956.185076000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "load77.exelator.com", "evidence": [ { "udp_stream": 387, "frame_number": 26056, "display_filter": "frame.number == 26056", "timestamp_epoch": "1583962657.099368000" }, { "udp_stream": 387, "frame_number": 26088, "display_filter": "frame.number == 26088", "timestamp_epoch": "1583962657.129850000" }, { "udp_stream": 387, "frame_number": 26089, "display_filter": "frame.number == 26089", "timestamp_epoch": "1583962657.131237000" }, { "tcp_stream": 538, "frame_number": 26116, "display_filter": "frame.number == 26116", "timestamp_epoch": "1583962657.165018000" } ], "is_private": null, "observable_id": "observable-1c5253cd0939bf45e3179509", "last_seen_epoch": "1583962657.165018000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962657.099368000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "loadus.exelator.com", "evidence": [ { "udp_stream": 382, "frame_number": 25903, "display_filter": "frame.number == 25903", "timestamp_epoch": "1583962656.768455000" }, { "udp_stream": 382, "frame_number": 25915, "display_filter": "frame.number == 25915", "timestamp_epoch": "1583962656.799530000" }, { "udp_stream": 382, "frame_number": 25928, "display_filter": "frame.number == 25928", "timestamp_epoch": "1583962656.834296000" }, { "tcp_stream": 532, "frame_number": 25965, "display_filter": "frame.number == 25965", "timestamp_epoch": "1583962656.856532000" } ], "is_private": null, "observable_id": "observable-fdb92dc105b9ad577f7627f7", "last_seen_epoch": "1583962656.856532000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962656.768455000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "login.live.com", "evidence": [ { "udp_stream": 178, "frame_number": 8549, "display_filter": "frame.number == 8549", "timestamp_epoch": "1583961873.948506000" }, { "udp_stream": 178, "frame_number": 8550, "display_filter": "frame.number == 8550", "timestamp_epoch": "1583961873.974309000" }, { "udp_stream": 192, "frame_number": 10481, "display_filter": "frame.number == 10481", "timestamp_epoch": "1583961955.590380000" }, { "udp_stream": 192, "frame_number": 10482, "display_filter": "frame.number == 10482", "timestamp_epoch": "1583961955.604959000" }, { "udp_stream": 240, "frame_number": 15439, "display_filter": "frame.number == 15439", "timestamp_epoch": "1583962381.344210000" }, { "udp_stream": 240, "frame_number": 15440, "display_filter": "frame.number == 15440", "timestamp_epoch": "1583962381.364416000" }, { "udp_stream": 240, "frame_number": 15441, "display_filter": "frame.number == 15441", "timestamp_epoch": "1583962381.378143000" }, { "udp_stream": 404, "frame_number": 26722, "display_filter": "frame.number == 26722", "timestamp_epoch": "1583962683.947152000" }, { "udp_stream": 404, "frame_number": 26723, "display_filter": "frame.number == 26723", "timestamp_epoch": "1583962683.965713000" }, { "tcp_stream": 258, "frame_number": 8559, "display_filter": "frame.number == 8559", "timestamp_epoch": "1583961874.042185000" }, { "tcp_stream": 272, "frame_number": 10486, "display_filter": "frame.number == 10486", "timestamp_epoch": "1583961955.673504000" }, { "tcp_stream": 319, "frame_number": 12309, "display_filter": "frame.number == 12309", "timestamp_epoch": "1583961994.005859000" }, { "tcp_stream": 397, "frame_number": 15445, "display_filter": "frame.number == 15445", "timestamp_epoch": "1583962381.450797000" }, { "tcp_stream": 557, "frame_number": 26727, "display_filter": "frame.number == 26727", "timestamp_epoch": "1583962684.021932000" } ], "is_private": null, "observable_id": "observable-30d42b2dc532dc4ae74cc6dd", "last_seen_epoch": "1583962684.021932000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961873.948506000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "login.microsoftonline.com", "evidence": [ { "udp_stream": 174, "frame_number": 8135, "display_filter": "frame.number == 8135", "timestamp_epoch": "1583961870.452904000" }, { "udp_stream": 174, "frame_number": 8136, "display_filter": "frame.number == 8136", "timestamp_epoch": "1583961870.477543000" }, { "tcp_stream": 255, "frame_number": 8142, "display_filter": "frame.number == 8142", "timestamp_epoch": "1583961870.514628000" } ], "is_private": null, "observable_id": "observable-1403cf37063322fc91404bc4", "last_seen_epoch": "1583961870.514628000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961870.452904000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "m.addthis.com", "evidence": [ { "udp_stream": 138, "frame_number": 4927, "display_filter": "frame.number == 4927", "timestamp_epoch": "1583961856.054302000" }, { "udp_stream": 138, "frame_number": 5213, "display_filter": "frame.number == 5213", "timestamp_epoch": "1583961856.360527000" }, { "udp_stream": 309, "frame_number": 21115, "display_filter": "frame.number == 21115", "timestamp_epoch": "1583962650.283918000" }, { "udp_stream": 309, "frame_number": 21124, "display_filter": "frame.number == 21124", "timestamp_epoch": "1583962650.314681000" }, { "udp_stream": 309, "frame_number": 21127, "display_filter": "frame.number == 21127", "timestamp_epoch": "1583962650.340042000" }, { "tcp_stream": 466, "frame_number": 21146, "display_filter": "frame.number == 21146", "timestamp_epoch": "1583962650.385589000" } ], "is_private": null, "observable_id": "observable-3bdcc9dd920cb5b656b8f9e5", "last_seen_epoch": "1583962650.385589000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961856.054302000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "mapping.nxtck.com", "evidence": [ { "udp_stream": 396, "frame_number": 26212, "display_filter": "frame.number == 26212", "timestamp_epoch": "1583962657.289583000" }, { "udp_stream": 396, "frame_number": 26215, "display_filter": "frame.number == 26215", "timestamp_epoch": "1583962657.320871000" }, { "udp_stream": 396, "frame_number": 26217, "display_filter": "frame.number == 26217", "timestamp_epoch": "1583962657.348534000" }, { "tcp_stream": 545, "frame_number": 26258, "display_filter": "frame.number == 26258", "timestamp_epoch": "1583962657.368952000" } ], "is_private": null, "observable_id": "observable-a1fd8da0b3a820effab4f100", "last_seen_epoch": "1583962657.368952000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962657.289583000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "match-975362022.us-east-1.elb.amazonaws.com", "evidence": [ { "udp_stream": 385, "frame_number": 26007, "display_filter": "frame.number == 26007", "timestamp_epoch": "1583962656.958475000" } ], "is_private": null, "observable_id": "observable-d733975cb9aec00ebbf3a952", "last_seen_epoch": "1583962656.958475000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962656.958475000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "match.360yield.com", "evidence": [ { "udp_stream": 395, "frame_number": 26092, "display_filter": "frame.number == 26092", "timestamp_epoch": "1583962657.132574000" }, { "udp_stream": 395, "frame_number": 26111, "display_filter": "frame.number == 26111", "timestamp_epoch": "1583962657.163780000" }, { "udp_stream": 395, "frame_number": 26128, "display_filter": "frame.number == 26128", "timestamp_epoch": "1583962657.176778000" }, { "tcp_stream": 542, "frame_number": 26189, "display_filter": "frame.number == 26189", "timestamp_epoch": "1583962657.268730000" } ], "is_private": null, "observable_id": "observable-fbf4b5fc9f947d16d46d33aa", "last_seen_epoch": "1583962657.268730000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962657.132574000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "match.adsrvr.org", "evidence": [ { "udp_stream": 385, "frame_number": 25995, "display_filter": "frame.number == 25995", "timestamp_epoch": "1583962656.929467000" }, { "udp_stream": 385, "frame_number": 26007, "display_filter": "frame.number == 26007", "timestamp_epoch": "1583962656.958475000" }, { "tcp_stream": 534, "frame_number": 26043, "display_filter": "frame.number == 26043", "timestamp_epoch": "1583962657.062865000" } ], "is_private": null, "observable_id": "observable-bbf823ff0ef3331f09a33f2a", "last_seen_epoch": "1583962657.062865000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962656.929467000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "match.prod.bidr.io", "evidence": [ { "udp_stream": 401, "frame_number": 26527, "display_filter": "frame.number == 26527", "timestamp_epoch": "1583962661.413763000" }, { "udp_stream": 401, "frame_number": 26534, "display_filter": "frame.number == 26534", "timestamp_epoch": "1583962661.444881000" }, { "udp_stream": 401, "frame_number": 26535, "display_filter": "frame.number == 26535", "timestamp_epoch": "1583962661.464277000" }, { "tcp_stream": 551, "frame_number": 26549, "display_filter": "frame.number == 26549", "timestamp_epoch": "1583962661.521962000" } ], "is_private": null, "observable_id": "observable-1ba4ad4210590e9fa538109e", "last_seen_epoch": "1583962661.521962000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962661.413763000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "mondogreek-dc.mondogreek.com", "evidence": [ { "udp_stream": 13, "frame_number": 319, "display_filter": "frame.number == 319", "timestamp_epoch": "1583961756.219780000" }, { "udp_stream": 13, "frame_number": 320, "display_filter": "frame.number == 320", "timestamp_epoch": "1583961756.220052000" }, { "udp_stream": 34, "frame_number": 1068, "display_filter": "frame.number == 1068", "timestamp_epoch": "1583961779.658177000" }, { "udp_stream": 34, "frame_number": 1069, "display_filter": "frame.number == 1069", "timestamp_epoch": "1583961779.658607000" }, { "udp_stream": 54, "frame_number": 1378, "display_filter": "frame.number == 1378", "timestamp_epoch": "1583961781.878568000" }, { "udp_stream": 54, "frame_number": 1379, "display_filter": "frame.number == 1379", "timestamp_epoch": "1583961781.878882000" }, { "udp_stream": 82, "frame_number": 2486, "display_filter": "frame.number == 2486", "timestamp_epoch": "1583961810.918613000" }, { "udp_stream": 82, "frame_number": 2487, "display_filter": "frame.number == 2487", "timestamp_epoch": "1583961810.919308000" }, { "udp_stream": 101, "frame_number": 2808, "display_filter": "frame.number == 2808", "timestamp_epoch": "1583961813.765796000" }, { "udp_stream": 101, "frame_number": 2809, "display_filter": "frame.number == 2809", "timestamp_epoch": "1583961813.766099000" }, { "udp_stream": 251, "frame_number": 15667, "display_filter": "frame.number == 15667", "timestamp_epoch": "1583962386.797821000" }, { "udp_stream": 251, "frame_number": 15668, "display_filter": "frame.number == 15668", "timestamp_epoch": "1583962386.798154000" }, { "udp_stream": 261, "frame_number": 16092, "display_filter": "frame.number == 16092", "timestamp_epoch": "1583962433.463950000" }, { "udp_stream": 261, "frame_number": 16093, "display_filter": "frame.number == 16093", "timestamp_epoch": "1583962433.464217000" }, { "udp_stream": 289, "frame_number": 16357, "display_filter": "frame.number == 16357", "timestamp_epoch": "1583962545.037411000" }, { "udp_stream": 289, "frame_number": 16358, "display_filter": "frame.number == 16358", "timestamp_epoch": "1583962545.037705000" }, { "udp_stream": 305, "frame_number": 21056, "display_filter": "frame.number == 21056", "timestamp_epoch": "1583962637.214633000" }, { "udp_stream": 305, "frame_number": 21057, "display_filter": "frame.number == 21057", "timestamp_epoch": "1583962637.214931000" } ], "is_private": null, "observable_id": "observable-fc33c33ba5b476a39d68358d", "last_seen_epoch": "1583962637.214931000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961756.219780000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "mondogreek.com", "evidence": [ { "udp_stream": 17, "frame_number": 547, "display_filter": "frame.number == 547", "timestamp_epoch": "1583961758.340596000" }, { "udp_stream": 17, "frame_number": 548, "display_filter": "frame.number == 548", "timestamp_epoch": "1583961758.341657000" }, { "udp_stream": 55, "frame_number": 1620, "display_filter": "frame.number == 1620", "timestamp_epoch": "1583961783.463628000" }, { "udp_stream": 55, "frame_number": 1621, "display_filter": "frame.number == 1621", "timestamp_epoch": "1583961783.464014000" }, { "udp_stream": 57, "frame_number": 1790, "display_filter": "frame.number == 1790", "timestamp_epoch": "1583961783.985573000" }, { "udp_stream": 57, "frame_number": 1791, "display_filter": "frame.number == 1791", "timestamp_epoch": "1583961783.986755000" }, { "udp_stream": 72, "frame_number": 2129, "display_filter": "frame.number == 2129", "timestamp_epoch": "1583961800.970926000" }, { "udp_stream": 72, "frame_number": 2131, "display_filter": "frame.number == 2131", "timestamp_epoch": "1583961800.971143000" }, { "udp_stream": 104, "frame_number": 3015, "display_filter": "frame.number == 3015", "timestamp_epoch": "1583961815.424012000" }, { "udp_stream": 104, "frame_number": 3016, "display_filter": "frame.number == 3016", "timestamp_epoch": "1583961815.424999000" }, { "udp_stream": 121, "frame_number": 3825, "display_filter": "frame.number == 3825", "timestamp_epoch": "1583961831.476016000" }, { "udp_stream": 121, "frame_number": 3827, "display_filter": "frame.number == 3827", "timestamp_epoch": "1583961831.476298000" }, { "udp_stream": 250, "frame_number": 15661, "display_filter": "frame.number == 15661", "timestamp_epoch": "1583962386.750583000" }, { "udp_stream": 250, "frame_number": 15662, "display_filter": "frame.number == 15662", "timestamp_epoch": "1583962386.751686000" }, { "udp_stream": 260, "frame_number": 16090, "display_filter": "frame.number == 16090", "timestamp_epoch": "1583962433.391674000" }, { "udp_stream": 260, "frame_number": 16091, "display_filter": "frame.number == 16091", "timestamp_epoch": "1583962433.392824000" }, { "udp_stream": 288, "frame_number": 16354, "display_filter": "frame.number == 16354", "timestamp_epoch": "1583962544.995048000" }, { "udp_stream": 288, "frame_number": 16355, "display_filter": "frame.number == 16355", "timestamp_epoch": "1583962544.995990000" } ], "is_private": null, "observable_id": "observable-4c1bb410881eeb8df3d499a3", "last_seen_epoch": "1583962544.995990000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961758.340596000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "mrodevicemgr.officeapps.live.com", "evidence": [ { "udp_stream": 218, "frame_number": 14419, "display_filter": "frame.number == 14419", "timestamp_epoch": "1583962114.533183000" }, { "udp_stream": 218, "frame_number": 14420, "display_filter": "frame.number == 14420", "timestamp_epoch": "1583962114.562144000" }, { "udp_stream": 218, "frame_number": 14421, "display_filter": "frame.number == 14421", "timestamp_epoch": "1583962114.660248000" }, { "tcp_stream": 371, "frame_number": 14425, "display_filter": "frame.number == 14425", "timestamp_epoch": "1583962114.710649000" } ], "is_private": null, "observable_id": "observable-669b624feea051d1c5bdb496", "last_seen_epoch": "1583962114.710649000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962114.533183000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "msftspeechmodelsprod.azureedge.net", "evidence": [ { "udp_stream": 242, "frame_number": 15545, "display_filter": "frame.number == 15545", "timestamp_epoch": "1583962384.970159000" }, { "udp_stream": 242, "frame_number": 15546, "display_filter": "frame.number == 15546", "timestamp_epoch": "1583962384.989254000" }, { "udp_stream": 242, "frame_number": 15547, "display_filter": "frame.number == 15547", "timestamp_epoch": "1583962385.041155000" }, { "udp_stream": 296, "frame_number": 16564, "display_filter": "frame.number == 16564", "timestamp_epoch": "1583962549.947731000" }, { "udp_stream": 296, "frame_number": 16565, "display_filter": "frame.number == 16565", "timestamp_epoch": "1583962549.968158000" }, { "udp_stream": 296, "frame_number": 16566, "display_filter": "frame.number == 16566", "timestamp_epoch": "1583962549.969823000" } ], "is_private": null, "observable_id": "observable-bbb6fe6311bb3deeb8792faa", "last_seen_epoch": "1583962549.969823000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962384.970159000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "muewhinerfhe.mondogreek.com", "evidence": [ { "udp_stream": 162, "frame_number": 7316, "display_filter": "frame.number == 7316", "timestamp_epoch": "1583961858.377611000" }, { "udp_stream": 162, "frame_number": 7317, "display_filter": "frame.number == 7317", "timestamp_epoch": "1583961858.377882000" } ], "is_private": null, "observable_id": "observable-0387d0395b96a9163ea27c46", "last_seen_epoch": "1583961858.377882000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961858.377611000" }, { "type": "domain", "roles": [ "dns-query", "http-host" ], "value": "nebula.wsimg.com", "evidence": [ { "udp_stream": 141, "frame_number": 4394, "display_filter": "frame.number == 4394", "timestamp_epoch": "1583961854.763504000" }, { "udp_stream": 141, "frame_number": 4426, "display_filter": "frame.number == 4426", "timestamp_epoch": "1583961854.810288000" }, { "udp_stream": 320, "frame_number": 21162, "display_filter": "frame.number == 21162", "timestamp_epoch": "1583962650.461201000" }, { "udp_stream": 320, "frame_number": 21182, "display_filter": "frame.number == 21182", "timestamp_epoch": "1583962650.491671000" }, { "udp_stream": 320, "frame_number": 21185, "display_filter": "frame.number == 21185", "timestamp_epoch": "1583962650.504416000" }, { "tcp_stream": 211, "frame_number": 4477, "display_filter": "frame.number == 4477", "timestamp_epoch": "1583961854.851083000" }, { "tcp_stream": 210, "frame_number": 4481, "display_filter": "frame.number == 4481", "timestamp_epoch": "1583961854.851687000" }, { "tcp_stream": 211, "frame_number": 4640, "display_filter": "frame.number == 4640", "timestamp_epoch": "1583961855.181740000" }, { "tcp_stream": 210, "frame_number": 4642, "display_filter": "frame.number == 4642", "timestamp_epoch": "1583961855.182260000" }, { "tcp_stream": 210, "frame_number": 4815, "display_filter": "frame.number == 4815", "timestamp_epoch": "1583961855.664609000" }, { "tcp_stream": 210, "frame_number": 5452, "display_filter": "frame.number == 5452", "timestamp_epoch": "1583961856.581965000" }, { "tcp_stream": 210, "frame_number": 6075, "display_filter": "frame.number == 6075", "timestamp_epoch": "1583961857.236308000" }, { "tcp_stream": 211, "frame_number": 6077, "display_filter": "frame.number == 6077", "timestamp_epoch": "1583961857.236854000" }, { "tcp_stream": 238, "frame_number": 6156, "display_filter": "frame.number == 6156", "timestamp_epoch": "1583961857.286384000" }, { "tcp_stream": 239, "frame_number": 6158, "display_filter": "frame.number == 6158", "timestamp_epoch": "1583961857.286584000" }, { "tcp_stream": 210, "frame_number": 7726, "display_filter": "frame.number == 7726", "timestamp_epoch": "1583961864.845032000" }, { "tcp_stream": 210, "frame_number": 8195, "display_filter": "frame.number == 8195", "timestamp_epoch": "1583961872.460195000" }, { "tcp_stream": 210, "frame_number": 9006, "display_filter": "frame.number == 9006", "timestamp_epoch": "1583961880.076800000" }, { "tcp_stream": 210, "frame_number": 9419, "display_filter": "frame.number == 9419", "timestamp_epoch": "1583961887.693830000" }, { "tcp_stream": 210, "frame_number": 9821, "display_filter": "frame.number == 9821", "timestamp_epoch": "1583961895.296505000" } ], "is_private": null, "observable_id": "observable-c92d01e31450bef11e65f195", "last_seen_epoch": "1583962650.504416000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961854.763504000" }, { "type": "domain", "roles": [ "dns-query", "http-host" ], "value": "newegg.com", "evidence": [ { "udp_stream": 308, "frame_number": 21114, "display_filter": "frame.number == 21114", "timestamp_epoch": "1583962650.283852000" }, { "udp_stream": 308, "frame_number": 21123, "display_filter": "frame.number == 21123", "timestamp_epoch": "1583962650.314584000" }, { "udp_stream": 308, "frame_number": 21133, "display_filter": "frame.number == 21133", "timestamp_epoch": "1583962650.349973000" }, { "tcp_stream": 467, "frame_number": 21154, "display_filter": "frame.number == 21154", "timestamp_epoch": "1583962650.405381000" } ], "is_private": null, "observable_id": "observable-152c0bb01d7db215ea2f1ad1", "last_seen_epoch": "1583962650.405381000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962650.283852000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "newegg.com.ssl.sc.omtrdc.net", "evidence": [ { "udp_stream": 336, "frame_number": 21384, "display_filter": "frame.number == 21384", "timestamp_epoch": "1583962651.092080000" } ], "is_private": null, "observable_id": "observable-5c9303fb887e42bf457b8a76", "last_seen_epoch": "1583962651.092080000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962651.092080000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "newegginc.demdex.net", "evidence": [ { "udp_stream": 348, "frame_number": 23792, "display_filter": "frame.number == 23792", "timestamp_epoch": "1583962652.394288000" }, { "udp_stream": 348, "frame_number": 23807, "display_filter": "frame.number == 23807", "timestamp_epoch": "1583962652.422875000" }, { "tcp_stream": 495, "frame_number": 23814, "display_filter": "frame.number == 23814", "timestamp_epoch": "1583962652.506365000" } ], "is_private": null, "observable_id": "observable-5163c70db1f6eed80000f94a", "last_seen_epoch": "1583962652.506365000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962652.394288000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "nexusrules.officeapps.live.com", "evidence": [ { "udp_stream": 110, "frame_number": 3121, "display_filter": "frame.number == 3121", "timestamp_epoch": "1583961816.717826000" }, { "udp_stream": 110, "frame_number": 3122, "display_filter": "frame.number == 3122", "timestamp_epoch": "1583961816.742544000" }, { "udp_stream": 177, "frame_number": 8542, "display_filter": "frame.number == 8542", "timestamp_epoch": "1583961873.835905000" }, { "udp_stream": 177, "frame_number": 8543, "display_filter": "frame.number == 8543", "timestamp_epoch": "1583961873.836267000" }, { "udp_stream": 190, "frame_number": 10338, "display_filter": "frame.number == 10338", "timestamp_epoch": "1583961936.170865000" }, { "udp_stream": 190, "frame_number": 10339, "display_filter": "frame.number == 10339", "timestamp_epoch": "1583961936.171143000" }, { "udp_stream": 417, "frame_number": 29844, "display_filter": "frame.number == 29844", "timestamp_epoch": "1583963487.664315000" }, { "udp_stream": 417, "frame_number": 29845, "display_filter": "frame.number == 29845", "timestamp_epoch": "1583963487.694128000" }, { "udp_stream": 417, "frame_number": 29846, "display_filter": "frame.number == 29846", "timestamp_epoch": "1583963487.731856000" }, { "tcp_stream": 148, "frame_number": 3126, "display_filter": "frame.number == 3126", "timestamp_epoch": "1583961816.796778000" }, { "tcp_stream": 257, "frame_number": 8547, "display_filter": "frame.number == 8547", "timestamp_epoch": "1583961873.895527000" }, { "tcp_stream": 269, "frame_number": 10343, "display_filter": "frame.number == 10343", "timestamp_epoch": "1583961936.268519000" }, { "tcp_stream": 647, "frame_number": 29850, "display_filter": "frame.number == 29850", "timestamp_epoch": "1583963487.870712000" } ], "is_private": null, "observable_id": "observable-0dc9804496777de7651b6aa4", "last_seen_epoch": "1583963487.870712000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961816.717826000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "nhfbugwsjf.mondogreek.com", "evidence": [ { "udp_stream": 12, "frame_number": 275, "display_filter": "frame.number == 275", "timestamp_epoch": "1583961755.962222000" }, { "udp_stream": 12, "frame_number": 276, "display_filter": "frame.number == 276", "timestamp_epoch": "1583961755.962554000" } ], "is_private": null, "observable_id": "observable-598334da9c6a5dc0b261441d", "last_seen_epoch": "1583961755.962554000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961755.962222000" }, { "type": "domain", "roles": [ "dns-query", "http-host" ], "value": "notable-quotes.com", "evidence": [ { "udp_stream": 207, "frame_number": 13301, "display_filter": "frame.number == 13301", "timestamp_epoch": "1583962027.181355000" }, { "udp_stream": 207, "frame_number": 13302, "display_filter": "frame.number == 13302", "timestamp_epoch": "1583962027.252924000" }, { "tcp_stream": 344, "frame_number": 13309, "display_filter": "frame.number == 13309", "timestamp_epoch": "1583962027.316706000" }, { "tcp_stream": 345, "frame_number": 13326, "display_filter": "frame.number == 13326", "timestamp_epoch": "1583962027.431505000" }, { "tcp_stream": 344, "frame_number": 13363, "display_filter": "frame.number == 13363", "timestamp_epoch": "1583962027.488515000" }, { "tcp_stream": 346, "frame_number": 13369, "display_filter": "frame.number == 13369", "timestamp_epoch": "1583962027.489267000" }, { "tcp_stream": 347, "frame_number": 13371, "display_filter": "frame.number == 13371", "timestamp_epoch": "1583962027.489469000" }, { "tcp_stream": 348, "frame_number": 13383, "display_filter": "frame.number == 13383", "timestamp_epoch": "1583962027.493360000" }, { "tcp_stream": 349, "frame_number": 13384, "display_filter": "frame.number == 13384", "timestamp_epoch": "1583962027.493415000" }, { "tcp_stream": 344, "frame_number": 13453, "display_filter": "frame.number == 13453", "timestamp_epoch": "1583962027.547622000" }, { "tcp_stream": 345, "frame_number": 14008, "display_filter": "frame.number == 14008", "timestamp_epoch": "1583962031.859675000" } ], "is_private": null, "observable_id": "observable-cd035e5d2692ceb8292af2ac", "last_seen_epoch": "1583962031.859675000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962027.181355000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "nvzkinvuuinkgs.mondogreek.com", "evidence": [ { "udp_stream": 270, "frame_number": 16220, "display_filter": "frame.number == 16220", "timestamp_epoch": "1583962439.874056000" }, { "udp_stream": 270, "frame_number": 16222, "display_filter": "frame.number == 16222", "timestamp_epoch": "1583962439.874349000" } ], "is_private": null, "observable_id": "observable-876ad876a2a05ecd0c7a6c8d", "last_seen_epoch": "1583962439.874349000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962439.874056000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "nypi.dc-storm.com", "evidence": [ { "udp_stream": 384, "frame_number": 25914, "display_filter": "frame.number == 25914", "timestamp_epoch": "1583962656.791774000" }, { "udp_stream": 384, "frame_number": 25919, "display_filter": "frame.number == 25919", "timestamp_epoch": "1583962656.815109000" } ], "is_private": null, "observable_id": "observable-1b76603c1a8f61ac9432c1fb", "last_seen_epoch": "1583962656.815109000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962656.791774000" }, { "type": "domain", "roles": [ "dns-query", "http-host" ], "value": "ocsp.digicert.com", "evidence": [ { "udp_stream": 193, "frame_number": 10494, "display_filter": "frame.number == 10494", "timestamp_epoch": "1583961955.768821000" }, { "udp_stream": 193, "frame_number": 10496, "display_filter": "frame.number == 10496", "timestamp_epoch": "1583961955.805772000" }, { "tcp_stream": 273, "frame_number": 10500, "display_filter": "frame.number == 10500", "timestamp_epoch": "1583961955.838319000" } ], "is_private": null, "observable_id": "observable-c8e04c64ccebf25929dbea62", "last_seen_epoch": "1583961955.838319000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961955.768821000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "pagead.l.doubleclick.net", "evidence": [ { "udp_stream": 365, "frame_number": 25148, "display_filter": "frame.number == 25148", "timestamp_epoch": "1583962655.347719000" }, { "udp_stream": 392, "frame_number": 26090, "display_filter": "frame.number == 26090", "timestamp_epoch": "1583962657.131301000" } ], "is_private": null, "observable_id": "observable-1e9f085bf4ea6b82d9170d74", "last_seen_epoch": "1583962657.131301000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962655.347719000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "pagead46.l.doubleclick.net", "evidence": [ { "udp_stream": 352, "frame_number": 24064, "display_filter": "frame.number == 24064", "timestamp_epoch": "1583962652.905894000" }, { "udp_stream": 354, "frame_number": 24232, "display_filter": "frame.number == 24232", "timestamp_epoch": "1583962653.141217000" }, { "udp_stream": 372, "frame_number": 25283, "display_filter": "frame.number == 25283", "timestamp_epoch": "1583962655.597916000" } ], "is_private": null, "observable_id": "observable-d96525b4492194d007eb9f83", "last_seen_epoch": "1583962655.597916000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962652.905894000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "partnerad.l.doubleclick.net", "evidence": [ { "udp_stream": 355, "frame_number": 24226, "display_filter": "frame.number == 24226", "timestamp_epoch": "1583962653.139608000" } ], "is_private": null, "observable_id": "observable-70f3911a93cbbe9592b0c533", "last_seen_epoch": "1583962653.139608000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962653.139608000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "pf.newegg.com", "evidence": [ { "udp_stream": 340, "frame_number": 21389, "display_filter": "frame.number == 21389", "timestamp_epoch": "1583962651.096911000" }, { "udp_stream": 340, "frame_number": 21462, "display_filter": "frame.number == 21462", "timestamp_epoch": "1583962651.129190000" }, { "udp_stream": 340, "frame_number": 21486, "display_filter": "frame.number == 21486", "timestamp_epoch": "1583962651.132407000" }, { "tcp_stream": 488, "frame_number": 21637, "display_filter": "frame.number == 21637", "timestamp_epoch": "1583962651.199705000" } ], "is_private": null, "observable_id": "observable-43a2028d2b3dab9060ebf667", "last_seen_epoch": "1583962651.199705000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962651.096911000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "pixel.advertising.com", "evidence": [ { "udp_stream": 389, "frame_number": 26058, "display_filter": "frame.number == 26058", "timestamp_epoch": "1583962657.103947000" }, { "udp_stream": 389, "frame_number": 26095, "display_filter": "frame.number == 26095", "timestamp_epoch": "1583962657.134863000" }, { "udp_stream": 389, "frame_number": 26098, "display_filter": "frame.number == 26098", "timestamp_epoch": "1583962657.137080000" }, { "tcp_stream": 541, "frame_number": 26191, "display_filter": "frame.number == 26191", "timestamp_epoch": "1583962657.269010000" } ], "is_private": null, "observable_id": "observable-a3740dd418d129e8a25d8bf3", "last_seen_epoch": "1583962657.269010000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962657.103947000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "pixel.rubiconproject.com", "evidence": [ { "udp_stream": 390, "frame_number": 26059, "display_filter": "frame.number == 26059", "timestamp_epoch": "1583962657.104542000" }, { "udp_stream": 390, "frame_number": 26082, "display_filter": "frame.number == 26082", "timestamp_epoch": "1583962657.125860000" }, { "tcp_stream": 536, "frame_number": 26150, "display_filter": "frame.number == 26150", "timestamp_epoch": "1583962657.208684000" } ], "is_private": null, "observable_id": "observable-5e91c004b68199531edd00ef", "last_seen_epoch": "1583962657.208684000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962657.104542000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "pixel.rubiconproject.net.akadns.net", "evidence": [ { "udp_stream": 390, "frame_number": 26082, "display_filter": "frame.number == 26082", "timestamp_epoch": "1583962657.125860000" } ], "is_private": null, "observable_id": "observable-57691020a7d51e6dfd5cd492", "last_seen_epoch": "1583962657.125860000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962657.125860000" }, { "type": "domain", "roles": [ "dns-query", "http-host", "tls-sni" ], "value": "platform.twitter.com", "evidence": [ { "udp_stream": 156, "frame_number": 6001, "display_filter": "frame.number == 6001", "timestamp_epoch": "1583961857.000173000" }, { "udp_stream": 156, "frame_number": 6069, "display_filter": "frame.number == 6069", "timestamp_epoch": "1583961857.209794000" }, { "udp_stream": 321, "frame_number": 21163, "display_filter": "frame.number == 21163", "timestamp_epoch": "1583962650.461396000" }, { "udp_stream": 321, "frame_number": 21184, "display_filter": "frame.number == 21184", "timestamp_epoch": "1583962650.492792000" }, { "udp_stream": 321, "frame_number": 21194, "display_filter": "frame.number == 21194", "timestamp_epoch": "1583962650.527524000" }, { "tcp_stream": 237, "frame_number": 6154, "display_filter": "frame.number == 6154", "timestamp_epoch": "1583961857.286196000" }, { "tcp_stream": 241, "frame_number": 6672, "display_filter": "frame.number == 6672", "timestamp_epoch": "1583961857.434186000" }, { "tcp_stream": 241, "frame_number": 6820, "display_filter": "frame.number == 6820", "timestamp_epoch": "1583961857.462573000" } ], "is_private": null, "observable_id": "observable-2f506e919718a20ac3f91717", "last_seen_epoch": "1583962650.527524000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961857.000173000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "play.google.com", "evidence": [ { "udp_stream": 364, "frame_number": 25127, "display_filter": "frame.number == 25127", "timestamp_epoch": "1583962655.240794000" }, { "udp_stream": 364, "frame_number": 25129, "display_filter": "frame.number == 25129", "timestamp_epoch": "1583962655.272099000" }, { "udp_stream": 364, "frame_number": 25130, "display_filter": "frame.number == 25130", "timestamp_epoch": "1583962655.290011000" }, { "tcp_stream": 511, "frame_number": 25139, "display_filter": "frame.number == 25139", "timestamp_epoch": "1583962655.310032000" } ], "is_private": null, "observable_id": "observable-a4a42b8dbe065eb4a3ea6364", "last_seen_epoch": "1583962655.310032000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962655.240794000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "plus.l.google.com", "evidence": [ { "udp_stream": 356, "frame_number": 24523, "display_filter": "frame.number == 24523", "timestamp_epoch": "1583962654.493084000" } ], "is_private": null, "observable_id": "observable-f05a0ae62b2532ac94d7e518", "last_seen_epoch": "1583962654.493084000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962654.493084000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "prod.mrodevicemgr.live.com.akadns.net", "evidence": [ { "udp_stream": 218, "frame_number": 14421, "display_filter": "frame.number == 14421", "timestamp_epoch": "1583962114.660248000" } ], "is_private": null, "observable_id": "observable-01356047e0a784cb871ed12f", "last_seen_epoch": "1583962114.660248000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962114.660248000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "prod.nexusrules.live.com.akadns.net", "evidence": [ { "udp_stream": 110, "frame_number": 3122, "display_filter": "frame.number == 3122", "timestamp_epoch": "1583961816.742544000" }, { "udp_stream": 177, "frame_number": 8543, "display_filter": "frame.number == 8543", "timestamp_epoch": "1583961873.836267000" }, { "udp_stream": 190, "frame_number": 10339, "display_filter": "frame.number == 10339", "timestamp_epoch": "1583961936.171143000" }, { "udp_stream": 417, "frame_number": 29846, "display_filter": "frame.number == 29846", "timestamp_epoch": "1583963487.731856000" } ], "is_private": null, "observable_id": "observable-39a46292a15be15a5f1932df", "last_seen_epoch": "1583963487.731856000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961816.742544000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "promotions.newegg.com", "evidence": [ { "udp_stream": 329, "frame_number": 21281, "display_filter": "frame.number == 21281", "timestamp_epoch": "1583962650.899420000" }, { "udp_stream": 329, "frame_number": 21290, "display_filter": "frame.number == 21290", "timestamp_epoch": "1583962650.943765000" }, { "tcp_stream": 471, "frame_number": 21302, "display_filter": "frame.number == 21302", "timestamp_epoch": "1583962650.966488000" } ], "is_private": null, "observable_id": "observable-aa3db9e0244f6bdddffd3b52", "last_seen_epoch": "1583962650.966488000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962650.899420000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "pti.store.microsoft.com", "evidence": [ { "udp_stream": 197, "frame_number": 12411, "display_filter": "frame.number == 12411", "timestamp_epoch": "1583961995.533222000" }, { "udp_stream": 197, "frame_number": 12412, "display_filter": "frame.number == 12412", "timestamp_epoch": "1583961995.556452000" }, { "udp_stream": 225, "frame_number": 14740, "display_filter": "frame.number == 14740", "timestamp_epoch": "1583962291.232047000" }, { "udp_stream": 225, "frame_number": 14743, "display_filter": "frame.number == 14743", "timestamp_epoch": "1583962291.263099000" }, { "udp_stream": 225, "frame_number": 14744, "display_filter": "frame.number == 14744", "timestamp_epoch": "1583962291.265084000" }, { "udp_stream": 227, "frame_number": 14918, "display_filter": "frame.number == 14918", "timestamp_epoch": "1583962319.914672000" }, { "udp_stream": 227, "frame_number": 14919, "display_filter": "frame.number == 14919", "timestamp_epoch": "1583962319.940114000" }, { "tcp_stream": 321, "frame_number": 12416, "display_filter": "frame.number == 12416", "timestamp_epoch": "1583961995.606172000" }, { "tcp_stream": 381, "frame_number": 14750, "display_filter": "frame.number == 14750", "timestamp_epoch": "1583962291.285102000" }, { "tcp_stream": 387, "frame_number": 14925, "display_filter": "frame.number == 14925", "timestamp_epoch": "1583962319.971860000" } ], "is_private": null, "observable_id": "observable-cdf7f9517f749a20ef42ddf6", "last_seen_epoch": "1583962319.971860000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961995.533222000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "px.steelhousemedia.com", "evidence": [ { "udp_stream": 399, "frame_number": 26432, "display_filter": "frame.number == 26432", "timestamp_epoch": "1583962658.957656000" }, { "udp_stream": 399, "frame_number": 26433, "display_filter": "frame.number == 26433", "timestamp_epoch": "1583962658.985207000" }, { "tcp_stream": 549, "frame_number": 26437, "display_filter": "frame.number == 26437", "timestamp_epoch": "1583962659.002722000" }, { "tcp_stream": 550, "frame_number": 26491, "display_filter": "frame.number == 26491", "timestamp_epoch": "1583962661.185111000" }, { "tcp_stream": 552, "frame_number": 26542, "display_filter": "frame.number == 26542", "timestamp_epoch": "1583962661.497727000" } ], "is_private": null, "observable_id": "observable-408797bd97ba56a1977acae2", "last_seen_epoch": "1583962661.497727000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962658.957656000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "pxtm.steelhousemedia.com", "evidence": [ { "udp_stream": 399, "frame_number": 26433, "display_filter": "frame.number == 26433", "timestamp_epoch": "1583962658.985207000" } ], "is_private": null, "observable_id": "observable-f600b97968a199475b927715", "last_seen_epoch": "1583962658.985207000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962658.985207000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "roijvdflsx.mondogreek.com", "evidence": [ { "udp_stream": 271, "frame_number": 16221, "display_filter": "frame.number == 16221", "timestamp_epoch": "1583962439.874196000" }, { "udp_stream": 271, "frame_number": 16224, "display_filter": "frame.number == 16224", "timestamp_epoch": "1583962439.874418000" } ], "is_private": null, "observable_id": "observable-1e16c976be53a9f9f7c880a9", "last_seen_epoch": "1583962439.874418000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962439.874196000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "rtb-csync.smartadserver.com", "evidence": [ { "udp_stream": 394, "frame_number": 26087, "display_filter": "frame.number == 26087", "timestamp_epoch": "1583962657.128132000" }, { "udp_stream": 394, "frame_number": 26110, "display_filter": "frame.number == 26110", "timestamp_epoch": "1583962657.158825000" }, { "udp_stream": 394, "frame_number": 26180, "display_filter": "frame.number == 26180", "timestamp_epoch": "1583962657.266607000" }, { "tcp_stream": 544, "frame_number": 26247, "display_filter": "frame.number == 26247", "timestamp_epoch": "1583962657.359466000" }, { "tcp_stream": 546, "frame_number": 26299, "display_filter": "frame.number == 26299", "timestamp_epoch": "1583962657.447591000" } ], "is_private": null, "observable_id": "observable-1d4b15cde435f57f8099df43", "last_seen_epoch": "1583962657.447591000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962657.128132000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "rum18.perf.linkedin.com", "evidence": [ { "udp_stream": 78, "frame_number": 2335, "display_filter": "frame.number == 2335", "timestamp_epoch": "1583961806.486979000" }, { "udp_stream": 78, "frame_number": 2340, "display_filter": "frame.number == 2340", "timestamp_epoch": "1583961806.507845000" }, { "tcp_stream": 117, "frame_number": 2397, "display_filter": "frame.number == 2397", "timestamp_epoch": "1583961806.671116000" } ], "is_private": null, "observable_id": "observable-4c4a6b2473fec43c3df4aa23", "last_seen_epoch": "1583961806.671116000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961806.486979000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "s-0001.s-msedge.net", "evidence": [ { "udp_stream": 137, "frame_number": 4342, "display_filter": "frame.number == 4342", "timestamp_epoch": "1583961854.516637000" }, { "udp_stream": 406, "frame_number": 26795, "display_filter": "frame.number == 26795", "timestamp_epoch": "1583962685.586418000" }, { "udp_stream": 407, "frame_number": 27314, "display_filter": "frame.number == 27314", "timestamp_epoch": "1583962732.810552000" } ], "is_private": null, "observable_id": "observable-3f3891427c3c108ac264c220", "last_seen_epoch": "1583962732.810552000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961854.516637000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "s-ring.msedge.net", "evidence": [ { "udp_stream": 75, "frame_number": 2326, "display_filter": "frame.number == 2326", "timestamp_epoch": "1583961806.398703000" }, { "udp_stream": 75, "frame_number": 2328, "display_filter": "frame.number == 2328", "timestamp_epoch": "1583961806.430849000" }, { "tcp_stream": 113, "frame_number": 2373, "display_filter": "frame.number == 2373", "timestamp_epoch": "1583961806.630592000" } ], "is_private": null, "observable_id": "observable-e2e09c15ce773c4bd6f6baf2", "last_seen_epoch": "1583961806.630592000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961806.398703000" }, { "type": "domain", "roles": [ "dns-query", "http-host", "tls-sni" ], "value": "s7.addthis.com", "evidence": [ { "udp_stream": 146, "frame_number": 4538, "display_filter": "frame.number == 4538", "timestamp_epoch": "1583961854.904839000" }, { "udp_stream": 146, "frame_number": 4544, "display_filter": "frame.number == 4544", "timestamp_epoch": "1583961854.927021000" }, { "udp_stream": 322, "frame_number": 21164, "display_filter": "frame.number == 21164", "timestamp_epoch": "1583962650.461620000" }, { "udp_stream": 322, "frame_number": 21183, "display_filter": "frame.number == 21183", "timestamp_epoch": "1583962650.492719000" }, { "udp_stream": 322, "frame_number": 21187, "display_filter": "frame.number == 21187", "timestamp_epoch": "1583962650.507613000" }, { "tcp_stream": 216, "frame_number": 4559, "display_filter": "frame.number == 4559", "timestamp_epoch": "1583961854.985134000" }, { "tcp_stream": 218, "frame_number": 4572, "display_filter": "frame.number == 4572", "timestamp_epoch": "1583961855.058332000" } ], "is_private": null, "observable_id": "observable-53fcb2eb838e40eb38acdced", "last_seen_epoch": "1583962650.507613000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961854.904839000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "sb.monetate.net", "evidence": [ { "udp_stream": 346, "frame_number": 23646, "display_filter": "frame.number == 23646", "timestamp_epoch": "1583962652.091185000" }, { "udp_stream": 346, "frame_number": 23650, "display_filter": "frame.number == 23650", "timestamp_epoch": "1583962652.122053000" }, { "udp_stream": 346, "frame_number": 23655, "display_filter": "frame.number == 23655", "timestamp_epoch": "1583962652.135603000" } ], "is_private": null, "observable_id": "observable-d4bc9bce2e6ea266c13c6ad8", "last_seen_epoch": "1583962652.135603000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962652.091185000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "scontent.xx.fbcdn.net", "evidence": [ { "udp_stream": 155, "frame_number": 5989, "display_filter": "frame.number == 5989", "timestamp_epoch": "1583961856.974342000" }, { "udp_stream": 310, "frame_number": 21130, "display_filter": "frame.number == 21130", "timestamp_epoch": "1583962650.341046000" } ], "is_private": null, "observable_id": "observable-72cdd77693b1dc882bc0d6cf", "last_seen_epoch": "1583962650.341046000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961856.974342000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "se.monetate.net", "evidence": [ { "udp_stream": 335, "frame_number": 21317, "display_filter": "frame.number == 21317", "timestamp_epoch": "1583962650.973530000" }, { "udp_stream": 335, "frame_number": 21367, "display_filter": "frame.number == 21367", "timestamp_epoch": "1583962651.004532000" }, { "udp_stream": 335, "frame_number": 21451, "display_filter": "frame.number == 21451", "timestamp_epoch": "1583962651.128381000" }, { "tcp_stream": 487, "frame_number": 21630, "display_filter": "frame.number == 21630", "timestamp_epoch": "1583962651.198570000" } ], "is_private": null, "observable_id": "observable-20dfb001ebf89a36e59000b1", "last_seen_epoch": "1583962651.198570000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962650.973530000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "sealserver.trustwave.com", "evidence": [ { "udp_stream": 338, "frame_number": 21378, "display_filter": "frame.number == 21378", "timestamp_epoch": "1583962651.055367000" }, { "udp_stream": 338, "frame_number": 21379, "display_filter": "frame.number == 21379", "timestamp_epoch": "1583962651.086538000" }, { "udp_stream": 338, "frame_number": 21482, "display_filter": "frame.number == 21482", "timestamp_epoch": "1583962651.129952000" }, { "tcp_stream": 486, "frame_number": 21606, "display_filter": "frame.number == 21606", "timestamp_epoch": "1583962651.197319000" } ], "is_private": null, "observable_id": "observable-be53fb328ea526dc073bfd2c", "last_seen_epoch": "1583962651.197319000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962651.055367000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "secure.adnxs.com", "evidence": [ { "udp_stream": 391, "frame_number": 26060, "display_filter": "frame.number == 26060", "timestamp_epoch": "1583962657.105078000" }, { "udp_stream": 391, "frame_number": 26083, "display_filter": "frame.number == 26083", "timestamp_epoch": "1583962657.125928000" }, { "tcp_stream": 537, "frame_number": 26185, "display_filter": "frame.number == 26185", "timestamp_epoch": "1583962657.267107000" } ], "is_private": null, "observable_id": "observable-35dd3cfd7f14a191503a8140", "last_seen_epoch": "1583962657.267107000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962657.105078000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "secure.newegg.com", "evidence": [ { "udp_stream": 333, "frame_number": 21297, "display_filter": "frame.number == 21297", "timestamp_epoch": "1583962650.960120000" }, { "udp_stream": 333, "frame_number": 21354, "display_filter": "frame.number == 21354", "timestamp_epoch": "1583962650.991794000" }, { "udp_stream": 333, "frame_number": 21364, "display_filter": "frame.number == 21364", "timestamp_epoch": "1583962651.000088000" }, { "tcp_stream": 482, "frame_number": 21491, "display_filter": "frame.number == 21491", "timestamp_epoch": "1583962651.136634000" } ], "is_private": null, "observable_id": "observable-14d94dcd3be296b5b308f17a", "last_seen_epoch": "1583962651.136634000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962650.960120000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "securepubads.g.doubleclick.net", "evidence": [ { "udp_stream": 355, "frame_number": 24222, "display_filter": "frame.number == 24222", "timestamp_epoch": "1583962653.095819000" }, { "udp_stream": 355, "frame_number": 24225, "display_filter": "frame.number == 24225", "timestamp_epoch": "1583962653.126996000" }, { "udp_stream": 355, "frame_number": 24226, "display_filter": "frame.number == 24226", "timestamp_epoch": "1583962653.139608000" }, { "tcp_stream": 502, "frame_number": 24248, "display_filter": "frame.number == 24248", "timestamp_epoch": "1583962653.172435000" } ], "is_private": null, "observable_id": "observable-d585839b09664977e1501389", "last_seen_epoch": "1583962653.172435000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962653.095819000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "self.events.data.microsoft.com", "evidence": [ { "udp_stream": 28, "frame_number": 1016, "display_filter": "frame.number == 1016", "timestamp_epoch": "1583961766.480352000" }, { "udp_stream": 28, "frame_number": 1019, "display_filter": "frame.number == 1019", "timestamp_epoch": "1583961766.602814000" }, { "udp_stream": 69, "frame_number": 2019, "display_filter": "frame.number == 2019", "timestamp_epoch": "1583961792.678223000" }, { "udp_stream": 69, "frame_number": 2020, "display_filter": "frame.number == 2020", "timestamp_epoch": "1583961792.706361000" }, { "udp_stream": 118, "frame_number": 3705, "display_filter": "frame.number == 3705", "timestamp_epoch": "1583961823.973236000" }, { "udp_stream": 118, "frame_number": 3706, "display_filter": "frame.number == 3706", "timestamp_epoch": "1583961824.002810000" }, { "udp_stream": 180, "frame_number": 9003, "display_filter": "frame.number == 9003", "timestamp_epoch": "1583961879.976722000" }, { "udp_stream": 180, "frame_number": 9004, "display_filter": "frame.number == 9004", "timestamp_epoch": "1583961880.041235000" }, { "tcp_stream": 50, "frame_number": 1023, "display_filter": "frame.number == 1023", "timestamp_epoch": "1583961766.883291000" }, { "tcp_stream": 99, "frame_number": 2024, "display_filter": "frame.number == 2024", "timestamp_epoch": "1583961792.836242000" }, { "tcp_stream": 175, "frame_number": 3710, "display_filter": "frame.number == 3710", "timestamp_epoch": "1583961824.060099000" }, { "tcp_stream": 260, "frame_number": 9010, "display_filter": "frame.number == 9010", "timestamp_epoch": "1583961880.113934000" }, { "tcp_stream": 365, "frame_number": 14262, "display_filter": "frame.number == 14262", "timestamp_epoch": "1583962086.400945000" }, { "tcp_stream": 366, "frame_number": 14319, "display_filter": "frame.number == 14319", "timestamp_epoch": "1583962112.351640000" }, { "tcp_stream": 372, "frame_number": 14483, "display_filter": "frame.number == 14483", "timestamp_epoch": "1583962143.682391000" }, { "tcp_stream": 373, "frame_number": 14512, "display_filter": "frame.number == 14512", "timestamp_epoch": "1583962155.990990000" } ], "is_private": null, "observable_id": "observable-062259f9df6a178908737469", "last_seen_epoch": "1583962155.990990000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961766.480352000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "settings-win.data.microsoft.com", "evidence": [ { "udp_stream": 117, "frame_number": 3698, "display_filter": "frame.number == 3698", "timestamp_epoch": "1583961823.738973000" }, { "udp_stream": 117, "frame_number": 3699, "display_filter": "frame.number == 3699", "timestamp_epoch": "1583961823.771503000" }, { "udp_stream": 239, "frame_number": 15386, "display_filter": "frame.number == 15386", "timestamp_epoch": "1583962380.401914000" }, { "udp_stream": 239, "frame_number": 15393, "display_filter": "frame.number == 15393", "timestamp_epoch": "1583962380.441417000" }, { "udp_stream": 284, "frame_number": 16327, "display_filter": "frame.number == 16327", "timestamp_epoch": "1583962544.765052000" }, { "udp_stream": 284, "frame_number": 16328, "display_filter": "frame.number == 16328", "timestamp_epoch": "1583962544.794759000" }, { "udp_stream": 284, "frame_number": 16329, "display_filter": "frame.number == 16329", "timestamp_epoch": "1583962544.824732000" }, { "tcp_stream": 174, "frame_number": 3703, "display_filter": "frame.number == 3703", "timestamp_epoch": "1583961823.830970000" }, { "tcp_stream": 396, "frame_number": 15401, "display_filter": "frame.number == 15401", "timestamp_epoch": "1583962380.471041000" }, { "tcp_stream": 405, "frame_number": 15717, "display_filter": "frame.number == 15717", "timestamp_epoch": "1583962387.261460000" }, { "tcp_stream": 407, "frame_number": 15754, "display_filter": "frame.number == 15754", "timestamp_epoch": "1583962387.520876000" }, { "tcp_stream": 415, "frame_number": 16333, "display_filter": "frame.number == 16333", "timestamp_epoch": "1583962544.850204000" }, { "tcp_stream": 424, "frame_number": 16570, "display_filter": "frame.number == 16570", "timestamp_epoch": "1583962550.983275000" }, { "tcp_stream": 425, "frame_number": 16595, "display_filter": "frame.number == 16595", "timestamp_epoch": "1583962551.126244000" } ], "is_private": null, "observable_id": "observable-fd9c2bb0a887bfad0807561a", "last_seen_epoch": "1583962551.126244000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961823.738973000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "settingsfd-geo.trafficmanager.net", "evidence": [ { "udp_stream": 117, "frame_number": 3699, "display_filter": "frame.number == 3699", "timestamp_epoch": "1583961823.771503000" }, { "udp_stream": 239, "frame_number": 15393, "display_filter": "frame.number == 15393", "timestamp_epoch": "1583962380.441417000" }, { "udp_stream": 284, "frame_number": 16329, "display_filter": "frame.number == 16329", "timestamp_epoch": "1583962544.824732000" } ], "is_private": null, "observable_id": "observable-02bfb21a1ef9388b5e799d76", "last_seen_epoch": "1583962544.824732000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961823.771503000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "slscr.update.microsoft.com", "evidence": [ { "udp_stream": 191, "frame_number": 10443, "display_filter": "frame.number == 10443", "timestamp_epoch": "1583961950.896457000" }, { "udp_stream": 191, "frame_number": 10445, "display_filter": "frame.number == 10445", "timestamp_epoch": "1583961951.891892000" }, { "udp_stream": 191, "frame_number": 10446, "display_filter": "frame.number == 10446", "timestamp_epoch": "1583961952.907454000" }, { "udp_stream": 191, "frame_number": 10456, "display_filter": "frame.number == 10456", "timestamp_epoch": "1583961954.783018000" }, { "udp_stream": 243, "frame_number": 15550, "display_filter": "frame.number == 15550", "timestamp_epoch": "1583962385.391674000" }, { "udp_stream": 243, "frame_number": 15551, "display_filter": "frame.number == 15551", "timestamp_epoch": "1583962385.535429000" }, { "udp_stream": 411, "frame_number": 27536, "display_filter": "frame.number == 27536", "timestamp_epoch": "1583962904.728695000" }, { "udp_stream": 411, "frame_number": 27537, "display_filter": "frame.number == 27537", "timestamp_epoch": "1583962904.757302000" }, { "udp_stream": 411, "frame_number": 27538, "display_filter": "frame.number == 27538", "timestamp_epoch": "1583962904.881940000" }, { "tcp_stream": 271, "frame_number": 10460, "display_filter": "frame.number == 10460", "timestamp_epoch": "1583961954.945579000" }, { "tcp_stream": 401, "frame_number": 15555, "display_filter": "frame.number == 15555", "timestamp_epoch": "1583962385.574608000" }, { "tcp_stream": 572, "frame_number": 27542, "display_filter": "frame.number == 27542", "timestamp_epoch": "1583962904.927272000" } ], "is_private": null, "observable_id": "observable-4012c92c03e1ff6f7c4e624f", "last_seen_epoch": "1583962904.927272000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961950.896457000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "spo-ring.msedge.net", "evidence": [ { "udp_stream": 127, "frame_number": 4046, "display_filter": "frame.number == 4046", "timestamp_epoch": "1583961837.164150000" }, { "udp_stream": 127, "frame_number": 4058, "display_filter": "frame.number == 4058", "timestamp_epoch": "1583961837.190570000" }, { "udp_stream": 206, "frame_number": 12906, "display_filter": "frame.number == 12906", "timestamp_epoch": "1583962015.853494000" }, { "udp_stream": 206, "frame_number": 12907, "display_filter": "frame.number == 12907", "timestamp_epoch": "1583962015.867946000" }, { "tcp_stream": 191, "frame_number": 4078, "display_filter": "frame.number == 4078", "timestamp_epoch": "1583961837.245010000" }, { "tcp_stream": 335, "frame_number": 12913, "display_filter": "frame.number == 12913", "timestamp_epoch": "1583962015.892849000" } ], "is_private": null, "observable_id": "observable-4629fc13a505594ee8182fd9", "last_seen_epoch": "1583962015.892849000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961837.164150000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "star-mini.c10r.facebook.com", "evidence": [ { "udp_stream": 154, "frame_number": 5984, "display_filter": "frame.number == 5984", "timestamp_epoch": "1583961856.929561000" }, { "udp_stream": 325, "frame_number": 21205, "display_filter": "frame.number == 21205", "timestamp_epoch": "1583962650.557596000" } ], "is_private": null, "observable_id": "observable-f96ef48d1952acced3ae4c3c", "last_seen_epoch": "1583962650.557596000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961856.929561000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "states.newegg.com", "evidence": [ { "udp_stream": 336, "frame_number": 21322, "display_filter": "frame.number == 21322", "timestamp_epoch": "1583962650.989158000" }, { "udp_stream": 336, "frame_number": 21372, "display_filter": "frame.number == 21372", "timestamp_epoch": "1583962651.019716000" }, { "udp_stream": 336, "frame_number": 21384, "display_filter": "frame.number == 21384", "timestamp_epoch": "1583962651.092080000" }, { "tcp_stream": 484, "frame_number": 21568, "display_filter": "frame.number == 21568", "timestamp_epoch": "1583962651.195071000" }, { "tcp_stream": 498, "frame_number": 24004, "display_filter": "frame.number == 24004", "timestamp_epoch": "1583962652.725185000" } ], "is_private": null, "observable_id": "observable-3d6c4a2169d82859d004c0c7", "last_seen_epoch": "1583962652.725185000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962650.989158000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "stats.g.doubleclick.net", "evidence": [ { "udp_stream": 361, "frame_number": 24769, "display_filter": "frame.number == 24769", "timestamp_epoch": "1583962654.673446000" }, { "udp_stream": 361, "frame_number": 24781, "display_filter": "frame.number == 24781", "timestamp_epoch": "1583962654.704131000" }, { "udp_stream": 361, "frame_number": 24784, "display_filter": "frame.number == 24784", "timestamp_epoch": "1583962654.705612000" }, { "tcp_stream": 510, "frame_number": 24879, "display_filter": "frame.number == 24879", "timestamp_epoch": "1583962654.735156000" } ], "is_private": null, "observable_id": "observable-65441b2cb1269de717e2221f", "last_seen_epoch": "1583962654.735156000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962654.673446000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "stats.l.doubleclick.net", "evidence": [ { "udp_stream": 361, "frame_number": 24784, "display_filter": "frame.number == 24784", "timestamp_epoch": "1583962654.705612000" } ], "is_private": null, "observable_id": "observable-a4a888286b45ad81f63afa84", "last_seen_epoch": "1583962654.705612000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962654.705612000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "storage.googleapis.com", "evidence": [ { "udp_stream": 374, "frame_number": 25497, "display_filter": "frame.number == 25497", "timestamp_epoch": "1583962655.838210000" }, { "udp_stream": 374, "frame_number": 25499, "display_filter": "frame.number == 25499", "timestamp_epoch": "1583962655.863798000" }, { "tcp_stream": 519, "frame_number": 25503, "display_filter": "frame.number == 25503", "timestamp_epoch": "1583962655.878836000" } ], "is_private": null, "observable_id": "observable-64a7be359bbfc67d8614c710", "last_seen_epoch": "1583962655.878836000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962655.838210000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "storecatalogrevocation.storequality.microsoft.com", "evidence": [ { "udp_stream": 244, "frame_number": 15562, "display_filter": "frame.number == 15562", "timestamp_epoch": "1583962385.634946000" }, { "udp_stream": 244, "frame_number": 15570, "display_filter": "frame.number == 15570", "timestamp_epoch": "1583962385.661204000" }, { "udp_stream": 244, "frame_number": 15571, "display_filter": "frame.number == 15571", "timestamp_epoch": "1583962385.663937000" }, { "udp_stream": 295, "frame_number": 16522, "display_filter": "frame.number == 16522", "timestamp_epoch": "1583962548.988295000" }, { "udp_stream": 295, "frame_number": 16523, "display_filter": "frame.number == 16523", "timestamp_epoch": "1583962549.014811000" }, { "udp_stream": 295, "frame_number": 16524, "display_filter": "frame.number == 16524", "timestamp_epoch": "1583962549.023492000" }, { "udp_stream": 410, "frame_number": 27476, "display_filter": "frame.number == 27476", "timestamp_epoch": "1583962861.337942000" }, { "udp_stream": 410, "frame_number": 27477, "display_filter": "frame.number == 27477", "timestamp_epoch": "1583962861.365380000" }, { "udp_stream": 410, "frame_number": 27478, "display_filter": "frame.number == 27478", "timestamp_epoch": "1583962861.371315000" }, { "tcp_stream": 402, "frame_number": 15575, "display_filter": "frame.number == 15575", "timestamp_epoch": "1583962385.683749000" }, { "tcp_stream": 421, "frame_number": 16528, "display_filter": "frame.number == 16528", "timestamp_epoch": "1583962549.089942000" }, { "tcp_stream": 569, "frame_number": 27482, "display_filter": "frame.number == 27482", "timestamp_epoch": "1583962861.387323000" } ], "is_private": null, "observable_id": "observable-e31fb5e53e0ba0be343608b7", "last_seen_epoch": "1583962861.387323000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962385.634946000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "sts.eccmp.com", "evidence": [ { "udp_stream": 370, "frame_number": 25223, "display_filter": "frame.number == 25223", "timestamp_epoch": "1583962655.435951000" }, { "udp_stream": 370, "frame_number": 25229, "display_filter": "frame.number == 25229", "timestamp_epoch": "1583962655.466589000" }, { "udp_stream": 370, "frame_number": 25244, "display_filter": "frame.number == 25244", "timestamp_epoch": "1583962655.496790000" }, { "tcp_stream": 514, "frame_number": 25314, "display_filter": "frame.number == 25314", "timestamp_epoch": "1583962655.627441000" }, { "tcp_stream": 529, "frame_number": 25834, "display_filter": "frame.number == 25834", "timestamp_epoch": "1583962656.368355000" } ], "is_private": null, "observable_id": "observable-e3c7e4671c16e822e96abfc1", "last_seen_epoch": "1583962656.368355000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962655.435951000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "syndication.twitter.com", "evidence": [ { "udp_stream": 161, "frame_number": 7057, "display_filter": "frame.number == 7057", "timestamp_epoch": "1583961857.752218000" }, { "udp_stream": 161, "frame_number": 7142, "display_filter": "frame.number == 7142", "timestamp_epoch": "1583961857.789491000" }, { "tcp_stream": 243, "frame_number": 7201, "display_filter": "frame.number == 7201", "timestamp_epoch": "1583961857.859694000" } ], "is_private": null, "observable_id": "observable-7fe7149d0f4dbf7723154cb3", "last_seen_epoch": "1583961857.859694000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961857.752218000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "t-ring.msedge.net", "evidence": [ { "udp_stream": 79, "frame_number": 2338, "display_filter": "frame.number == 2338", "timestamp_epoch": "1583961806.505691000" }, { "udp_stream": 79, "frame_number": 2339, "display_filter": "frame.number == 2339", "timestamp_epoch": "1583961806.506259000" }, { "tcp_stream": 116, "frame_number": 2350, "display_filter": "frame.number == 2350", "timestamp_epoch": "1583961806.556626000" } ], "is_private": null, "observable_id": "observable-d3191cee77eb4577b3eb21e6", "last_seen_epoch": "1583961806.556626000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961806.505691000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "tag.rmp.rakuten.com", "evidence": [ { "udp_stream": 369, "frame_number": 25222, "display_filter": "frame.number == 25222", "timestamp_epoch": "1583962655.435701000" }, { "udp_stream": 369, "frame_number": 25228, "display_filter": "frame.number == 25228", "timestamp_epoch": "1583962655.466524000" }, { "udp_stream": 369, "frame_number": 25241, "display_filter": "frame.number == 25241", "timestamp_epoch": "1583962655.496450000" }, { "tcp_stream": 516, "frame_number": 25272, "display_filter": "frame.number == 25272", "timestamp_epoch": "1583962655.536358000" } ], "is_private": null, "observable_id": "observable-d7035f93d7c06d2520f9c614", "last_seen_epoch": "1583962655.536358000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962655.435701000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "tags-cluster.rd.linksynergy.com", "evidence": [ { "udp_stream": 376, "frame_number": 25538, "display_filter": "frame.number == 25538", "timestamp_epoch": "1583962655.936276000" } ], "is_private": null, "observable_id": "observable-653b03e3ba18826497365c1a", "last_seen_epoch": "1583962655.936276000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962655.936276000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "tags.rd.linksynergy.com", "evidence": [ { "udp_stream": 376, "frame_number": 25508, "display_filter": "frame.number == 25508", "timestamp_epoch": "1583962655.895642000" }, { "udp_stream": 376, "frame_number": 25530, "display_filter": "frame.number == 25530", "timestamp_epoch": "1583962655.921742000" }, { "udp_stream": 376, "frame_number": 25538, "display_filter": "frame.number == 25538", "timestamp_epoch": "1583962655.936276000" }, { "tcp_stream": 521, "frame_number": 25720, "display_filter": "frame.number == 25720", "timestamp_epoch": "1583962656.143263000" } ], "is_private": null, "observable_id": "observable-1d498c6cda32c83396eb1f4d", "last_seen_epoch": "1583962656.143263000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962655.895642000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "tags.tiqcdn.com", "evidence": [ { "udp_stream": 332, "frame_number": 21296, "display_filter": "frame.number == 21296", "timestamp_epoch": "1583962650.959746000" }, { "udp_stream": 332, "frame_number": 21318, "display_filter": "frame.number == 21318", "timestamp_epoch": "1583962650.986719000" }, { "tcp_stream": 480, "frame_number": 21484, "display_filter": "frame.number == 21484", "timestamp_epoch": "1583962651.131970000" }, { "tcp_stream": 480, "frame_number": 21581, "display_filter": "frame.number == 21581", "timestamp_epoch": "1583962651.195962000" } ], "is_private": null, "observable_id": "observable-0d7fc7b741e0a5776667b57e", "last_seen_epoch": "1583962651.195962000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962650.959746000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "tpc.googlesyndication.com", "evidence": [ { "udp_stream": 358, "frame_number": 24519, "display_filter": "frame.number == 24519", "timestamp_epoch": "1583962654.479483000" }, { "udp_stream": 358, "frame_number": 24531, "display_filter": "frame.number == 24531", "timestamp_epoch": "1583962654.503997000" }, { "tcp_stream": 509, "frame_number": 24552, "display_filter": "frame.number == 24552", "timestamp_epoch": "1583962654.542479000" } ], "is_private": null, "observable_id": "observable-8de0f9d7444ec3c9eaa1b63f", "last_seen_epoch": "1583962654.542479000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962654.479483000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "triggeredmail.appspot.com", "evidence": [ { "udp_stream": 367, "frame_number": 25218, "display_filter": "frame.number == 25218", "timestamp_epoch": "1583962655.435019000" }, { "udp_stream": 367, "frame_number": 25226, "display_filter": "frame.number == 25226", "timestamp_epoch": "1583962655.465486000" }, { "udp_stream": 367, "frame_number": 25243, "display_filter": "frame.number == 25243", "timestamp_epoch": "1583962655.496736000" }, { "tcp_stream": 515, "frame_number": 25274, "display_filter": "frame.number == 25274", "timestamp_epoch": "1583962655.536611000" } ], "is_private": null, "observable_id": "observable-0b0dc19a22110f4fa46e222e", "last_seen_epoch": "1583962655.536611000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962655.435019000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "tring.clo.footprintdns.com", "evidence": [ { "udp_stream": 76, "frame_number": 2327, "display_filter": "frame.number == 2327", "timestamp_epoch": "1583961806.401801000" }, { "udp_stream": 76, "frame_number": 2329, "display_filter": "frame.number == 2329", "timestamp_epoch": "1583961806.431111000" }, { "tcp_stream": 114, "frame_number": 2352, "display_filter": "frame.number == 2352", "timestamp_epoch": "1583961806.556962000" } ], "is_private": null, "observable_id": "observable-ef8f5fd8f7f1f51288181c65", "last_seen_epoch": "1583961806.556962000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961806.401801000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "tuscaloosabarnyard.com", "evidence": [ { "udp_stream": 136, "frame_number": 4348, "display_filter": "frame.number == 4348", "timestamp_epoch": "1583961854.572439000" }, { "udp_stream": 326, "frame_number": 21211, "display_filter": "frame.number == 21211", "timestamp_epoch": "1583962650.607967000" } ], "is_private": null, "observable_id": "observable-4e21eeb94c49dfb824ea3611", "last_seen_epoch": "1583962650.607967000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961854.572439000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "twitter.com", "evidence": [ { "udp_stream": 157, "frame_number": 6002, "display_filter": "frame.number == 6002", "timestamp_epoch": "1583961857.008064000" }, { "udp_stream": 157, "frame_number": 6018, "display_filter": "frame.number == 6018", "timestamp_epoch": "1583961857.057731000" } ], "is_private": null, "observable_id": "observable-5053a6ad945b2b10a724cc74", "last_seen_epoch": "1583961857.057731000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961857.008064000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "ukrtzhmkwhgj.mondogreek.com", "evidence": [ { "udp_stream": 163, "frame_number": 7318, "display_filter": "frame.number == 7318", "timestamp_epoch": "1583961858.377972000" }, { "udp_stream": 163, "frame_number": 7320, "display_filter": "frame.number == 7320", "timestamp_epoch": "1583961858.378172000" } ], "is_private": null, "observable_id": "observable-a002cc24dec2affa37d78150", "last_seen_epoch": "1583961858.378172000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961858.377972000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "umwatson.trafficmanager.net", "evidence": [ { "udp_stream": 405, "frame_number": 26766, "display_filter": "frame.number == 26766", "timestamp_epoch": "1583962684.331866000" } ], "is_private": null, "observable_id": "observable-38d6b80c8108d3d8ba79c812", "last_seen_epoch": "1583962684.331866000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962684.331866000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "ups.analytics.yahoo.com", "evidence": [ { "udp_stream": 398, "frame_number": 26390, "display_filter": "frame.number == 26390", "timestamp_epoch": "1583962657.753969000" }, { "udp_stream": 398, "frame_number": 26391, "display_filter": "frame.number == 26391", "timestamp_epoch": "1583962657.784497000" }, { "udp_stream": 398, "frame_number": 26392, "display_filter": "frame.number == 26392", "timestamp_epoch": "1583962657.788154000" }, { "tcp_stream": 548, "frame_number": 26406, "display_filter": "frame.number == 26406", "timestamp_epoch": "1583962657.853227000" } ], "is_private": null, "observable_id": "observable-fac1c2b06e08a83d5bf0284d", "last_seen_epoch": "1583962657.853227000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962657.753969000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "ut.ra.linksynergy.com", "evidence": [ { "udp_stream": 375, "frame_number": 25507, "display_filter": "frame.number == 25507", "timestamp_epoch": "1583962655.894777000" }, { "udp_stream": 375, "frame_number": 25531, "display_filter": "frame.number == 25531", "timestamp_epoch": "1583962655.921875000" }, { "udp_stream": 375, "frame_number": 25539, "display_filter": "frame.number == 25539", "timestamp_epoch": "1583962655.936347000" }, { "tcp_stream": 522, "frame_number": 25561, "display_filter": "frame.number == 25561", "timestamp_epoch": "1583962655.959746000" } ], "is_private": null, "observable_id": "observable-6bfaab96e21ec0eabfeac952", "last_seen_epoch": "1583962655.959746000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962655.894777000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "v1.addthisedge.com", "evidence": [ { "udp_stream": 151, "frame_number": 4926, "display_filter": "frame.number == 4926", "timestamp_epoch": "1583961856.053988000" }, { "udp_stream": 151, "frame_number": 5227, "display_filter": "frame.number == 5227", "timestamp_epoch": "1583961856.360811000" }, { "udp_stream": 324, "frame_number": 21190, "display_filter": "frame.number == 21190", "timestamp_epoch": "1583962650.507885000" }, { "udp_stream": 324, "frame_number": 21198, "display_filter": "frame.number == 21198", "timestamp_epoch": "1583962650.538697000" }, { "udp_stream": 324, "frame_number": 21204, "display_filter": "frame.number == 21204", "timestamp_epoch": "1583962650.557545000" } ], "is_private": null, "observable_id": "observable-baf4f7f263ee4cd5141024fa", "last_seen_epoch": "1583962650.557545000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961856.053988000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "vbwxoaflt.mondogreek.com", "evidence": [ { "udp_stream": 164, "frame_number": 7319, "display_filter": "frame.number == 7319", "timestamp_epoch": "1583961858.378167000" }, { "udp_stream": 164, "frame_number": 7322, "display_filter": "frame.number == 7322", "timestamp_epoch": "1583961858.378408000" } ], "is_private": null, "observable_id": "observable-390a43172c93fca895b0c134", "last_seen_epoch": "1583961858.378408000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961858.378167000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "vzxmvhjnnsazsyw.mondogreek.com", "evidence": [ { "udp_stream": 50, "frame_number": 1272, "display_filter": "frame.number == 1272", "timestamp_epoch": "1583961781.432375000" }, { "udp_stream": 50, "frame_number": 1273, "display_filter": "frame.number == 1273", "timestamp_epoch": "1583961781.432752000" } ], "is_private": null, "observable_id": "observable-ffd616a26c7fc85d83a1aa3d", "last_seen_epoch": "1583961781.432752000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961781.432375000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "watson.telemetry.microsoft.com", "evidence": [ { "udp_stream": 405, "frame_number": 26765, "display_filter": "frame.number == 26765", "timestamp_epoch": "1583962684.318184000" }, { "udp_stream": 405, "frame_number": 26766, "display_filter": "frame.number == 26766", "timestamp_epoch": "1583962684.331866000" }, { "tcp_stream": 558, "frame_number": 26770, "display_filter": "frame.number == 26770", "timestamp_epoch": "1583962684.378942000" } ], "is_private": null, "observable_id": "observable-ac8a46d2072ba16f426284ef", "last_seen_epoch": "1583962684.378942000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962684.318184000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "web.vortex.data.microsoft.com", "evidence": [ { "udp_stream": 205, "frame_number": 12903, "display_filter": "frame.number == 12903", "timestamp_epoch": "1583962015.841022000" }, { "udp_stream": 205, "frame_number": 12946, "display_filter": "frame.number == 12946", "timestamp_epoch": "1583962015.928169000" }, { "tcp_stream": 341, "frame_number": 12979, "display_filter": "frame.number == 12979", "timestamp_epoch": "1583962016.009136000" }, { "tcp_stream": 337, "frame_number": 12981, "display_filter": "frame.number == 12981", "timestamp_epoch": "1583962016.009516000" }, { "tcp_stream": 338, "frame_number": 12983, "display_filter": "frame.number == 12983", "timestamp_epoch": "1583962016.009694000" }, { "tcp_stream": 340, "frame_number": 12985, "display_filter": "frame.number == 12985", "timestamp_epoch": "1583962016.009868000" }, { "tcp_stream": 339, "frame_number": 12987, "display_filter": "frame.number == 12987", "timestamp_epoch": "1583962016.010114000" }, { "tcp_stream": 336, "frame_number": 12989, "display_filter": "frame.number == 12989", "timestamp_epoch": "1583962016.010255000" } ], "is_private": null, "observable_id": "observable-ce410ff47637cec445bf130f", "last_seen_epoch": "1583962016.010255000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962015.841022000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "wpad.mondogreek.com", "evidence": [ { "udp_stream": 29, "frame_number": 1045, "display_filter": "frame.number == 1045", "timestamp_epoch": "1583961769.278542000" }, { "udp_stream": 29, "frame_number": 1046, "display_filter": "frame.number == 1046", "timestamp_epoch": "1583961769.280053000" }, { "udp_stream": 37, "frame_number": 1081, "display_filter": "frame.number == 1081", "timestamp_epoch": "1583961780.297336000" }, { "udp_stream": 37, "frame_number": 1082, "display_filter": "frame.number == 1082", "timestamp_epoch": "1583961780.297613000" }, { "udp_stream": 70, "frame_number": 2058, "display_filter": "frame.number == 2058", "timestamp_epoch": "1583961795.313560000" }, { "udp_stream": 70, "frame_number": 2059, "display_filter": "frame.number == 2059", "timestamp_epoch": "1583961795.313901000" }, { "udp_stream": 85, "frame_number": 2499, "display_filter": "frame.number == 2499", "timestamp_epoch": "1583961811.509917000" }, { "udp_stream": 85, "frame_number": 2500, "display_filter": "frame.number == 2500", "timestamp_epoch": "1583961811.510192000" }, { "udp_stream": 119, "frame_number": 3763, "display_filter": "frame.number == 3763", "timestamp_epoch": "1583961826.576626000" }, { "udp_stream": 119, "frame_number": 3764, "display_filter": "frame.number == 3764", "timestamp_epoch": "1583961826.576920000" }, { "udp_stream": 120, "frame_number": 3767, "display_filter": "frame.number == 3767", "timestamp_epoch": "1583961829.279283000" }, { "udp_stream": 120, "frame_number": 3768, "display_filter": "frame.number == 3768", "timestamp_epoch": "1583961829.279628000" }, { "udp_stream": 133, "frame_number": 4315, "display_filter": "frame.number == 4315", "timestamp_epoch": "1583961853.498551000" }, { "udp_stream": 133, "frame_number": 4316, "display_filter": "frame.number == 4316", "timestamp_epoch": "1583961853.498879000" }, { "udp_stream": 147, "frame_number": 4809, "display_filter": "frame.number == 4809", "timestamp_epoch": "1583961855.330328000" }, { "udp_stream": 147, "frame_number": 4810, "display_filter": "frame.number == 4810", "timestamp_epoch": "1583961855.330672000" }, { "udp_stream": 169, "frame_number": 7698, "display_filter": "frame.number == 7698", "timestamp_epoch": "1583961862.500514000" }, { "udp_stream": 169, "frame_number": 7699, "display_filter": "frame.number == 7699", "timestamp_epoch": "1583961862.500827000" }, { "udp_stream": 171, "frame_number": 7703, "display_filter": "frame.number == 7703", "timestamp_epoch": "1583961862.503247000" }, { "udp_stream": 171, "frame_number": 7704, "display_filter": "frame.number == 7704", "timestamp_epoch": "1583961862.503491000" } ], "is_private": null, "observable_id": "observable-467d2539f56dab43ccb36218", "last_seen_epoch": "1583964312.292695000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961769.278542000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "ww.steelhousemedia.com", "evidence": [ { "udp_stream": 400, "frame_number": 26454, "display_filter": "frame.number == 26454", "timestamp_epoch": "1583962659.156343000" }, { "udp_stream": 400, "frame_number": 26455, "display_filter": "frame.number == 26455", "timestamp_epoch": "1583962659.187302000" }, { "udp_stream": 400, "frame_number": 26458, "display_filter": "frame.number == 26458", "timestamp_epoch": "1583962660.218284000" }, { "udp_stream": 400, "frame_number": 26599, "display_filter": "frame.number == 26599", "timestamp_epoch": "1583962662.232347000" }, { "udp_stream": 400, "frame_number": 26616, "display_filter": "frame.number == 26616", "timestamp_epoch": "1583962663.610644000" }, { "tcp_stream": 554, "frame_number": 26620, "display_filter": "frame.number == 26620", "timestamp_epoch": "1583962663.632257000" } ], "is_private": null, "observable_id": "observable-e1bab2915e68e6406b3144eb", "last_seen_epoch": "1583962663.632257000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962659.156343000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "www-google-analytics.l.google.com", "evidence": [ { "udp_stream": 158, "frame_number": 6019, "display_filter": "frame.number == 6019", "timestamp_epoch": "1583961857.067951000" }, { "udp_stream": 359, "frame_number": 24672, "display_filter": "frame.number == 24672", "timestamp_epoch": "1583962654.604448000" } ], "is_private": null, "observable_id": "observable-efaf809fde38ece4cbac7d86", "last_seen_epoch": "1583962654.604448000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961857.067951000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "www-googletagmanager.l.google.com", "evidence": [ { "udp_stream": 368, "frame_number": 25254, "display_filter": "frame.number == 25254", "timestamp_epoch": "1583962655.506747000" } ], "is_private": null, "observable_id": "observable-b34036b6c06367a28b7e1659", "last_seen_epoch": "1583962655.506747000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962655.506747000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "www.addthis.com", "evidence": [ { "udp_stream": 153, "frame_number": 5936, "display_filter": "frame.number == 5936", "timestamp_epoch": "1583961856.850533000" }, { "udp_stream": 153, "frame_number": 5937, "display_filter": "frame.number == 5937", "timestamp_epoch": "1583961856.889136000" } ], "is_private": null, "observable_id": "observable-d5b15b5dd997b374ea204004", "last_seen_epoch": "1583961856.889136000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961856.850533000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "www.bing.com", "evidence": [ { "udp_stream": 59, "frame_number": 1801, "display_filter": "frame.number == 1801", "timestamp_epoch": "1583961788.617428000" }, { "udp_stream": 59, "frame_number": 1802, "display_filter": "frame.number == 1802", "timestamp_epoch": "1583961788.662452000" }, { "udp_stream": 73, "frame_number": 2280, "display_filter": "frame.number == 2280", "timestamp_epoch": "1583961806.049201000" }, { "udp_stream": 73, "frame_number": 2281, "display_filter": "frame.number == 2281", "timestamp_epoch": "1583961806.049603000" }, { "udp_stream": 122, "frame_number": 3979, "display_filter": "frame.number == 3979", "timestamp_epoch": "1583961832.890108000" }, { "udp_stream": 122, "frame_number": 3980, "display_filter": "frame.number == 3980", "timestamp_epoch": "1583961832.907313000" }, { "udp_stream": 124, "frame_number": 4037, "display_filter": "frame.number == 4037", "timestamp_epoch": "1583961837.107429000" }, { "udp_stream": 124, "frame_number": 4038, "display_filter": "frame.number == 4038", "timestamp_epoch": "1583961837.107859000" }, { "udp_stream": 130, "frame_number": 4256, "display_filter": "frame.number == 4256", "timestamp_epoch": "1583961848.516411000" }, { "udp_stream": 130, "frame_number": 4257, "display_filter": "frame.number == 4257", "timestamp_epoch": "1583961848.562517000" }, { "udp_stream": 200, "frame_number": 12476, "display_filter": "frame.number == 12476", "timestamp_epoch": "1583962013.755011000" }, { "udp_stream": 200, "frame_number": 12478, "display_filter": "frame.number == 12478", "timestamp_epoch": "1583962013.872576000" }, { "udp_stream": 212, "frame_number": 14087, "display_filter": "frame.number == 14087", "timestamp_epoch": "1583962054.667278000" }, { "udp_stream": 212, "frame_number": 14092, "display_filter": "frame.number == 14092", "timestamp_epoch": "1583962054.684480000" }, { "udp_stream": 294, "frame_number": 16487, "display_filter": "frame.number == 16487", "timestamp_epoch": "1583962547.110221000" }, { "udp_stream": 294, "frame_number": 16488, "display_filter": "frame.number == 16488", "timestamp_epoch": "1583962547.138635000" }, { "udp_stream": 294, "frame_number": 16489, "display_filter": "frame.number == 16489", "timestamp_epoch": "1583962547.149148000" }, { "tcp_stream": 88, "frame_number": 1808, "display_filter": "frame.number == 1808", "timestamp_epoch": "1583961788.875575000" }, { "tcp_stream": 111, "frame_number": 2285, "display_filter": "frame.number == 2285", "timestamp_epoch": "1583961806.201646000" }, { "tcp_stream": 187, "frame_number": 3984, "display_filter": "frame.number == 3984", "timestamp_epoch": "1583961832.930417000" } ], "is_private": null, "observable_id": "observable-50872cad0c040b00ae9fbfdf", "last_seen_epoch": "1583963186.465756000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961788.617428000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "www.combsscreenprinting.com", "evidence": [ { "udp_stream": 148, "frame_number": 4876, "display_filter": "frame.number == 4876", "timestamp_epoch": "1583961855.929704000" }, { "udp_stream": 148, "frame_number": 4916, "display_filter": "frame.number == 4916", "timestamp_epoch": "1583961856.009855000" } ], "is_private": null, "observable_id": "observable-b50cbaab6e81e18eea5a3edc", "last_seen_epoch": "1583961856.009855000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961855.929704000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "www.facebook.com", "evidence": [ { "udp_stream": 154, "frame_number": 5938, "display_filter": "frame.number == 5938", "timestamp_epoch": "1583961856.893298000" }, { "udp_stream": 154, "frame_number": 5984, "display_filter": "frame.number == 5984", "timestamp_epoch": "1583961856.929561000" }, { "udp_stream": 325, "frame_number": 21191, "display_filter": "frame.number == 21191", "timestamp_epoch": "1583962650.509056000" }, { "udp_stream": 325, "frame_number": 21199, "display_filter": "frame.number == 21199", "timestamp_epoch": "1583962650.539670000" }, { "udp_stream": 325, "frame_number": 21205, "display_filter": "frame.number == 21205", "timestamp_epoch": "1583962650.557596000" }, { "tcp_stream": 244, "frame_number": 7216, "display_filter": "frame.number == 7216", "timestamp_epoch": "1583961858.018771000" }, { "tcp_stream": 245, "frame_number": 7229, "display_filter": "frame.number == 7229", "timestamp_epoch": "1583961858.043596000" }, { "tcp_stream": 530, "frame_number": 25891, "display_filter": "frame.number == 25891", "timestamp_epoch": "1583962656.695963000" } ], "is_private": null, "observable_id": "observable-7b4d7b0c039fda8ae0d04ddd", "last_seen_epoch": "1583962656.695963000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961856.893298000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "www.godaddy.com", "evidence": [ { "udp_stream": 149, "frame_number": 4877, "display_filter": "frame.number == 4877", "timestamp_epoch": "1583961855.929844000" }, { "udp_stream": 149, "frame_number": 4886, "display_filter": "frame.number == 4886", "timestamp_epoch": "1583961855.968427000" } ], "is_private": null, "observable_id": "observable-0a308ab2ef090dce83d0d24e", "last_seen_epoch": "1583961855.968427000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961855.929844000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "www.google-analytics.com", "evidence": [ { "udp_stream": 158, "frame_number": 6003, "display_filter": "frame.number == 6003", "timestamp_epoch": "1583961857.015931000" }, { "udp_stream": 158, "frame_number": 6019, "display_filter": "frame.number == 6019", "timestamp_epoch": "1583961857.067951000" }, { "udp_stream": 359, "frame_number": 24663, "display_filter": "frame.number == 24663", "timestamp_epoch": "1583962654.581676000" }, { "udp_stream": 359, "frame_number": 24672, "display_filter": "frame.number == 24672", "timestamp_epoch": "1583962654.604448000" }, { "tcp_stream": 235, "frame_number": 6025, "display_filter": "frame.number == 6025", "timestamp_epoch": "1583961857.085776000" } ], "is_private": null, "observable_id": "observable-ebe0d28c238f30aa8d61f8e4", "last_seen_epoch": "1583962654.604448000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961857.015931000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "www.google.com", "evidence": [ { "udp_stream": 353, "frame_number": 24218, "display_filter": "frame.number == 24218", "timestamp_epoch": "1583962653.093030000" }, { "udp_stream": 353, "frame_number": 24223, "display_filter": "frame.number == 24223", "timestamp_epoch": "1583962653.124048000" }, { "udp_stream": 353, "frame_number": 24231, "display_filter": "frame.number == 24231", "timestamp_epoch": "1583962653.141149000" }, { "tcp_stream": 503, "frame_number": 24246, "display_filter": "frame.number == 24246", "timestamp_epoch": "1583962653.172191000" } ], "is_private": null, "observable_id": "observable-0980945d83b8ccd680c78656", "last_seen_epoch": "1583962653.172191000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962653.093030000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "www.googleadservices.com", "evidence": [ { "udp_stream": 365, "frame_number": 25141, "display_filter": "frame.number == 25141", "timestamp_epoch": "1583962655.316585000" }, { "udp_stream": 365, "frame_number": 25148, "display_filter": "frame.number == 25148", "timestamp_epoch": "1583962655.347719000" }, { "tcp_stream": 512, "frame_number": 25183, "display_filter": "frame.number == 25183", "timestamp_epoch": "1583962655.369994000" } ], "is_private": null, "observable_id": "observable-9ec6b47445a6b5af55b1ada4", "last_seen_epoch": "1583962655.369994000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962655.316585000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "www.googlecommerce.com", "evidence": [ { "udp_stream": 351, "frame_number": 24051, "display_filter": "frame.number == 24051", "timestamp_epoch": "1583962652.857426000" }, { "udp_stream": 351, "frame_number": 24062, "display_filter": "frame.number == 24062", "timestamp_epoch": "1583962652.888732000" }, { "udp_stream": 351, "frame_number": 24065, "display_filter": "frame.number == 24065", "timestamp_epoch": "1583962652.905991000" }, { "tcp_stream": 500, "frame_number": 24112, "display_filter": "frame.number == 24112", "timestamp_epoch": "1583962652.935543000" } ], "is_private": null, "observable_id": "observable-15d6f68e977e647646f4a81c", "last_seen_epoch": "1583962652.935543000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962652.857426000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "www.googletagmanager.com", "evidence": [ { "udp_stream": 368, "frame_number": 25221, "display_filter": "frame.number == 25221", "timestamp_epoch": "1583962655.435607000" }, { "udp_stream": 368, "frame_number": 25227, "display_filter": "frame.number == 25227", "timestamp_epoch": "1583962655.466445000" }, { "udp_stream": 368, "frame_number": 25254, "display_filter": "frame.number == 25254", "timestamp_epoch": "1583962655.506747000" }, { "tcp_stream": 518, "frame_number": 25260, "display_filter": "frame.number == 25260", "timestamp_epoch": "1583962655.526230000" } ], "is_private": null, "observable_id": "observable-4906dac44b74bdf6f27705b0", "last_seen_epoch": "1583962655.526230000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962655.435607000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "www.googletagservices.com", "evidence": [ { "udp_stream": 352, "frame_number": 24058, "display_filter": "frame.number == 24058", "timestamp_epoch": "1583962652.858903000" }, { "udp_stream": 352, "frame_number": 24063, "display_filter": "frame.number == 24063", "timestamp_epoch": "1583962652.890727000" }, { "udp_stream": 352, "frame_number": 24064, "display_filter": "frame.number == 24064", "timestamp_epoch": "1583962652.905894000" }, { "tcp_stream": 499, "frame_number": 24114, "display_filter": "frame.number == 24114", "timestamp_epoch": "1583962652.936184000" } ], "is_private": null, "observable_id": "observable-cdf8bb11ffdda0ce0ac371e6", "last_seen_epoch": "1583962652.936184000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962652.858903000" }, { "type": "domain", "roles": [ "dns-query", "http-host", "tls-sni" ], "value": "www.newegg.com", "evidence": [ { "udp_stream": 323, "frame_number": 21179, "display_filter": "frame.number == 21179", "timestamp_epoch": "1583962650.483652000" }, { "udp_stream": 323, "frame_number": 21192, "display_filter": "frame.number == 21192", "timestamp_epoch": "1583962650.514704000" }, { "udp_stream": 323, "frame_number": 21195, "display_filter": "frame.number == 21195", "timestamp_epoch": "1583962650.527591000" }, { "tcp_stream": 469, "frame_number": 21202, "display_filter": "frame.number == 21202", "timestamp_epoch": "1583962650.547673000" }, { "tcp_stream": 470, "frame_number": 21215, "display_filter": "frame.number == 21215", "timestamp_epoch": "1583962650.619185000" } ], "is_private": null, "observable_id": "observable-843a66126bea490f84cc9e69", "last_seen_epoch": "1583962650.619185000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962650.483652000" }, { "type": "domain", "roles": [ "dns-query", "http-host" ], "value": "www.notable-quotes.com", "evidence": [ { "udp_stream": 209, "frame_number": 13333, "display_filter": "frame.number == 13333", "timestamp_epoch": "1583962027.448432000" }, { "udp_stream": 209, "frame_number": 13391, "display_filter": "frame.number == 13391", "timestamp_epoch": "1583962027.518423000" }, { "tcp_stream": 352, "frame_number": 13467, "display_filter": "frame.number == 13467", "timestamp_epoch": "1583962027.570033000" }, { "tcp_stream": 353, "frame_number": 13468, "display_filter": "frame.number == 13468", "timestamp_epoch": "1583962027.570077000" }, { "tcp_stream": 355, "frame_number": 13473, "display_filter": "frame.number == 13473", "timestamp_epoch": "1583962027.570585000" }, { "tcp_stream": 354, "frame_number": 13477, "display_filter": "frame.number == 13477", "timestamp_epoch": "1583962027.572340000" } ], "is_private": null, "observable_id": "observable-0fa85407bdf872ba691e1fe0", "last_seen_epoch": "1583962027.572340000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962027.448432000" }, { "type": "domain", "roles": [ "dns-query", "http-host" ], "value": "www.tuscaloosabarnyard.com", "evidence": [ { "udp_stream": 136, "frame_number": 4338, "display_filter": "frame.number == 4338", "timestamp_epoch": "1583961854.498926000" }, { "udp_stream": 136, "frame_number": 4348, "display_filter": "frame.number == 4348", "timestamp_epoch": "1583961854.572439000" }, { "udp_stream": 326, "frame_number": 21197, "display_filter": "frame.number == 21197", "timestamp_epoch": "1583962650.530170000" }, { "udp_stream": 326, "frame_number": 21207, "display_filter": "frame.number == 21207", "timestamp_epoch": "1583962650.560528000" }, { "udp_stream": 326, "frame_number": 21211, "display_filter": "frame.number == 21211", "timestamp_epoch": "1583962650.607967000" }, { "tcp_stream": 200, "frame_number": 4366, "display_filter": "frame.number == 4366", "timestamp_epoch": "1583961854.645117000" }, { "tcp_stream": 200, "frame_number": 4398, "display_filter": "frame.number == 4398", "timestamp_epoch": "1583961854.770626000" }, { "tcp_stream": 200, "frame_number": 7675, "display_filter": "frame.number == 7675", "timestamp_epoch": "1583961859.573307000" } ], "is_private": null, "observable_id": "observable-bd6db84d320ff7bc2704ebaa", "last_seen_epoch": "1583962650.607967000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961854.498926000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "www2.newegg.com", "evidence": [ { "udp_stream": 341, "frame_number": 21520, "display_filter": "frame.number == 21520", "timestamp_epoch": "1583962651.150243000" }, { "udp_stream": 341, "frame_number": 21564, "display_filter": "frame.number == 21564", "timestamp_epoch": "1583962651.182553000" }, { "udp_stream": 341, "frame_number": 21634, "display_filter": "frame.number == 21634", "timestamp_epoch": "1583962651.199027000" }, { "tcp_stream": 490, "frame_number": 21711, "display_filter": "frame.number == 21711", "timestamp_epoch": "1583962651.228233000" } ], "is_private": null, "observable_id": "observable-800538bf25c0941c1eb453f0", "last_seen_epoch": "1583962651.228233000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962651.150243000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "www3.l.google.com", "evidence": [ { "udp_stream": 351, "frame_number": 24065, "display_filter": "frame.number == 24065", "timestamp_epoch": "1583962652.905991000" } ], "is_private": null, "observable_id": "observable-117eb10a51866a3788ab1f48", "last_seen_epoch": "1583962652.905991000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962652.905991000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "z.moatads.com", "evidence": [ { "udp_stream": 150, "frame_number": 4925, "display_filter": "frame.number == 4925", "timestamp_epoch": "1583961856.052929000" }, { "udp_stream": 150, "frame_number": 5207, "display_filter": "frame.number == 5207", "timestamp_epoch": "1583961856.360480000" }, { "udp_stream": 327, "frame_number": 21206, "display_filter": "frame.number == 21206", "timestamp_epoch": "1583962650.558947000" }, { "udp_stream": 327, "frame_number": 21210, "display_filter": "frame.number == 21210", "timestamp_epoch": "1583962650.589603000" }, { "udp_stream": 327, "frame_number": 21212, "display_filter": "frame.number == 21212", "timestamp_epoch": "1583962650.608017000" }, { "tcp_stream": 230, "frame_number": 5257, "display_filter": "frame.number == 5257", "timestamp_epoch": "1583961856.395511000" } ], "is_private": null, "observable_id": "observable-7f46c44c24a87d120d8303da", "last_seen_epoch": "1583962650.608017000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961856.052929000" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "10.3.11.1", "evidence": [], "is_private": true, "observable_id": "observable-2202b35c8996a9198d34f292", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "10.3.11.119", "evidence": [ { "udp_stream": 104, "frame_number": 3015, "display_filter": "frame.number == 3015", "timestamp_epoch": "1583961815.424012000" }, { "udp_stream": 104, "frame_number": 3016, "display_filter": "frame.number == 3016", "timestamp_epoch": "1583961815.424999000" }, { "udp_stream": 260, "frame_number": 16090, "display_filter": "frame.number == 16090", "timestamp_epoch": "1583962433.391674000" }, { "udp_stream": 260, "frame_number": 16091, "display_filter": "frame.number == 16091", "timestamp_epoch": "1583962433.392824000" }, { "udp_stream": 307, "frame_number": 21071, "display_filter": "frame.number == 21071", "timestamp_epoch": "1583962637.221413000" } ], "is_private": true, "observable_id": "observable-25a92627e0dfdfedee87dd98", "last_seen_epoch": "1583962637.221413000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961815.424012000" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "10.3.11.131", "evidence": [], "is_private": true, "observable_id": "observable-8c7fd78400f752fe84f19111", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "10.3.11.194", "evidence": [ { "udp_stream": 57, "frame_number": 1790, "display_filter": "frame.number == 1790", "timestamp_epoch": "1583961783.985573000" }, { "udp_stream": 57, "frame_number": 1791, "display_filter": "frame.number == 1791", "timestamp_epoch": "1583961783.986755000" }, { "udp_stream": 288, "frame_number": 16354, "display_filter": "frame.number == 16354", "timestamp_epoch": "1583962544.995048000" }, { "udp_stream": 288, "frame_number": 16355, "display_filter": "frame.number == 16355", "timestamp_epoch": "1583962544.995990000" } ], "is_private": true, "observable_id": "observable-45e7be6ae3bf86d13ae4e06f", "last_seen_epoch": "1583962544.995990000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961783.985573000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "10.3.11.218", "evidence": [ { "udp_stream": 17, "frame_number": 547, "display_filter": "frame.number == 547", "timestamp_epoch": "1583961758.340596000" }, { "udp_stream": 17, "frame_number": 548, "display_filter": "frame.number == 548", "timestamp_epoch": "1583961758.341657000" }, { "udp_stream": 250, "frame_number": 15661, "display_filter": "frame.number == 15661", "timestamp_epoch": "1583962386.750583000" }, { "udp_stream": 250, "frame_number": 15662, "display_filter": "frame.number == 15662", "timestamp_epoch": "1583962386.751686000" }, { "udp_stream": 306, "frame_number": 21064, "display_filter": "frame.number == 21064", "timestamp_epoch": "1583962637.217396000" } ], "is_private": true, "observable_id": "observable-2b97a200053629ca971f1687", "last_seen_epoch": "1583962637.217396000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961758.340596000" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "10.3.11.254", "evidence": [], "is_private": true, "observable_id": "observable-cedba38eb57ecca1b452748b", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "10.3.11.255", "evidence": [], "is_private": true, "observable_id": "observable-8b13c4331f13211f3aebb4bd", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "10.3.11.3", "evidence": [ { "udp_stream": 1, "frame_number": 4, "display_filter": "frame.number == 4", "timestamp_epoch": "1583961755.129096000" }, { "udp_stream": 6, "frame_number": 97, "display_filter": "frame.number == 97", "timestamp_epoch": "1583961755.517270000" }, { "udp_stream": 8, "frame_number": 216, "display_filter": "frame.number == 216", "timestamp_epoch": "1583961755.709448000" }, { "udp_stream": 10, "frame_number": 269, "display_filter": "frame.number == 269", "timestamp_epoch": "1583961755.887604000" }, { "udp_stream": 13, "frame_number": 320, "display_filter": "frame.number == 320", "timestamp_epoch": "1583961756.220052000" }, { "udp_stream": 16, "frame_number": 546, "display_filter": "frame.number == 546", "timestamp_epoch": "1583961758.338153000" }, { "udp_stream": 18, "frame_number": 550, "display_filter": "frame.number == 550", "timestamp_epoch": "1583961758.356527000" }, { "udp_stream": 33, "frame_number": 1067, "display_filter": "frame.number == 1067", "timestamp_epoch": "1583961779.625644000" }, { "udp_stream": 34, "frame_number": 1069, "display_filter": "frame.number == 1069", "timestamp_epoch": "1583961779.658607000" }, { "udp_stream": 41, "frame_number": 1093, "display_filter": "frame.number == 1093", "timestamp_epoch": "1583961780.815765000" }, { "udp_stream": 45, "frame_number": 1101, "display_filter": "frame.number == 1101", "timestamp_epoch": "1583961781.054298000" }, { "udp_stream": 47, "frame_number": 1252, "display_filter": "frame.number == 1252", "timestamp_epoch": "1583961781.271226000" }, { "udp_stream": 49, "frame_number": 1271, "display_filter": "frame.number == 1271", "timestamp_epoch": "1583961781.422599000" }, { "udp_stream": 52, "frame_number": 1333, "display_filter": "frame.number == 1333", "timestamp_epoch": "1583961781.592936000" }, { "udp_stream": 54, "frame_number": 1379, "display_filter": "frame.number == 1379", "timestamp_epoch": "1583961781.878882000" }, { "udp_stream": 55, "frame_number": 1621, "display_filter": "frame.number == 1621", "timestamp_epoch": "1583961783.464014000" }, { "udp_stream": 56, "frame_number": 1789, "display_filter": "frame.number == 1789", "timestamp_epoch": "1583961783.982972000" }, { "udp_stream": 72, "frame_number": 2131, "display_filter": "frame.number == 2131", "timestamp_epoch": "1583961800.971143000" }, { "udp_stream": 81, "frame_number": 2485, "display_filter": "frame.number == 2485", "timestamp_epoch": "1583961810.892861000" }, { "udp_stream": 82, "frame_number": 2487, "display_filter": "frame.number == 2487", "timestamp_epoch": "1583961810.919308000" } ], "is_private": true, "observable_id": "observable-1c0d865670c404c14bcc2e04", "last_seen_epoch": "1583962637.214931000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961755.129096000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "104.105.248.178", "evidence": [ { "udp_stream": 320, "frame_number": 21185, "display_filter": "frame.number == 21185", "timestamp_epoch": "1583962650.504416000" } ], "is_private": false, "observable_id": "observable-c6a52b2cb59bc84f03f15d95", "last_seen_epoch": "1583962650.504416000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962650.504416000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "104.117.242.71", "evidence": [ { "udp_stream": 335, "frame_number": 21451, "display_filter": "frame.number == 21451", "timestamp_epoch": "1583962651.128381000" }, { "udp_stream": 346, "frame_number": 23655, "display_filter": "frame.number == 23655", "timestamp_epoch": "1583962652.135603000" } ], "is_private": false, "observable_id": "observable-36e9f1ae7e993c5b2c376995", "last_seen_epoch": "1583962652.135603000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962651.128381000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "104.244.42.1", "evidence": [ { "udp_stream": 157, "frame_number": 6018, "display_filter": "frame.number == 6018", "timestamp_epoch": "1583961857.057731000" } ], "is_private": false, "observable_id": "observable-e67da5ddc7b420515bdd215f", "last_seen_epoch": "1583961857.057731000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961857.057731000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "104.244.42.129", "evidence": [ { "udp_stream": 157, "frame_number": 6018, "display_filter": "frame.number == 6018", "timestamp_epoch": "1583961857.057731000" } ], "is_private": false, "observable_id": "observable-51dd877850ef2335c2ba9b99", "last_seen_epoch": "1583961857.057731000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961857.057731000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "104.244.42.136", "evidence": [ { "udp_stream": 161, "frame_number": 7142, "display_filter": "frame.number == 7142", "timestamp_epoch": "1583961857.789491000" } ], "is_private": false, "observable_id": "observable-3abfaf7e6c56d4397213f728", "last_seen_epoch": "1583961857.789491000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961857.789491000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "104.244.42.200", "evidence": [ { "udp_stream": 161, "frame_number": 7142, "display_filter": "frame.number == 7142", "timestamp_epoch": "1583961857.789491000" } ], "is_private": false, "observable_id": "observable-3059659c693dae3cfefab1f0", "last_seen_epoch": "1583961857.789491000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961857.789491000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "104.244.42.72", "evidence": [ { "udp_stream": 161, "frame_number": 7142, "display_filter": "frame.number == 7142", "timestamp_epoch": "1583961857.789491000" } ], "is_private": false, "observable_id": "observable-30c984aa70aa0afb021463e6", "last_seen_epoch": "1583961857.789491000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961857.789491000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "104.244.42.8", "evidence": [ { "udp_stream": 161, "frame_number": 7142, "display_filter": "frame.number == 7142", "timestamp_epoch": "1583961857.789491000" } ], "is_private": false, "observable_id": "observable-8490263f7d35ab90f92fe084", "last_seen_epoch": "1583961857.789491000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961857.789491000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "104.254.148.133", "evidence": [ { "udp_stream": 391, "frame_number": 26083, "display_filter": "frame.number == 26083", "timestamp_epoch": "1583962657.125928000" } ], "is_private": false, "observable_id": "observable-6416a8040e396afc73fdf5fd", "last_seen_epoch": "1583962657.125928000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962657.125928000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "104.254.148.165", "evidence": [ { "udp_stream": 391, "frame_number": 26083, "display_filter": "frame.number == 26083", "timestamp_epoch": "1583962657.125928000" } ], "is_private": false, "observable_id": "observable-fd59a109bebd5b234e70001e", "last_seen_epoch": "1583962657.125928000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962657.125928000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "104.254.148.166", "evidence": [ { "udp_stream": 391, "frame_number": 26083, "display_filter": "frame.number == 26083", "timestamp_epoch": "1583962657.125928000" } ], "is_private": false, "observable_id": "observable-d8a6229aebef63b05b453892", "last_seen_epoch": "1583962657.125928000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962657.125928000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "104.254.148.196", "evidence": [ { "udp_stream": 391, "frame_number": 26083, "display_filter": "frame.number == 26083", "timestamp_epoch": "1583962657.125928000" } ], "is_private": false, "observable_id": "observable-51bf82e132088bdea7b04313", "last_seen_epoch": "1583962657.125928000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962657.125928000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "104.254.149.100", "evidence": [ { "udp_stream": 391, "frame_number": 26083, "display_filter": "frame.number == 26083", "timestamp_epoch": "1583962657.125928000" } ], "is_private": false, "observable_id": "observable-789a3ba9d8709338d08c3609", "last_seen_epoch": "1583962657.125928000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962657.125928000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "104.254.149.101", "evidence": [ { "udp_stream": 391, "frame_number": 26083, "display_filter": "frame.number == 26083", "timestamp_epoch": "1583962657.125928000" } ], "is_private": false, "observable_id": "observable-321c9a4f014e8807fd65b6bc", "last_seen_epoch": "1583962657.125928000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962657.125928000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "104.254.149.68", "evidence": [ { "udp_stream": 391, "frame_number": 26083, "display_filter": "frame.number == 26083", "timestamp_epoch": "1583962657.125928000" } ], "is_private": false, "observable_id": "observable-68be57a33d1522039d6ea728", "last_seen_epoch": "1583962657.125928000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962657.125928000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "104.254.149.69", "evidence": [ { "udp_stream": 391, "frame_number": 26083, "display_filter": "frame.number == 26083", "timestamp_epoch": "1583962657.125928000" } ], "is_private": false, "observable_id": "observable-852a15c86ac38173fb6183a1", "last_seen_epoch": "1583962657.125928000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962657.125928000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "104.26.8.32", "evidence": [ { "udp_stream": 143, "frame_number": 4438, "display_filter": "frame.number == 4438", "timestamp_epoch": "1583961854.840055000" }, { "udp_stream": 314, "frame_number": 21145, "display_filter": "frame.number == 21145", "timestamp_epoch": "1583962650.385341000" } ], "is_private": false, "observable_id": "observable-411957f7527145803efdc67c", "last_seen_epoch": "1583962650.385341000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961854.840055000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "104.26.9.32", "evidence": [ { "udp_stream": 143, "frame_number": 4438, "display_filter": "frame.number == 4438", "timestamp_epoch": "1583961854.840055000" }, { "udp_stream": 314, "frame_number": 21145, "display_filter": "frame.number == 21145", "timestamp_epoch": "1583962650.385341000" } ], "is_private": false, "observable_id": "observable-7ec5efbd5609d5343b79c92d", "last_seen_epoch": "1583962650.385341000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961854.840055000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "104.36.113.17", "evidence": [ { "udp_stream": 397, "frame_number": 26254, "display_filter": "frame.number == 26254", "timestamp_epoch": "1583962657.367426000" } ], "is_private": false, "observable_id": "observable-24af5f6a130979ccd202aa15", "last_seen_epoch": "1583962657.367426000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962657.367426000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "111.221.29.40", "evidence": [ { "udp_stream": 237, "frame_number": 15315, "display_filter": "frame.number == 15315", "timestamp_epoch": "1583962360.863226000" }, { "udp_stream": 252, "frame_number": 15726, "display_filter": "frame.number == 15726", "timestamp_epoch": "1583962387.327849000" }, { "udp_stream": 257, "frame_number": 16028, "display_filter": "frame.number == 16028", "timestamp_epoch": "1583962418.344091000" } ], "is_private": false, "observable_id": "observable-9e5b0215393d67153dfbea31", "last_seen_epoch": "1583962418.344091000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962360.863226000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "13.107.136.254", "evidence": [ { "udp_stream": 127, "frame_number": 4058, "display_filter": "frame.number == 4058", "timestamp_epoch": "1583961837.190570000" }, { "udp_stream": 206, "frame_number": 12907, "display_filter": "frame.number == 12907", "timestamp_epoch": "1583962015.867946000" } ], "is_private": false, "observable_id": "observable-ec08a15d131ea1fe9a94eab4", "last_seen_epoch": "1583962015.867946000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961837.190570000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "13.107.18.254", "evidence": [ { "udp_stream": 63, "frame_number": 1860, "display_filter": "frame.number == 1860", "timestamp_epoch": "1583961789.191783000" }, { "udp_stream": 125, "frame_number": 4047, "display_filter": "frame.number == 4047", "timestamp_epoch": "1583961837.170614000" } ], "is_private": false, "observable_id": "observable-31cdd3ccef2af17576e6d6cf", "last_seen_epoch": "1583961837.170614000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961789.191783000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "13.107.21.200", "evidence": [ { "udp_stream": 59, "frame_number": 1802, "display_filter": "frame.number == 1802", "timestamp_epoch": "1583961788.662452000" }, { "udp_stream": 73, "frame_number": 2281, "display_filter": "frame.number == 2281", "timestamp_epoch": "1583961806.049603000" }, { "udp_stream": 122, "frame_number": 3980, "display_filter": "frame.number == 3980", "timestamp_epoch": "1583961832.907313000" }, { "udp_stream": 124, "frame_number": 4038, "display_filter": "frame.number == 4038", "timestamp_epoch": "1583961837.107859000" }, { "udp_stream": 130, "frame_number": 4257, "display_filter": "frame.number == 4257", "timestamp_epoch": "1583961848.562517000" }, { "udp_stream": 200, "frame_number": 12478, "display_filter": "frame.number == 12478", "timestamp_epoch": "1583962013.872576000" }, { "udp_stream": 212, "frame_number": 14092, "display_filter": "frame.number == 14092", "timestamp_epoch": "1583962054.684480000" }, { "udp_stream": 294, "frame_number": 16489, "display_filter": "frame.number == 16489", "timestamp_epoch": "1583962547.149148000" } ], "is_private": false, "observable_id": "observable-b4c71312c189a38661999891", "last_seen_epoch": "1583962547.149148000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961788.662452000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "13.107.246.10", "evidence": [ { "udp_stream": 64, "frame_number": 1867, "display_filter": "frame.number == 1867", "timestamp_epoch": "1583961789.224967000" }, { "udp_stream": 197, "frame_number": 12412, "display_filter": "frame.number == 12412", "timestamp_epoch": "1583961995.556452000" }, { "udp_stream": 225, "frame_number": 14744, "display_filter": "frame.number == 14744", "timestamp_epoch": "1583962291.265084000" }, { "udp_stream": 227, "frame_number": 14919, "display_filter": "frame.number == 14919", "timestamp_epoch": "1583962319.940114000" } ], "is_private": false, "observable_id": "observable-05bc871ccb71bda96018ef8b", "last_seen_epoch": "1583962319.940114000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961789.224967000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "13.107.246.254", "evidence": [ { "udp_stream": 76, "frame_number": 2329, "display_filter": "frame.number == 2329", "timestamp_epoch": "1583961806.431111000" }, { "udp_stream": 79, "frame_number": 2339, "display_filter": "frame.number == 2339", "timestamp_epoch": "1583961806.506259000" } ], "is_private": false, "observable_id": "observable-e64f15836857d9c0b5a0a3f1", "last_seen_epoch": "1583961806.506259000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961806.431111000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "13.107.3.128", "evidence": [ { "udp_stream": 137, "frame_number": 4342, "display_filter": "frame.number == 4342", "timestamp_epoch": "1583961854.516637000" }, { "udp_stream": 406, "frame_number": 26795, "display_filter": "frame.number == 26795", "timestamp_epoch": "1583962685.586418000" }, { "udp_stream": 407, "frame_number": 27314, "display_filter": "frame.number == 27314", "timestamp_epoch": "1583962732.810552000" } ], "is_private": false, "observable_id": "observable-a456ee5d88ec997da66cd4ca", "last_seen_epoch": "1583962732.810552000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961854.516637000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "13.107.3.254", "evidence": [ { "udp_stream": 75, "frame_number": 2328, "display_filter": "frame.number == 2328", "timestamp_epoch": "1583961806.430849000" } ], "is_private": false, "observable_id": "observable-fff0a3b3eda31053cc4098dd", "last_seen_epoch": "1583961806.430849000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961806.430849000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "13.107.42.254", "evidence": [ { "udp_stream": 74, "frame_number": 2295, "display_filter": "frame.number == 2295", "timestamp_epoch": "1583961806.240830000" } ], "is_private": false, "observable_id": "observable-c312f62fafbb7e01bc482e8c", "last_seen_epoch": "1583961806.240830000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961806.240830000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "13.107.43.14", "evidence": [ { "udp_stream": 78, "frame_number": 2340, "display_filter": "frame.number == 2340", "timestamp_epoch": "1583961806.507845000" } ], "is_private": false, "observable_id": "observable-659efd51ebdf92fc9a9184ca", "last_seen_epoch": "1583961806.507845000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961806.507845000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "13.107.5.80", "evidence": [ { "udp_stream": 199, "frame_number": 12477, "display_filter": "frame.number == 12477", "timestamp_epoch": "1583962013.872494000" } ], "is_private": false, "observable_id": "observable-10e7923a06108052cf5c1168", "last_seen_epoch": "1583962013.872494000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962013.872494000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "13.107.6.158", "evidence": [ { "udp_stream": 186, "frame_number": 10212, "display_filter": "frame.number == 10212", "timestamp_epoch": "1583961911.739107000" }, { "udp_stream": 349, "frame_number": 23849, "display_filter": "frame.number == 23849", "timestamp_epoch": "1583962652.620832000" } ], "is_private": false, "observable_id": "observable-ddf24a77201a6d91ff08c01c", "last_seen_epoch": "1583962652.620832000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961911.739107000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "13.107.6.254", "evidence": [ { "udp_stream": 77, "frame_number": 2336, "display_filter": "frame.number == 2336", "timestamp_epoch": "1583961806.493595000" } ], "is_private": false, "observable_id": "observable-7bdcaa3b4479d338df9e9de6", "last_seen_epoch": "1583961806.493595000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961806.493595000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "13.249.26.114", "evidence": [ { "udp_stream": 152, "frame_number": 5064, "display_filter": "frame.number == 5064", "timestamp_epoch": "1583961856.184965000" } ], "is_private": false, "observable_id": "observable-aa6a09d76eb1825962f6bdb4", "last_seen_epoch": "1583961856.184965000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961856.184965000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "13.249.26.125", "evidence": [ { "udp_stream": 152, "frame_number": 5064, "display_filter": "frame.number == 5064", "timestamp_epoch": "1583961856.184965000" } ], "is_private": false, "observable_id": "observable-2aa19fcf1636a414de489b1a", "last_seen_epoch": "1583961856.184965000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961856.184965000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "13.249.26.87", "evidence": [ { "udp_stream": 152, "frame_number": 5064, "display_filter": "frame.number == 5064", "timestamp_epoch": "1583961856.184965000" } ], "is_private": false, "observable_id": "observable-42d1137d0bbbd812d2bb7e0e", "last_seen_epoch": "1583961856.184965000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961856.184965000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "13.249.26.99", "evidence": [ { "udp_stream": 152, "frame_number": 5064, "display_filter": "frame.number == 5064", "timestamp_epoch": "1583961856.184965000" } ], "is_private": false, "observable_id": "observable-75a562a0df4a1f4e6e45c591", "last_seen_epoch": "1583961856.184965000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961856.184965000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "13.68.93.109", "evidence": [ { "udp_stream": 191, "frame_number": 10456, "display_filter": "frame.number == 10456", "timestamp_epoch": "1583961954.783018000" } ], "is_private": false, "observable_id": "observable-9713bd037b3e777fa06eaa41", "last_seen_epoch": "1583961954.783018000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961954.783018000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "13.78.168.230", "evidence": [ { "udp_stream": 243, "frame_number": 15551, "display_filter": "frame.number == 15551", "timestamp_epoch": "1583962385.535429000" }, { "udp_stream": 411, "frame_number": 27538, "display_filter": "frame.number == 27538", "timestamp_epoch": "1583962904.881940000" } ], "is_private": false, "observable_id": "observable-274fe42150261fb2bd34ecb6", "last_seen_epoch": "1583962904.881940000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962385.535429000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "13.78.177.144", "evidence": [ { "udp_stream": 26, "frame_number": 863, "display_filter": "frame.number == 863", "timestamp_epoch": "1583961760.453103000" } ], "is_private": false, "observable_id": "observable-d366901c404d8b0bd0229999", "last_seen_epoch": "1583961760.453103000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961760.453103000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "13.78.186.254", "evidence": [ { "udp_stream": 115, "frame_number": 3512, "display_filter": "frame.number == 3512", "timestamp_epoch": "1583961818.499999000" } ], "is_private": false, "observable_id": "observable-c3dd7b6348ad7e3e6c72c99a", "last_seen_epoch": "1583961818.499999000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961818.499999000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "13.78.187.58", "evidence": [ { "udp_stream": 114, "frame_number": 3304, "display_filter": "frame.number == 3304", "timestamp_epoch": "1583961817.728584000" } ], "is_private": false, "observable_id": "observable-376d367b631b2f32abbf0f9b", "last_seen_epoch": "1583961817.728584000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961817.728584000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "130.211.21.54", "evidence": [ { "udp_stream": 330, "frame_number": 26006, "display_filter": "frame.number == 26006", "timestamp_epoch": "1583962656.958202000" } ], "is_private": false, "observable_id": "observable-d58477261d6d0fc1bc722fcb", "last_seen_epoch": "1583962656.958202000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962656.958202000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "130.211.28.134", "evidence": [ { "udp_stream": 396, "frame_number": 26217, "display_filter": "frame.number == 26217", "timestamp_epoch": "1583962657.348534000" } ], "is_private": false, "observable_id": "observable-6d3b87783a9afefa9cd3d744", "last_seen_epoch": "1583962657.348534000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962657.348534000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "131.107.255.255", "evidence": [ { "udp_stream": 36, "frame_number": 1080, "display_filter": "frame.number == 1080", "timestamp_epoch": "1583961779.950820000" }, { "udp_stream": 84, "frame_number": 2498, "display_filter": "frame.number == 2498", "timestamp_epoch": "1583961811.185698000" }, { "udp_stream": 220, "frame_number": 14615, "display_filter": "frame.number == 14615", "timestamp_epoch": "1583962215.989692000" }, { "udp_stream": 223, "frame_number": 14725, "display_filter": "frame.number == 14725", "timestamp_epoch": "1583962275.929534000" } ], "is_private": false, "observable_id": "observable-90d7a5a6cf040f7b1c6007d8", "last_seen_epoch": "1583962275.929534000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961779.950820000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "139.178.81.9", "evidence": [ { "udp_stream": 382, "frame_number": 25928, "display_filter": "frame.number == 25928", "timestamp_epoch": "1583962656.834296000" } ], "is_private": false, "observable_id": "observable-ad15654e216295edc1285484", "last_seen_epoch": "1583962656.834296000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962656.834296000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "151.101.50.208", "evidence": [ { "udp_stream": 159, "frame_number": 6020, "display_filter": "frame.number == 6020", "timestamp_epoch": "1583961857.068008000" } ], "is_private": false, "observable_id": "observable-8d7fb50f55724027f07675a4", "last_seen_epoch": "1583961857.068008000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961857.068008000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "152.199.4.210", "evidence": [ { "udp_stream": 332, "frame_number": 21318, "display_filter": "frame.number == 21318", "timestamp_epoch": "1583962650.986719000" } ], "is_private": false, "observable_id": "observable-9cd1b3f3869eac56b33b670d", "last_seen_epoch": "1583962650.986719000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962650.986719000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "152.199.4.33", "evidence": [ { "udp_stream": 204, "frame_number": 12660, "display_filter": "frame.number == 12660", "timestamp_epoch": "1583962015.538643000" } ], "is_private": false, "observable_id": "observable-c7a59f11ef09f9113e0ec20a", "last_seen_epoch": "1583962015.538643000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962015.538643000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "169.46.74.216", "evidence": [ { "udp_stream": 399, "frame_number": 26433, "display_filter": "frame.number == 26433", "timestamp_epoch": "1583962658.985207000" } ], "is_private": false, "observable_id": "observable-2d07f626fad39f61b49ff75d", "last_seen_epoch": "1583962658.985207000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962658.985207000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "169.60.140.161", "evidence": [ { "udp_stream": 400, "frame_number": 26616, "display_filter": "frame.number == 26616", "timestamp_epoch": "1583962663.610644000" } ], "is_private": false, "observable_id": "observable-5b340e9a3d8aa5c39329a78c", "last_seen_epoch": "1583962663.610644000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962663.610644000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "169.60.153.61", "evidence": [ { "udp_stream": 366, "frame_number": 25242, "display_filter": "frame.number == 25242", "timestamp_epoch": "1583962655.496520000" } ], "is_private": false, "observable_id": "observable-f051f4dfd60028bb163b950c", "last_seen_epoch": "1583962655.496520000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962655.496520000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "172.217.1.142", "evidence": [ { "udp_stream": 364, "frame_number": 25130, "display_filter": "frame.number == 25130", "timestamp_epoch": "1583962655.290011000" } ], "is_private": false, "observable_id": "observable-b87cb72216b371c26b5c0da1", "last_seen_epoch": "1583962655.290011000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962655.290011000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "172.217.12.74", "evidence": [ { "udp_stream": 210, "frame_number": 13828, "display_filter": "frame.number == 13828", "timestamp_epoch": "1583962031.453069000" } ], "is_private": false, "observable_id": "observable-831c4d1e0b6a83739a82d759", "last_seen_epoch": "1583962031.453069000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962031.453069000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "172.217.12.84", "evidence": [ { "udp_stream": 367, "frame_number": 25243, "display_filter": "frame.number == 25243", "timestamp_epoch": "1583962655.496736000" } ], "is_private": false, "observable_id": "observable-fa0f562b4d04b09df36ac0a1", "last_seen_epoch": "1583962655.496736000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962655.496736000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "172.217.14.161", "evidence": [ { "udp_stream": 358, "frame_number": 24531, "display_filter": "frame.number == 24531", "timestamp_epoch": "1583962654.503997000" } ], "is_private": false, "observable_id": "observable-922357e7d3bd940d05bc0e92", "last_seen_epoch": "1583962654.503997000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962654.503997000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "172.217.14.162", "evidence": [ { "udp_stream": 352, "frame_number": 24064, "display_filter": "frame.number == 24064", "timestamp_epoch": "1583962652.905894000" }, { "udp_stream": 354, "frame_number": 24232, "display_filter": "frame.number == 24232", "timestamp_epoch": "1583962653.141217000" }, { "udp_stream": 372, "frame_number": 25283, "display_filter": "frame.number == 25283", "timestamp_epoch": "1583962655.597916000" } ], "is_private": false, "observable_id": "observable-3dc72f35bd15c85802d449d6", "last_seen_epoch": "1583962655.597916000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962652.905894000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "172.217.2.226", "evidence": [ { "udp_stream": 365, "frame_number": 25148, "display_filter": "frame.number == 25148", "timestamp_epoch": "1583962655.347719000" }, { "udp_stream": 392, "frame_number": 26090, "display_filter": "frame.number == 26090", "timestamp_epoch": "1583962657.131301000" } ], "is_private": false, "observable_id": "observable-c70aa6a092966081ebb475d1", "last_seen_epoch": "1583962657.131301000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962655.347719000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "172.217.6.142", "evidence": [ { "udp_stream": 356, "frame_number": 24523, "display_filter": "frame.number == 24523", "timestamp_epoch": "1583962654.493084000" } ], "is_private": false, "observable_id": "observable-29ccda1ba053fe1cafe485b6", "last_seen_epoch": "1583962654.493084000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962654.493084000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "172.217.6.144", "evidence": [ { "udp_stream": 208, "frame_number": 13334, "display_filter": "frame.number == 13334", "timestamp_epoch": "1583962027.473726000" } ], "is_private": false, "observable_id": "observable-0be7da622b6dd9e75e9ea518", "last_seen_epoch": "1583962027.473726000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962027.473726000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "172.217.6.174", "evidence": [ { "udp_stream": 351, "frame_number": 24065, "display_filter": "frame.number == 24065", "timestamp_epoch": "1583962652.905991000" } ], "is_private": false, "observable_id": "observable-82ecd561f7fba943cfe05476", "last_seen_epoch": "1583962652.905991000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962652.905991000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "172.217.9.4", "evidence": [ { "udp_stream": 353, "frame_number": 24231, "display_filter": "frame.number == 24231", "timestamp_epoch": "1583962653.141149000" } ], "is_private": false, "observable_id": "observable-ca80ac7475fb0e14ea6d31cd", "last_seen_epoch": "1583962653.141149000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962653.141149000" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "172.245.249.117", "evidence": [], "is_private": false, "observable_id": "observable-a5f3c1c25d5efd7b0275d41d", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "173.194.223.154", "evidence": [ { "udp_stream": 361, "frame_number": 24784, "display_filter": "frame.number == 24784", "timestamp_epoch": "1583962654.705612000" }, { "udp_stream": 371, "frame_number": 25284, "display_filter": "frame.number == 25284", "timestamp_epoch": "1583962655.597976000" } ], "is_private": false, "observable_id": "observable-4554ae5028b623efed8e5112", "last_seen_epoch": "1583962655.597976000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962654.705612000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "173.194.223.155", "evidence": [ { "udp_stream": 361, "frame_number": 24784, "display_filter": "frame.number == 24784", "timestamp_epoch": "1583962654.705612000" }, { "udp_stream": 371, "frame_number": 25284, "display_filter": "frame.number == 25284", "timestamp_epoch": "1583962655.597976000" } ], "is_private": false, "observable_id": "observable-c8fca9d0eddefb6ff7bcce5f", "last_seen_epoch": "1583962655.597976000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962654.705612000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "173.194.223.156", "evidence": [ { "udp_stream": 361, "frame_number": 24784, "display_filter": "frame.number == 24784", "timestamp_epoch": "1583962654.705612000" }, { "udp_stream": 371, "frame_number": 25284, "display_filter": "frame.number == 25284", "timestamp_epoch": "1583962655.597976000" } ], "is_private": false, "observable_id": "observable-da0f75ae33bcc1227da6dd6d", "last_seen_epoch": "1583962655.597976000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962654.705612000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "173.194.223.157", "evidence": [ { "udp_stream": 361, "frame_number": 24784, "display_filter": "frame.number == 24784", "timestamp_epoch": "1583962654.705612000" }, { "udp_stream": 371, "frame_number": 25284, "display_filter": "frame.number == 25284", "timestamp_epoch": "1583962655.597976000" } ], "is_private": false, "observable_id": "observable-f3cbf61c2082e45f918ccd00", "last_seen_epoch": "1583962655.597976000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962654.705612000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "18.204.46.201", "evidence": [ { "udp_stream": 386, "frame_number": 26010, "display_filter": "frame.number == 26010", "timestamp_epoch": "1583962656.960973000" } ], "is_private": false, "observable_id": "observable-a2e9313785f4fbb251591d7b", "last_seen_epoch": "1583962656.960973000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962656.960973000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "18.208.78.141", "evidence": [ { "udp_stream": 386, "frame_number": 26010, "display_filter": "frame.number == 26010", "timestamp_epoch": "1583962656.960973000" } ], "is_private": false, "observable_id": "observable-58ae84053c3fc941451613f4", "last_seen_epoch": "1583962656.960973000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962656.960973000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "18.211.91.10", "evidence": [ { "udp_stream": 389, "frame_number": 26098, "display_filter": "frame.number == 26098", "timestamp_epoch": "1583962657.137080000" } ], "is_private": false, "observable_id": "observable-4a83e6a62f06198f8c5dbd91", "last_seen_epoch": "1583962657.137080000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962657.137080000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "18.213.117.209", "evidence": [ { "udp_stream": 386, "frame_number": 26010, "display_filter": "frame.number == 26010", "timestamp_epoch": "1583962656.960973000" } ], "is_private": false, "observable_id": "observable-5d9c8495b8bb1108e3b3062f", "last_seen_epoch": "1583962656.960973000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962656.960973000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "18.214.132.216", "evidence": [ { "udp_stream": 228, "frame_number": 14974, "display_filter": "frame.number == 14974", "timestamp_epoch": "1583962320.197469000" } ], "is_private": false, "observable_id": "observable-297cab48e03c404da9ce77e7", "last_seen_epoch": "1583962320.197469000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962320.197469000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "18.232.32.205", "evidence": [ { "udp_stream": 385, "frame_number": 26007, "display_filter": "frame.number == 26007", "timestamp_epoch": "1583962656.958475000" } ], "is_private": false, "observable_id": "observable-476948b12c8e07674f72cd97", "last_seen_epoch": "1583962656.958475000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962656.958475000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "18.233.90.151", "evidence": [ { "udp_stream": 228, "frame_number": 14974, "display_filter": "frame.number == 14974", "timestamp_epoch": "1583962320.197469000" } ], "is_private": false, "observable_id": "observable-f50a516368eb9fbdccbf39ba", "last_seen_epoch": "1583962320.197469000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962320.197469000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "18.235.112.207", "evidence": [ { "udp_stream": 228, "frame_number": 14974, "display_filter": "frame.number == 14974", "timestamp_epoch": "1583962320.197469000" } ], "is_private": false, "observable_id": "observable-cf758b2a38e275fd34c82089", "last_seen_epoch": "1583962320.197469000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962320.197469000" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "185.14.31.98", "evidence": [], "is_private": false, "observable_id": "observable-ebfad4e3a16bbd3bc46aea76", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "185.141.27.238", "evidence": [], "is_private": false, "observable_id": "observable-c8a090c852f0d9adbf4eab1c", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "185.180.198.50", "evidence": [], "is_private": false, "observable_id": "observable-2b5f81c2541070def26ad339", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "190.214.13.2", "evidence": [], "is_private": false, "observable_id": "observable-399350cd25cfc81f0854faf9", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "192.243.232.58", "evidence": [ { "udp_stream": 350, "frame_number": 23890, "display_filter": "frame.number == 23890", "timestamp_epoch": "1583962652.656673000" } ], "is_private": false, "observable_id": "observable-dad0ed97c020ca8b7214bf7b", "last_seen_epoch": "1583962652.656673000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962652.656673000" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "195.123.242.48", "evidence": [], "is_private": false, "observable_id": "observable-09ee1310276d4651cd54c178", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "198.23.252.130", "evidence": [], "is_private": false, "observable_id": "observable-42dad44edf1f21b60ba08345", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "198.23.252.135", "evidence": [], "is_private": false, "observable_id": "observable-d5ffc2d7e1823d05d44101b5", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "199.187.193.166", "evidence": [ { "udp_stream": 394, "frame_number": 26180, "display_filter": "frame.number == 26180", "timestamp_epoch": "1583962657.266607000" } ], "is_private": false, "observable_id": "observable-fe361e0ba2a45b6b0b82a3dd", "last_seen_epoch": "1583962657.266607000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962657.266607000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "199.247.13.144", "evidence": [ { "udp_stream": 412, "frame_number": 27775, "display_filter": "frame.number == 27775", "timestamp_epoch": "1583963020.430853000" } ], "is_private": false, "observable_id": "observable-02b263d892a37f177516df64", "last_seen_epoch": "1583963020.430853000", "enrichment_state": "not_requested", "first_seen_epoch": "1583963020.430853000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "20.44.86.43", "evidence": [ { "udp_stream": 405, "frame_number": 26766, "display_filter": "frame.number == 26766", "timestamp_epoch": "1583962684.331866000" } ], "is_private": false, "observable_id": "observable-63adcd67d00991ece5ea0213", "last_seen_epoch": "1583962684.331866000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962684.331866000" }, { "type": "ipv4", "roles": [ "http-host", "network-endpoint" ], "value": "203.176.135.102", "evidence": [ { "tcp_stream": 448, "frame_number": 19116, "display_filter": "frame.number == 19116", "timestamp_epoch": "1583962613.434697000" }, { "tcp_stream": 449, "frame_number": 19547, "display_filter": "frame.number == 19547", "timestamp_epoch": "1583962615.812536000" }, { "tcp_stream": 459, "frame_number": 20660, "display_filter": "frame.number == 20660", "timestamp_epoch": "1583962620.007347000" }, { "tcp_stream": 465, "frame_number": 21096, "display_filter": "frame.number == 21096", "timestamp_epoch": "1583962639.795666000" }, { "tcp_stream": 555, "frame_number": 26673, "display_filter": "frame.number == 26673", "timestamp_epoch": "1583962672.861852000" } ], "is_private": false, "observable_id": "observable-db313399ad53bc3a475fd5a1", "last_seen_epoch": "1583962672.861852000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962613.434697000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "204.79.197.200", "evidence": [ { "udp_stream": 59, "frame_number": 1802, "display_filter": "frame.number == 1802", "timestamp_epoch": "1583961788.662452000" }, { "udp_stream": 73, "frame_number": 2281, "display_filter": "frame.number == 2281", "timestamp_epoch": "1583961806.049603000" }, { "udp_stream": 122, "frame_number": 3980, "display_filter": "frame.number == 3980", "timestamp_epoch": "1583961832.907313000" }, { "udp_stream": 124, "frame_number": 4038, "display_filter": "frame.number == 4038", "timestamp_epoch": "1583961837.107859000" }, { "udp_stream": 130, "frame_number": 4257, "display_filter": "frame.number == 4257", "timestamp_epoch": "1583961848.562517000" }, { "udp_stream": 200, "frame_number": 12478, "display_filter": "frame.number == 12478", "timestamp_epoch": "1583962013.872576000" }, { "udp_stream": 212, "frame_number": 14092, "display_filter": "frame.number == 14092", "timestamp_epoch": "1583962054.684480000" }, { "udp_stream": 294, "frame_number": 16489, "display_filter": "frame.number == 16489", "timestamp_epoch": "1583962547.149148000" } ], "is_private": false, "observable_id": "observable-27f8fb39289e5e8b76956388", "last_seen_epoch": "1583962547.149148000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961788.662452000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "204.79.197.222", "evidence": [ { "udp_stream": 65, "frame_number": 1888, "display_filter": "frame.number == 1888", "timestamp_epoch": "1583961789.266116000" }, { "udp_stream": 198, "frame_number": 12452, "display_filter": "frame.number == 12452", "timestamp_epoch": "1583962012.938150000" } ], "is_private": false, "observable_id": "observable-f473027743f35dffb42a329b", "last_seen_epoch": "1583962012.938150000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961789.266116000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "204.79.197.254", "evidence": [ { "udp_stream": 62, "frame_number": 1838, "display_filter": "frame.number == 1838", "timestamp_epoch": "1583961789.154954000" }, { "udp_stream": 203, "frame_number": 12625, "display_filter": "frame.number == 12625", "timestamp_epoch": "1583962015.260881000" } ], "is_private": false, "observable_id": "observable-ef67f826d9abcfb82cc8ae33", "last_seen_epoch": "1583962015.260881000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961789.154954000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "205.185.216.10", "evidence": [ { "udp_stream": 408, "frame_number": 27387, "display_filter": "frame.number == 27387", "timestamp_epoch": "1583962744.515705000" } ], "is_private": false, "observable_id": "observable-fba1b1437d3caa5fa48917b9", "last_seen_epoch": "1583962744.515705000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962744.515705000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "205.185.216.42", "evidence": [ { "udp_stream": 408, "frame_number": 27387, "display_filter": "frame.number == 27387", "timestamp_epoch": "1583962744.515705000" } ], "is_private": false, "observable_id": "observable-9b5f9bcf8293d228e1ab3e65", "last_seen_epoch": "1583962744.515705000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962744.515705000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "209.97.130.197", "evidence": [ { "udp_stream": 413, "frame_number": 28321, "display_filter": "frame.number == 28321", "timestamp_epoch": "1583963031.223332000" } ], "is_private": false, "observable_id": "observable-e137a2ff68f8534bde63dc87", "last_seen_epoch": "1583963031.223332000", "enrichment_state": "not_requested", "first_seen_epoch": "1583963031.223332000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "216.58.193.142", "evidence": [ { "udp_stream": 158, "frame_number": 6019, "display_filter": "frame.number == 6019", "timestamp_epoch": "1583961857.067951000" }, { "udp_stream": 359, "frame_number": 24672, "display_filter": "frame.number == 24672", "timestamp_epoch": "1583962654.604448000" } ], "is_private": false, "observable_id": "observable-d3f1e1ad26d17224be7af003", "last_seen_epoch": "1583962654.604448000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961857.067951000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "216.58.194.104", "evidence": [ { "udp_stream": 368, "frame_number": 25254, "display_filter": "frame.number == 25254", "timestamp_epoch": "1583962655.506747000" } ], "is_private": false, "observable_id": "observable-5d8444509d39cca0b550cbe9", "last_seen_epoch": "1583962655.506747000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962655.506747000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "216.58.194.112", "evidence": [ { "udp_stream": 374, "frame_number": 25499, "display_filter": "frame.number == 25499", "timestamp_epoch": "1583962655.863798000" } ], "is_private": false, "observable_id": "observable-a37fc2e3ec141d80c085b051", "last_seen_epoch": "1583962655.863798000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962655.863798000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "216.58.194.131", "evidence": [ { "udp_stream": 139, "frame_number": 4391, "display_filter": "frame.number == 4391", "timestamp_epoch": "1583961854.757824000" }, { "udp_stream": 316, "frame_number": 21142, "display_filter": "frame.number == 21142", "timestamp_epoch": "1583962650.383619000" } ], "is_private": false, "observable_id": "observable-826c5434665ddd7c40c4ddde", "last_seen_epoch": "1583962650.383619000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961854.757824000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "216.58.194.42", "evidence": [ { "udp_stream": 138, "frame_number": 4390, "display_filter": "frame.number == 4390", "timestamp_epoch": "1583961854.757736000" }, { "udp_stream": 315, "frame_number": 21139, "display_filter": "frame.number == 21139", "timestamp_epoch": "1583962650.374617000" } ], "is_private": false, "observable_id": "observable-687793b86252a694dab3e57e", "last_seen_epoch": "1583962650.374617000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961854.757736000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "216.58.194.98", "evidence": [ { "udp_stream": 355, "frame_number": 24226, "display_filter": "frame.number == 24226", "timestamp_epoch": "1583962653.139608000" } ], "is_private": false, "observable_id": "observable-73cfde24895a6d9741e9a4a9", "last_seen_epoch": "1583962653.139608000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962653.139608000" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "224.0.0.22", "evidence": [], "is_private": false, "observable_id": "observable-fd392ca8a177c7f78c2e0105", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "224.0.0.251", "evidence": [], "is_private": false, "observable_id": "observable-a41b707ef9489fcd32e029d1", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "224.0.0.252", "evidence": [], "is_private": false, "observable_id": "observable-9b93ccd8fc1fbfc88735e682", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "23.199.252.214", "evidence": [ { "udp_stream": 308, "frame_number": 21133, "display_filter": "frame.number == 21133", "timestamp_epoch": "1583962650.349973000" } ], "is_private": false, "observable_id": "observable-d7f2d64503b9ab8642c8f76a", "last_seen_epoch": "1583962650.349973000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962650.349973000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "23.199.253.242", "evidence": [ { "udp_stream": 327, "frame_number": 21212, "display_filter": "frame.number == 21212", "timestamp_epoch": "1583962650.608017000" } ], "is_private": false, "observable_id": "observable-bd58aa91bb2bc03f14e0e413", "last_seen_epoch": "1583962650.608017000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962650.608017000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "23.199.253.39", "evidence": [ { "udp_stream": 328, "frame_number": 21288, "display_filter": "frame.number == 21288", "timestamp_epoch": "1583962650.943602000" } ], "is_private": false, "observable_id": "observable-a2c59f7f0de7a8f9f92f257f", "last_seen_epoch": "1583962650.943602000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962650.943602000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "23.199.253.53", "evidence": [ { "udp_stream": 393, "frame_number": 26147, "display_filter": "frame.number == 26147", "timestamp_epoch": "1583962657.208179000" } ], "is_private": false, "observable_id": "observable-e160e6c02dd6188778118f94", "last_seen_epoch": "1583962657.208179000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962657.208179000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "23.204.16.227", "evidence": [ { "udp_stream": 338, "frame_number": 21482, "display_filter": "frame.number == 21482", "timestamp_epoch": "1583962651.129952000" } ], "is_private": false, "observable_id": "observable-2980e7cb539777b049b3b28d", "last_seen_epoch": "1583962651.129952000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962651.129952000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "23.204.68.230", "evidence": [ { "udp_stream": 149, "frame_number": 4886, "display_filter": "frame.number == 4886", "timestamp_epoch": "1583961855.968427000" } ], "is_private": false, "observable_id": "observable-216321716ed926a1cfdeb6cf", "last_seen_epoch": "1583961855.968427000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961855.968427000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "23.206.208.173", "evidence": [ { "udp_stream": 168, "frame_number": 7613, "display_filter": "frame.number == 7613", "timestamp_epoch": "1583961859.233927000" } ], "is_private": false, "observable_id": "observable-82d8532e27e9e19e129f0bb5", "last_seen_epoch": "1583961859.233927000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961859.233927000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "23.206.213.111", "evidence": [ { "udp_stream": 244, "frame_number": 15571, "display_filter": "frame.number == 15571", "timestamp_epoch": "1583962385.663937000" }, { "udp_stream": 295, "frame_number": 16524, "display_filter": "frame.number == 16524", "timestamp_epoch": "1583962549.023492000" }, { "udp_stream": 410, "frame_number": 27478, "display_filter": "frame.number == 27478", "timestamp_epoch": "1583962861.371315000" } ], "is_private": false, "observable_id": "observable-57bc2242caeb746ad8335346", "last_seen_epoch": "1583962861.371315000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962385.663937000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "23.209.74.120", "evidence": [ { "udp_stream": 141, "frame_number": 4426, "display_filter": "frame.number == 4426", "timestamp_epoch": "1583961854.810288000" } ], "is_private": false, "observable_id": "observable-cb80e882345115fb814bf57a", "last_seen_epoch": "1583961854.810288000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961854.810288000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "23.211.18.27", "evidence": [ { "udp_stream": 140, "frame_number": 4396, "display_filter": "frame.number == 4396", "timestamp_epoch": "1583961854.766530000" }, { "udp_stream": 142, "frame_number": 4416, "display_filter": "frame.number == 4416", "timestamp_epoch": "1583961854.797966000" }, { "udp_stream": 144, "frame_number": 4446, "display_filter": "frame.number == 4446", "timestamp_epoch": "1583961854.845638000" }, { "udp_stream": 318, "frame_number": 21159, "display_filter": "frame.number == 21159", "timestamp_epoch": "1583962650.459214000" }, { "udp_stream": 317, "frame_number": 21160, "display_filter": "frame.number == 21160", "timestamp_epoch": "1583962650.459266000" }, { "udp_stream": 319, "frame_number": 21161, "display_filter": "frame.number == 21161", "timestamp_epoch": "1583962650.459342000" } ], "is_private": false, "observable_id": "observable-08e6bd1fc40023076fe11df5", "last_seen_epoch": "1583962650.459342000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961854.766530000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "23.211.36.128", "evidence": [ { "udp_stream": 201, "frame_number": 12480, "display_filter": "frame.number == 12480", "timestamp_epoch": "1583962014.002923000" } ], "is_private": false, "observable_id": "observable-6560a94d4976b88c50180504", "last_seen_epoch": "1583962014.002923000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962014.002923000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "23.4.97.247", "evidence": [ { "udp_stream": 21, "frame_number": 604, "display_filter": "frame.number == 604", "timestamp_epoch": "1583961758.615654000" }, { "udp_stream": 22, "frame_number": 657, "display_filter": "frame.number == 657", "timestamp_epoch": "1583961759.040026000" }, { "udp_stream": 24, "frame_number": 683, "display_filter": "frame.number == 683", "timestamp_epoch": "1583961759.326791000" }, { "udp_stream": 108, "frame_number": 3116, "display_filter": "frame.number == 3116", "timestamp_epoch": "1583961816.043339000" }, { "udp_stream": 111, "frame_number": 3163, "display_filter": "frame.number == 3163", "timestamp_epoch": "1583961817.238134000" }, { "udp_stream": 112, "frame_number": 3187, "display_filter": "frame.number == 3187", "timestamp_epoch": "1583961817.390606000" } ], "is_private": false, "observable_id": "observable-72b146600cd0835f5cf885e2", "last_seen_epoch": "1583961817.390606000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961758.615654000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "23.44.170.27", "evidence": [ { "udp_stream": 150, "frame_number": 5207, "display_filter": "frame.number == 5207", "timestamp_epoch": "1583961856.360480000" } ], "is_private": false, "observable_id": "observable-32771c3698ea070ca2f35b6b", "last_seen_epoch": "1583961856.360480000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961856.360480000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "23.46.28.16", "evidence": [ { "udp_stream": 61, "frame_number": 1820, "display_filter": "frame.number == 1820", "timestamp_epoch": "1583961789.088257000" } ], "is_private": false, "observable_id": "observable-e362901d03b4c8815cce34ba", "last_seen_epoch": "1583961789.088257000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961789.088257000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "23.46.28.24", "evidence": [ { "udp_stream": 61, "frame_number": 1820, "display_filter": "frame.number == 1820", "timestamp_epoch": "1583961789.088257000" } ], "is_private": false, "observable_id": "observable-51bba2a7439ce055061b555a", "last_seen_epoch": "1583961789.088257000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961789.088257000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "23.63.253.147", "evidence": [ { "udp_stream": 342, "frame_number": 21898, "display_filter": "frame.number == 21898", "timestamp_epoch": "1583962651.368700000" } ], "is_private": false, "observable_id": "observable-5520df03d2f3af7d51f09a7f", "last_seen_epoch": "1583962651.368700000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962651.368700000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "23.63.253.208", "evidence": [ { "udp_stream": 342, "frame_number": 21898, "display_filter": "frame.number == 21898", "timestamp_epoch": "1583962651.368700000" } ], "is_private": false, "observable_id": "observable-52fa104453d0239b31560014", "last_seen_epoch": "1583962651.368700000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962651.368700000" }, { "type": "ipv4", "roles": [ "http-host", "network-endpoint" ], "value": "239.255.255.250", "evidence": [ { "frame_number": 516, "display_filter": "frame.number == 516", "timestamp_epoch": "1583961757.053472000" }, { "frame_number": 518, "display_filter": "frame.number == 518", "timestamp_epoch": "1583961757.141829000" }, { "frame_number": 521, "display_filter": "frame.number == 521", "timestamp_epoch": "1583961757.317110000" }, { "frame_number": 522, "display_filter": "frame.number == 522", "timestamp_epoch": "1583961757.339046000" }, { "frame_number": 523, "display_filter": "frame.number == 523", "timestamp_epoch": "1583961757.467307000" }, { "frame_number": 806, "display_filter": "frame.number == 806", "timestamp_epoch": "1583961760.039998000" }, { "frame_number": 827, "display_filter": "frame.number == 827", "timestamp_epoch": "1583961760.150356000" }, { "frame_number": 832, "display_filter": "frame.number == 832", "timestamp_epoch": "1583961760.353574000" }, { "frame_number": 851, "display_filter": "frame.number == 851", "timestamp_epoch": "1583961760.385437000" }, { "frame_number": 865, "display_filter": "frame.number == 865", "timestamp_epoch": "1583961760.462907000" }, { "frame_number": 936, "display_filter": "frame.number == 936", "timestamp_epoch": "1583961763.041172000" }, { "frame_number": 937, "display_filter": "frame.number == 937", "timestamp_epoch": "1583961763.150914000" }, { "frame_number": 938, "display_filter": "frame.number == 938", "timestamp_epoch": "1583961763.478458000" }, { "frame_number": 1018, "display_filter": "frame.number == 1018", "timestamp_epoch": "1583961766.496768000" }, { "frame_number": 1047, "display_filter": "frame.number == 1047", "timestamp_epoch": "1583961769.510883000" }, { "frame_number": 1048, "display_filter": "frame.number == 1048", "timestamp_epoch": "1583961772.526214000" }, { "frame_number": 4311, "display_filter": "frame.number == 4311", "timestamp_epoch": "1583961851.807484000" }, { "frame_number": 4314, "display_filter": "frame.number == 4314", "timestamp_epoch": "1583961852.809426000" }, { "frame_number": 4331, "display_filter": "frame.number == 4331", "timestamp_epoch": "1583961853.810540000" }, { "frame_number": 4427, "display_filter": "frame.number == 4427", "timestamp_epoch": "1583961854.810945000" } ], "is_private": false, "observable_id": "observable-10350461dc8dfff09bbe6ab7", "last_seen_epoch": "1583963092.293061000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961757.053472000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "3.208.14.195", "evidence": [ { "udp_stream": 336, "frame_number": 21384, "display_filter": "frame.number == 21384", "timestamp_epoch": "1583962651.092080000" } ], "is_private": false, "observable_id": "observable-3890ed97741d35f640d54fc9", "last_seen_epoch": "1583962651.092080000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962651.092080000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "3.211.188.196", "evidence": [ { "udp_stream": 389, "frame_number": 26098, "display_filter": "frame.number == 26098", "timestamp_epoch": "1583962657.137080000" } ], "is_private": false, "observable_id": "observable-52f7a99c324d9d1140ba7273", "last_seen_epoch": "1583962657.137080000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962657.137080000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "3.212.136.177", "evidence": [ { "udp_stream": 385, "frame_number": 26007, "display_filter": "frame.number == 26007", "timestamp_epoch": "1583962656.958475000" } ], "is_private": false, "observable_id": "observable-696e903634b226656eb5ad02", "last_seen_epoch": "1583962656.958475000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962656.958475000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "3.213.24.71", "evidence": [ { "udp_stream": 389, "frame_number": 26098, "display_filter": "frame.number == 26098", "timestamp_epoch": "1583962657.137080000" } ], "is_private": false, "observable_id": "observable-db715eb129e1f507cd974269", "last_seen_epoch": "1583962657.137080000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962657.137080000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "3.215.9.190", "evidence": [ { "udp_stream": 389, "frame_number": 26098, "display_filter": "frame.number == 26098", "timestamp_epoch": "1583962657.137080000" } ], "is_private": false, "observable_id": "observable-f26568356b674b79cfd613d2", "last_seen_epoch": "1583962657.137080000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962657.137080000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "3.217.52.69", "evidence": [ { "udp_stream": 389, "frame_number": 26098, "display_filter": "frame.number == 26098", "timestamp_epoch": "1583962657.137080000" } ], "is_private": false, "observable_id": "observable-6e50015a679511870409877a", "last_seen_epoch": "1583962657.137080000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962657.137080000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "3.218.90.66", "evidence": [ { "udp_stream": 398, "frame_number": 26392, "display_filter": "frame.number == 26392", "timestamp_epoch": "1583962657.788154000" } ], "is_private": false, "observable_id": "observable-6a13837642f3c983d7af03d6", "last_seen_epoch": "1583962657.788154000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962657.788154000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "3.219.244.74", "evidence": [ { "udp_stream": 336, "frame_number": 21384, "display_filter": "frame.number == 21384", "timestamp_epoch": "1583962651.092080000" } ], "is_private": false, "observable_id": "observable-8df7c6a4f4f3cf997506b8f7", "last_seen_epoch": "1583962651.092080000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962651.092080000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "3.224.145.145", "evidence": [ { "udp_stream": 228, "frame_number": 14974, "display_filter": "frame.number == 14974", "timestamp_epoch": "1583962320.197469000" } ], "is_private": false, "observable_id": "observable-026938190305caa827f2ed60", "last_seen_epoch": "1583962320.197469000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962320.197469000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "3.225.102.19", "evidence": [ { "udp_stream": 385, "frame_number": 26007, "display_filter": "frame.number == 26007", "timestamp_epoch": "1583962656.958475000" } ], "is_private": false, "observable_id": "observable-6da8882db38ffa12d257532e", "last_seen_epoch": "1583962656.958475000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962656.958475000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "3.92.109.57", "evidence": [ { "udp_stream": 386, "frame_number": 26010, "display_filter": "frame.number == 26010", "timestamp_epoch": "1583962656.960973000" } ], "is_private": false, "observable_id": "observable-24bfc7f5cd9a1f06bdc1c47f", "last_seen_epoch": "1583962656.960973000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962656.960973000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "31.13.65.36", "evidence": [ { "udp_stream": 325, "frame_number": 21205, "display_filter": "frame.number == 21205", "timestamp_epoch": "1583962650.557596000" } ], "is_private": false, "observable_id": "observable-797b009776fca2932a7735a1", "last_seen_epoch": "1583962650.557596000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962650.557596000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "31.13.65.7", "evidence": [ { "udp_stream": 155, "frame_number": 5989, "display_filter": "frame.number == 5989", "timestamp_epoch": "1583961856.974342000" }, { "udp_stream": 310, "frame_number": 21130, "display_filter": "frame.number == 21130", "timestamp_epoch": "1583962650.341046000" } ], "is_private": false, "observable_id": "observable-f7d0ff3f49b6d489bd11f0f1", "last_seen_epoch": "1583962650.341046000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961856.974342000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "31.13.93.35", "evidence": [ { "udp_stream": 154, "frame_number": 5984, "display_filter": "frame.number == 5984", "timestamp_epoch": "1583961856.929561000" } ], "is_private": false, "observable_id": "observable-276855856ffbad3229628263", "last_seen_epoch": "1583961856.929561000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961856.929561000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "34.102.147.248", "evidence": [ { "udp_stream": 369, "frame_number": 25241, "display_filter": "frame.number == 25241", "timestamp_epoch": "1583962655.496450000" } ], "is_private": false, "observable_id": "observable-c12cbb48c141ca26f2e85832", "last_seen_epoch": "1583962655.496450000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962655.496450000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "34.192.244.88", "evidence": [ { "udp_stream": 386, "frame_number": 26010, "display_filter": "frame.number == 26010", "timestamp_epoch": "1583962656.960973000" } ], "is_private": false, "observable_id": "observable-1fe87e109f924fcc0e8b25b5", "last_seen_epoch": "1583962656.960973000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962656.960973000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "34.192.250.175", "evidence": [ { "udp_stream": 228, "frame_number": 14974, "display_filter": "frame.number == 14974", "timestamp_epoch": "1583962320.197469000" } ], "is_private": false, "observable_id": "observable-815cfa137ef572df9feedf21", "last_seen_epoch": "1583962320.197469000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962320.197469000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "34.193.215.190", "evidence": [ { "udp_stream": 389, "frame_number": 26098, "display_filter": "frame.number == 26098", "timestamp_epoch": "1583962657.137080000" } ], "is_private": false, "observable_id": "observable-fefdbc9d21ff21ac122363ea", "last_seen_epoch": "1583962657.137080000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962657.137080000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "34.194.253.146", "evidence": [ { "udp_stream": 386, "frame_number": 26010, "display_filter": "frame.number == 26010", "timestamp_epoch": "1583962656.960973000" } ], "is_private": false, "observable_id": "observable-363a9252d915c7e4d51a2afc", "last_seen_epoch": "1583962656.960973000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962656.960973000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "34.196.181.158", "evidence": [ { "udp_stream": 228, "frame_number": 14974, "display_filter": "frame.number == 14974", "timestamp_epoch": "1583962320.197469000" } ], "is_private": false, "observable_id": "observable-963b7cfcd00bd0fa4485bb98", "last_seen_epoch": "1583962320.197469000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962320.197469000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "34.197.12.81", "evidence": [ { "udp_stream": 228, "frame_number": 14974, "display_filter": "frame.number == 14974", "timestamp_epoch": "1583962320.197469000" } ], "is_private": false, "observable_id": "observable-933c849ba5ccb856258e19b5", "last_seen_epoch": "1583962320.197469000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962320.197469000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "34.206.247.240", "evidence": [ { "udp_stream": 395, "frame_number": 26128, "display_filter": "frame.number == 26128", "timestamp_epoch": "1583962657.176778000" } ], "is_private": false, "observable_id": "observable-23339749bb5370af1defb56d", "last_seen_epoch": "1583962657.176778000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962657.176778000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "34.208.124.133", "evidence": [ { "udp_stream": 345, "frame_number": 23659, "display_filter": "frame.number == 23659", "timestamp_epoch": "1583962652.155462000" } ], "is_private": false, "observable_id": "observable-91a655a9597691c42572dc45", "last_seen_epoch": "1583962652.155462000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962652.155462000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "34.208.131.21", "evidence": [ { "udp_stream": 343, "frame_number": 21915, "display_filter": "frame.number == 21915", "timestamp_epoch": "1583962651.475025000" }, { "udp_stream": 348, "frame_number": 23807, "display_filter": "frame.number == 23807", "timestamp_epoch": "1583962652.422875000" } ], "is_private": false, "observable_id": "observable-b9b64bfd2a24e2a24f48c8c6", "last_seen_epoch": "1583962652.422875000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962651.475025000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "34.208.36.157", "evidence": [ { "udp_stream": 343, "frame_number": 21915, "display_filter": "frame.number == 21915", "timestamp_epoch": "1583962651.475025000" }, { "udp_stream": 348, "frame_number": 23807, "display_filter": "frame.number == 23807", "timestamp_epoch": "1583962652.422875000" } ], "is_private": false, "observable_id": "observable-eb14020ff65e8b7d60dd5324", "last_seen_epoch": "1583962652.422875000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962651.475025000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "34.209.127.1", "evidence": [ { "udp_stream": 343, "frame_number": 21915, "display_filter": "frame.number == 21915", "timestamp_epoch": "1583962651.475025000" }, { "udp_stream": 348, "frame_number": 23807, "display_filter": "frame.number == 23807", "timestamp_epoch": "1583962652.422875000" } ], "is_private": false, "observable_id": "observable-1fa350c532249dba35ca3c53", "last_seen_epoch": "1583962652.422875000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962651.475025000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "34.211.22.199", "evidence": [ { "udp_stream": 345, "frame_number": 23659, "display_filter": "frame.number == 23659", "timestamp_epoch": "1583962652.155462000" } ], "is_private": false, "observable_id": "observable-2e1504458a1e07935337b113", "last_seen_epoch": "1583962652.155462000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962652.155462000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "34.212.232.109", "evidence": [ { "udp_stream": 343, "frame_number": 21915, "display_filter": "frame.number == 21915", "timestamp_epoch": "1583962651.475025000" }, { "udp_stream": 348, "frame_number": 23807, "display_filter": "frame.number == 23807", "timestamp_epoch": "1583962652.422875000" } ], "is_private": false, "observable_id": "observable-9fa2aaf08e9df9a2a4dae738", "last_seen_epoch": "1583962652.422875000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962651.475025000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "34.213.227.128", "evidence": [ { "udp_stream": 345, "frame_number": 23659, "display_filter": "frame.number == 23659", "timestamp_epoch": "1583962652.155462000" } ], "is_private": false, "observable_id": "observable-1aaf979bbed278f691bd024c", "last_seen_epoch": "1583962652.155462000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962652.155462000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "34.224.92.105", "evidence": [ { "udp_stream": 395, "frame_number": 26128, "display_filter": "frame.number == 26128", "timestamp_epoch": "1583962657.176778000" } ], "is_private": false, "observable_id": "observable-c2027fe767a0b064bf2fc1e3", "last_seen_epoch": "1583962657.176778000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962657.176778000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "34.225.211.231", "evidence": [ { "udp_stream": 395, "frame_number": 26128, "display_filter": "frame.number == 26128", "timestamp_epoch": "1583962657.176778000" } ], "is_private": false, "observable_id": "observable-17fceabe2ab49d8a1302f0ca", "last_seen_epoch": "1583962657.176778000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962657.176778000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "34.231.157.146", "evidence": [ { "udp_stream": 395, "frame_number": 26128, "display_filter": "frame.number == 26128", "timestamp_epoch": "1583962657.176778000" } ], "is_private": false, "observable_id": "observable-d4e9ab7b293c29fcb79d1f9e", "last_seen_epoch": "1583962657.176778000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962657.176778000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "34.231.65.133", "evidence": [ { "udp_stream": 401, "frame_number": 26535, "display_filter": "frame.number == 26535", "timestamp_epoch": "1583962661.464277000" } ], "is_private": false, "observable_id": "observable-24f9dab2293a866b8b89dca5", "last_seen_epoch": "1583962661.464277000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962661.464277000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "34.232.94.82", "evidence": [ { "udp_stream": 401, "frame_number": 26535, "display_filter": "frame.number == 26535", "timestamp_epoch": "1583962661.464277000" } ], "is_private": false, "observable_id": "observable-3eb5116a714dbcfba08fdd6f", "last_seen_epoch": "1583962661.464277000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962661.464277000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "34.234.197.182", "evidence": [ { "udp_stream": 401, "frame_number": 26535, "display_filter": "frame.number == 26535", "timestamp_epoch": "1583962661.464277000" } ], "is_private": false, "observable_id": "observable-edfd38d3f7de9119854b9a88", "last_seen_epoch": "1583962661.464277000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962661.464277000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "34.234.23.242", "evidence": [ { "udp_stream": 336, "frame_number": 21384, "display_filter": "frame.number == 21384", "timestamp_epoch": "1583962651.092080000" } ], "is_private": false, "observable_id": "observable-b5d6d09d0be7a94aab3c4ea9", "last_seen_epoch": "1583962651.092080000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962651.092080000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "34.236.165.152", "evidence": [ { "udp_stream": 385, "frame_number": 26007, "display_filter": "frame.number == 26007", "timestamp_epoch": "1583962656.958475000" } ], "is_private": false, "observable_id": "observable-df66da7c0d834dadb2a9a61e", "last_seen_epoch": "1583962656.958475000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962656.958475000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "34.98.67.3", "evidence": [ { "udp_stream": 376, "frame_number": 25538, "display_filter": "frame.number == 25538", "timestamp_epoch": "1583962655.936276000" } ], "is_private": false, "observable_id": "observable-5716d73809a44e521dc73d8b", "last_seen_epoch": "1583962655.936276000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962655.936276000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "35.161.118.223", "evidence": [ { "udp_stream": 343, "frame_number": 21915, "display_filter": "frame.number == 21915", "timestamp_epoch": "1583962651.475025000" }, { "udp_stream": 348, "frame_number": 23807, "display_filter": "frame.number == 23807", "timestamp_epoch": "1583962652.422875000" } ], "is_private": false, "observable_id": "observable-83ab37863754b87df9cf37b6", "last_seen_epoch": "1583962652.422875000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962651.475025000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "35.161.52.15", "evidence": [ { "udp_stream": 343, "frame_number": 21915, "display_filter": "frame.number == 21915", "timestamp_epoch": "1583962651.475025000" }, { "udp_stream": 348, "frame_number": 23807, "display_filter": "frame.number == 23807", "timestamp_epoch": "1583962652.422875000" } ], "is_private": false, "observable_id": "observable-54d391ca599767ad2d787054", "last_seen_epoch": "1583962652.422875000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962651.475025000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "35.163.173.161", "evidence": [ { "udp_stream": 343, "frame_number": 21915, "display_filter": "frame.number == 21915", "timestamp_epoch": "1583962651.475025000" }, { "udp_stream": 348, "frame_number": 23807, "display_filter": "frame.number == 23807", "timestamp_epoch": "1583962652.422875000" } ], "is_private": false, "observable_id": "observable-935b9486dc3d95f6f2b76b2b", "last_seen_epoch": "1583962652.422875000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962651.475025000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "35.167.5.179", "evidence": [ { "udp_stream": 343, "frame_number": 21915, "display_filter": "frame.number == 21915", "timestamp_epoch": "1583962651.475025000" }, { "udp_stream": 348, "frame_number": 23807, "display_filter": "frame.number == 23807", "timestamp_epoch": "1583962652.422875000" } ], "is_private": false, "observable_id": "observable-deee192e3820de882c3aaabf", "last_seen_epoch": "1583962652.422875000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962651.475025000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "35.169.43.149", "evidence": [ { "udp_stream": 401, "frame_number": 26535, "display_filter": "frame.number == 26535", "timestamp_epoch": "1583962661.464277000" } ], "is_private": false, "observable_id": "observable-734003cf6b0ac079888d17fa", "last_seen_epoch": "1583962661.464277000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962661.464277000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "35.190.72.21", "evidence": [ { "udp_stream": 383, "frame_number": 25912, "display_filter": "frame.number == 25912", "timestamp_epoch": "1583962656.790277000" } ], "is_private": false, "observable_id": "observable-1f6249767bb3bc866b5a5ffe", "last_seen_epoch": "1583962656.790277000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962656.790277000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "35.241.23.116", "evidence": [ { "udp_stream": 375, "frame_number": 25539, "display_filter": "frame.number == 25539", "timestamp_epoch": "1583962655.936347000" }, { "udp_stream": 378, "frame_number": 25540, "display_filter": "frame.number == 25540", "timestamp_epoch": "1583962655.936451000" }, { "udp_stream": 380, "frame_number": 25541, "display_filter": "frame.number == 25541", "timestamp_epoch": "1583962655.936519000" }, { "udp_stream": 379, "frame_number": 25542, "display_filter": "frame.number == 25542", "timestamp_epoch": "1583962655.936624000" }, { "udp_stream": 381, "frame_number": 25557, "display_filter": "frame.number == 25557", "timestamp_epoch": "1583962655.958527000" }, { "udp_stream": 377, "frame_number": 25648, "display_filter": "frame.number == 25648", "timestamp_epoch": "1583962656.140330000" }, { "udp_stream": 384, "frame_number": 25919, "display_filter": "frame.number == 25919", "timestamp_epoch": "1583962656.815109000" } ], "is_private": false, "observable_id": "observable-552ce5be829db0c5f5c3989e", "last_seen_epoch": "1583962656.815109000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962655.936347000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "35.244.140.139", "evidence": [ { "udp_stream": 388, "frame_number": 26097, "display_filter": "frame.number == 26097", "timestamp_epoch": "1583962657.136998000" } ], "is_private": false, "observable_id": "observable-c566788760f12388af8501d4", "last_seen_epoch": "1583962657.136998000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962657.136998000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "40.100.155.18", "evidence": [ { "udp_stream": 66, "frame_number": 1898, "display_filter": "frame.number == 1898", "timestamp_epoch": "1583961789.286717000" } ], "is_private": false, "observable_id": "observable-224a863bbbe67d186970d2ff", "last_seen_epoch": "1583961789.286717000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961789.286717000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "40.100.155.2", "evidence": [ { "udp_stream": 66, "frame_number": 1898, "display_filter": "frame.number == 1898", "timestamp_epoch": "1583961789.286717000" } ], "is_private": false, "observable_id": "observable-fcdb51b2c630cd83f1063eb1", "last_seen_epoch": "1583961789.286717000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961789.286717000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "40.119.2.214", "evidence": [ { "udp_stream": 117, "frame_number": 3699, "display_filter": "frame.number == 3699", "timestamp_epoch": "1583961823.771503000" }, { "udp_stream": 239, "frame_number": 15393, "display_filter": "frame.number == 15393", "timestamp_epoch": "1583962380.441417000" }, { "udp_stream": 284, "frame_number": 16329, "display_filter": "frame.number == 16329", "timestamp_epoch": "1583962544.824732000" } ], "is_private": false, "observable_id": "observable-ffc8e49ef9949a86e4550b8a", "last_seen_epoch": "1583962544.824732000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961823.771503000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "40.126.0.65", "evidence": [ { "udp_stream": 174, "frame_number": 8136, "display_filter": "frame.number == 8136", "timestamp_epoch": "1583961870.477543000" } ], "is_private": false, "observable_id": "observable-6d9ebc2e200af1ca86128afc", "last_seen_epoch": "1583961870.477543000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961870.477543000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "40.126.0.66", "evidence": [ { "udp_stream": 174, "frame_number": 8136, "display_filter": "frame.number == 8136", "timestamp_epoch": "1583961870.477543000" } ], "is_private": false, "observable_id": "observable-2985a2c27ef44bd660510f2f", "last_seen_epoch": "1583961870.477543000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961870.477543000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "40.126.0.67", "evidence": [ { "udp_stream": 174, "frame_number": 8136, "display_filter": "frame.number == 8136", "timestamp_epoch": "1583961870.477543000" } ], "is_private": false, "observable_id": "observable-12bb2e4e550ef1552546dc29", "last_seen_epoch": "1583961870.477543000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961870.477543000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "40.126.0.68", "evidence": [ { "udp_stream": 174, "frame_number": 8136, "display_filter": "frame.number == 8136", "timestamp_epoch": "1583961870.477543000" } ], "is_private": false, "observable_id": "observable-3ae4f5896bfb92f0e49a06cf", "last_seen_epoch": "1583961870.477543000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961870.477543000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "40.126.0.69", "evidence": [ { "udp_stream": 174, "frame_number": 8136, "display_filter": "frame.number == 8136", "timestamp_epoch": "1583961870.477543000" } ], "is_private": false, "observable_id": "observable-6bd7725f8e1544d9d17d020d", "last_seen_epoch": "1583961870.477543000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961870.477543000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "40.126.0.71", "evidence": [ { "udp_stream": 174, "frame_number": 8136, "display_filter": "frame.number == 8136", "timestamp_epoch": "1583961870.477543000" } ], "is_private": false, "observable_id": "observable-2c54a7db047c514da40801c6", "last_seen_epoch": "1583961870.477543000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961870.477543000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "40.126.0.72", "evidence": [ { "udp_stream": 174, "frame_number": 8136, "display_filter": "frame.number == 8136", "timestamp_epoch": "1583961870.477543000" } ], "is_private": false, "observable_id": "observable-351f15c26bb6ae43146256ac", "last_seen_epoch": "1583961870.477543000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961870.477543000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "40.126.0.73", "evidence": [ { "udp_stream": 174, "frame_number": 8136, "display_filter": "frame.number == 8136", "timestamp_epoch": "1583961870.477543000" } ], "is_private": false, "observable_id": "observable-789bf898ccdfdc85b98c117e", "last_seen_epoch": "1583961870.477543000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961870.477543000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "40.69.218.62", "evidence": [ { "udp_stream": 15, "frame_number": 526, "display_filter": "frame.number == 526", "timestamp_epoch": "1583961757.840619000" }, { "udp_stream": 102, "frame_number": 3007, "display_filter": "frame.number == 3007", "timestamp_epoch": "1583961815.247099000" } ], "is_private": false, "observable_id": "observable-8f15c0a868af8a2219185627", "last_seen_epoch": "1583961815.247099000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961757.840619000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "40.90.22.183", "evidence": [ { "udp_stream": 240, "frame_number": 15441, "display_filter": "frame.number == 15441", "timestamp_epoch": "1583962381.378143000" } ], "is_private": false, "observable_id": "observable-bec5bec32ff689bd5af2156d", "last_seen_epoch": "1583962381.378143000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962381.378143000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "40.90.22.185", "evidence": [ { "udp_stream": 178, "frame_number": 8550, "display_filter": "frame.number == 8550", "timestamp_epoch": "1583961873.974309000" }, { "udp_stream": 404, "frame_number": 26723, "display_filter": "frame.number == 26723", "timestamp_epoch": "1583962683.965713000" } ], "is_private": false, "observable_id": "observable-f8b60f702f84f4460430c77e", "last_seen_epoch": "1583962683.965713000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961873.974309000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "40.90.22.187", "evidence": [ { "udp_stream": 178, "frame_number": 8550, "display_filter": "frame.number == 8550", "timestamp_epoch": "1583961873.974309000" }, { "udp_stream": 240, "frame_number": 15441, "display_filter": "frame.number == 15441", "timestamp_epoch": "1583962381.378143000" }, { "udp_stream": 404, "frame_number": 26723, "display_filter": "frame.number == 26723", "timestamp_epoch": "1583962683.965713000" } ], "is_private": false, "observable_id": "observable-0e691f48ea87c5370deb4ca6", "last_seen_epoch": "1583962683.965713000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961873.974309000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "40.90.22.188", "evidence": [ { "udp_stream": 192, "frame_number": 10482, "display_filter": "frame.number == 10482", "timestamp_epoch": "1583961955.604959000" } ], "is_private": false, "observable_id": "observable-5a8bbf6ea195c14de99c72cd", "last_seen_epoch": "1583961955.604959000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961955.604959000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "40.90.22.189", "evidence": [ { "udp_stream": 178, "frame_number": 8550, "display_filter": "frame.number == 8550", "timestamp_epoch": "1583961873.974309000" }, { "udp_stream": 192, "frame_number": 10482, "display_filter": "frame.number == 10482", "timestamp_epoch": "1583961955.604959000" }, { "udp_stream": 240, "frame_number": 15441, "display_filter": "frame.number == 15441", "timestamp_epoch": "1583962381.378143000" } ], "is_private": false, "observable_id": "observable-6b77d4ed0020f8229fbd1238", "last_seen_epoch": "1583962381.378143000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961873.974309000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "40.90.22.190", "evidence": [ { "udp_stream": 404, "frame_number": 26723, "display_filter": "frame.number == 26723", "timestamp_epoch": "1583962683.965713000" } ], "is_private": false, "observable_id": "observable-b73fe1a7bbb1a93ee294edce", "last_seen_epoch": "1583962683.965713000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962683.965713000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "40.90.22.191", "evidence": [ { "udp_stream": 192, "frame_number": 10482, "display_filter": "frame.number == 10482", "timestamp_epoch": "1583961955.604959000" } ], "is_private": false, "observable_id": "observable-75ffe03a6b9baf21697950ef", "last_seen_epoch": "1583961955.604959000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961955.604959000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "40.91.76.238", "evidence": [ { "udp_stream": 194, "frame_number": 10540, "display_filter": "frame.number == 10540", "timestamp_epoch": "1583961956.376456000" }, { "udp_stream": 241, "frame_number": 15489, "display_filter": "frame.number == 15489", "timestamp_epoch": "1583962381.966088000" }, { "udp_stream": 291, "frame_number": 16385, "display_filter": "frame.number == 16385", "timestamp_epoch": "1583962545.300426000" }, { "udp_stream": 409, "frame_number": 27436, "display_filter": "frame.number == 27436", "timestamp_epoch": "1583962857.635043000" } ], "is_private": false, "observable_id": "observable-7e45f9cecbb4e8f34b395a9f", "last_seen_epoch": "1583962857.635043000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961956.376456000" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "45.148.120.153", "evidence": [], "is_private": false, "observable_id": "observable-901caf483d34c80e094d343f", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "50.87.248.17", "evidence": [ { "udp_stream": 179, "frame_number": 8612, "display_filter": "frame.number == 8612", "timestamp_epoch": "1583961876.430841000" } ], "is_private": false, "observable_id": "observable-1fa516e46dc6dd3ae28c5f77", "last_seen_epoch": "1583961876.430841000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961876.430841000" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "51.254.164.244", "evidence": [], "is_private": false, "observable_id": "observable-3448c5ac0844d4fe3525eb6b", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.0.81.73", "evidence": [ { "udp_stream": 401, "frame_number": 26535, "display_filter": "frame.number == 26535", "timestamp_epoch": "1583962661.464277000" } ], "is_private": false, "observable_id": "observable-6d7d53dc686f91852a63cb26", "last_seen_epoch": "1583962661.464277000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962661.464277000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "52.109.12.19", "evidence": [ { "udp_stream": 110, "frame_number": 3122, "display_filter": "frame.number == 3122", "timestamp_epoch": "1583961816.742544000" }, { "udp_stream": 177, "frame_number": 8543, "display_filter": "frame.number == 8543", "timestamp_epoch": "1583961873.836267000" }, { "udp_stream": 190, "frame_number": 10339, "display_filter": "frame.number == 10339", "timestamp_epoch": "1583961936.171143000" } ], "is_private": false, "observable_id": "observable-c0704f8bf8fac20faa7ada23", "last_seen_epoch": "1583961936.171143000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961816.742544000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "52.109.8.30", "evidence": [ { "udp_stream": 218, "frame_number": 14421, "display_filter": "frame.number == 14421", "timestamp_epoch": "1583962114.660248000" } ], "is_private": false, "observable_id": "observable-844d34c3d5fb2912eb4ddc53", "last_seen_epoch": "1583962114.660248000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962114.660248000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "52.109.88.36", "evidence": [ { "udp_stream": 417, "frame_number": 29846, "display_filter": "frame.number == 29846", "timestamp_epoch": "1583963487.731856000" } ], "is_private": false, "observable_id": "observable-32fe5196af63908fbfa2e48a", "last_seen_epoch": "1583963487.731856000", "enrichment_state": "not_requested", "first_seen_epoch": "1583963487.731856000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "52.114.132.73", "evidence": [ { "udp_stream": 118, "frame_number": 3706, "display_filter": "frame.number == 3706", "timestamp_epoch": "1583961824.002810000" }, { "udp_stream": 180, "frame_number": 9004, "display_filter": "frame.number == 9004", "timestamp_epoch": "1583961880.041235000" } ], "is_private": false, "observable_id": "observable-23d88c5b5d35a70fa04a56c9", "last_seen_epoch": "1583961880.041235000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961824.002810000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "52.114.77.34", "evidence": [ { "udp_stream": 28, "frame_number": 1019, "display_filter": "frame.number == 1019", "timestamp_epoch": "1583961766.602814000" }, { "udp_stream": 69, "frame_number": 2020, "display_filter": "frame.number == 2020", "timestamp_epoch": "1583961792.706361000" } ], "is_private": false, "observable_id": "observable-2d140cf426a13f83d3ad4eab", "last_seen_epoch": "1583961792.706361000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961766.602814000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "52.161.15.246", "evidence": [ { "udp_stream": 25, "frame_number": 753, "display_filter": "frame.number == 753", "timestamp_epoch": "1583961759.735456000" }, { "udp_stream": 113, "frame_number": 3231, "display_filter": "frame.number == 3231", "timestamp_epoch": "1583961817.510251000" } ], "is_private": false, "observable_id": "observable-d0d970db98d3115a5c31d6c5", "last_seen_epoch": "1583961817.510251000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961759.735456000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "52.173.134.115", "evidence": [ { "udp_stream": 202, "frame_number": 12513, "display_filter": "frame.number == 12513", "timestamp_epoch": "1583962014.306944000" } ], "is_private": false, "observable_id": "observable-8bf43c3e36b9a51fb27fe6f3", "last_seen_epoch": "1583962014.306944000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962014.306944000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "52.179.129.229", "evidence": [ { "udp_stream": 123, "frame_number": 4009, "display_filter": "frame.number == 4009", "timestamp_epoch": "1583961833.292679000" }, { "udp_stream": 131, "frame_number": 4284, "display_filter": "frame.number == 4284", "timestamp_epoch": "1583961848.817143000" } ], "is_private": false, "observable_id": "observable-382c1d8f1def7330b9eeb437", "last_seen_epoch": "1583961848.817143000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961833.292679000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.2.35.4", "evidence": [ { "udp_stream": 395, "frame_number": 26128, "display_filter": "frame.number == 26128", "timestamp_epoch": "1583962657.176778000" } ], "is_private": false, "observable_id": "observable-296bc8ca665ee8edf438cd1e", "last_seen_epoch": "1583962657.176778000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962657.176778000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.201.53.231", "evidence": [ { "udp_stream": 385, "frame_number": 26007, "display_filter": "frame.number == 26007", "timestamp_epoch": "1583962656.958475000" } ], "is_private": false, "observable_id": "observable-082d61d238beef3217627724", "last_seen_epoch": "1583962656.958475000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962656.958475000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.202.136.43", "evidence": [ { "udp_stream": 401, "frame_number": 26535, "display_filter": "frame.number == 26535", "timestamp_epoch": "1583962661.464277000" } ], "is_private": false, "observable_id": "observable-dd00cf1865319c43a6481154", "last_seen_epoch": "1583962661.464277000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962661.464277000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.202.7.233", "evidence": [ { "udp_stream": 401, "frame_number": 26535, "display_filter": "frame.number == 26535", "timestamp_epoch": "1583962661.464277000" } ], "is_private": false, "observable_id": "observable-8f75be07e9afd189e5bf14f7", "last_seen_epoch": "1583962661.464277000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962661.464277000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.204.219.227", "evidence": [ { "udp_stream": 401, "frame_number": 26535, "display_filter": "frame.number == 26535", "timestamp_epoch": "1583962661.464277000" } ], "is_private": false, "observable_id": "observable-a81bf85bd787e589c4eecac3", "last_seen_epoch": "1583962661.464277000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962661.464277000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.204.222.100", "evidence": [ { "udp_stream": 395, "frame_number": 26128, "display_filter": "frame.number == 26128", "timestamp_epoch": "1583962657.176778000" } ], "is_private": false, "observable_id": "observable-a08247ea10f2de4dd61c3990", "last_seen_epoch": "1583962657.176778000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962657.176778000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.206.178.1", "evidence": [ { "udp_stream": 228, "frame_number": 14974, "display_filter": "frame.number == 14974", "timestamp_epoch": "1583962320.197469000" } ], "is_private": false, "observable_id": "observable-f9c975b2826dad73b2e342c2", "last_seen_epoch": "1583962320.197469000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962320.197469000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.23.116.187", "evidence": [ { "udp_stream": 385, "frame_number": 26007, "display_filter": "frame.number == 26007", "timestamp_epoch": "1583962656.958475000" } ], "is_private": false, "observable_id": "observable-105cb8461e214e54e86eb4d0", "last_seen_epoch": "1583962656.958475000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962656.958475000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "52.230.220.159", "evidence": [ { "udp_stream": 236, "frame_number": 15204, "display_filter": "frame.number == 15204", "timestamp_epoch": "1583962359.660989000" }, { "udp_stream": 245, "frame_number": 15601, "display_filter": "frame.number == 15601", "timestamp_epoch": "1583962385.972448000" }, { "udp_stream": 256, "frame_number": 15923, "display_filter": "frame.number == 15923", "timestamp_epoch": "1583962416.974560000" } ], "is_private": false, "observable_id": "observable-149d49c1ff2e9bfeb32f2f16", "last_seen_epoch": "1583962416.974560000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962359.660989000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "52.230.222.68", "evidence": [ { "udp_stream": 226, "frame_number": 14921, "display_filter": "frame.number == 14921", "timestamp_epoch": "1583962319.963750000" }, { "udp_stream": 235, "frame_number": 15136, "display_filter": "frame.number == 15136", "timestamp_epoch": "1583962351.740704000" }, { "udp_stream": 238, "frame_number": 15376, "display_filter": "frame.number == 15376", "timestamp_epoch": "1583962380.292101000" }, { "udp_stream": 254, "frame_number": 15744, "display_filter": "frame.number == 15744", "timestamp_epoch": "1583962387.466826000" }, { "udp_stream": 262, "frame_number": 16114, "display_filter": "frame.number == 16114", "timestamp_epoch": "1583962434.184347000" }, { "udp_stream": 290, "frame_number": 16404, "display_filter": "frame.number == 16404", "timestamp_epoch": "1583962545.440932000" } ], "is_private": false, "observable_id": "observable-b73764d56fb3a2ebca36ce7e", "last_seen_epoch": "1583962545.440932000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962319.963750000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "52.242.211.89", "evidence": [ { "udp_stream": 196, "frame_number": 12357, "display_filter": "frame.number == 12357", "timestamp_epoch": "1583961994.711946000" }, { "udp_stream": 211, "frame_number": 14081, "display_filter": "frame.number == 14081", "timestamp_epoch": "1583962054.581731000" }, { "udp_stream": 224, "frame_number": 14741, "display_filter": "frame.number == 14741", "timestamp_epoch": "1583962291.242182000" } ], "is_private": false, "observable_id": "observable-31652b02c3300c435efdbe38", "last_seen_epoch": "1583962291.242182000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961994.711946000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.3.121.18", "evidence": [ { "udp_stream": 385, "frame_number": 26007, "display_filter": "frame.number == 26007", "timestamp_epoch": "1583962656.958475000" } ], "is_private": false, "observable_id": "observable-b0bb4dd223044664f01b3a45", "last_seen_epoch": "1583962656.958475000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962656.958475000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "52.45.33.138", "evidence": [ { "udp_stream": 398, "frame_number": 26392, "display_filter": "frame.number == 26392", "timestamp_epoch": "1583962657.788154000" } ], "is_private": false, "observable_id": "observable-3f343eb9c68cb1316e5e9509", "last_seen_epoch": "1583962657.788154000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962657.788154000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.70.73.113", "evidence": [ { "udp_stream": 389, "frame_number": 26098, "display_filter": "frame.number == 26098", "timestamp_epoch": "1583962657.137080000" } ], "is_private": false, "observable_id": "observable-2b831c66817e906a0f82696b", "last_seen_epoch": "1583962657.137080000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962657.137080000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.73.178.122", "evidence": [ { "udp_stream": 395, "frame_number": 26128, "display_filter": "frame.number == 26128", "timestamp_epoch": "1583962657.176778000" } ], "is_private": false, "observable_id": "observable-2a237f3c00e4e967e33c589b", "last_seen_epoch": "1583962657.176778000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962657.176778000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "52.9.108.55", "evidence": [ { "udp_stream": 145, "frame_number": 4543, "display_filter": "frame.number == 4543", "timestamp_epoch": "1583961854.926971000" }, { "udp_stream": 281, "frame_number": 16284, "display_filter": "frame.number == 16284", "timestamp_epoch": "1583962457.871573000" }, { "udp_stream": 311, "frame_number": 21128, "display_filter": "frame.number == 21128", "timestamp_epoch": "1583962650.340100000" } ], "is_private": false, "observable_id": "observable-13ce1334882546a703581865", "last_seen_epoch": "1583962650.340100000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961854.926971000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.98.73.210", "evidence": [ { "udp_stream": 66, "frame_number": 1898, "display_filter": "frame.number == 1898", "timestamp_epoch": "1583961789.286717000" } ], "is_private": false, "observable_id": "observable-87757fb77355128439b9297f", "last_seen_epoch": "1583961789.286717000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961789.286717000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "52.98.73.226", "evidence": [ { "udp_stream": 66, "frame_number": 1898, "display_filter": "frame.number == 1898", "timestamp_epoch": "1583961789.286717000" } ], "is_private": false, "observable_id": "observable-15663109298445f0b0489145", "last_seen_epoch": "1583961789.286717000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961789.286717000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.98.73.242", "evidence": [ { "udp_stream": 66, "frame_number": 1898, "display_filter": "frame.number == 1898", "timestamp_epoch": "1583961789.286717000" } ], "is_private": false, "observable_id": "observable-80b5ebca70f2b14d43837e7d", "last_seen_epoch": "1583961789.286717000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961789.286717000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.98.77.66", "evidence": [ { "udp_stream": 66, "frame_number": 1898, "display_filter": "frame.number == 1898", "timestamp_epoch": "1583961789.286717000" } ], "is_private": false, "observable_id": "observable-5e38c9d3e1f05862a63a4235", "last_seen_epoch": "1583961789.286717000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961789.286717000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.98.77.82", "evidence": [ { "udp_stream": 66, "frame_number": 1898, "display_filter": "frame.number == 1898", "timestamp_epoch": "1583961789.286717000" } ], "is_private": false, "observable_id": "observable-7885680650d446cb8e40f569", "last_seen_epoch": "1583961789.286717000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961789.286717000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.98.80.210", "evidence": [ { "udp_stream": 66, "frame_number": 1898, "display_filter": "frame.number == 1898", "timestamp_epoch": "1583961789.286717000" } ], "is_private": false, "observable_id": "observable-46cdf533a8ccf34a41a1ee6a", "last_seen_epoch": "1583961789.286717000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961789.286717000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.98.81.178", "evidence": [ { "udp_stream": 66, "frame_number": 1898, "display_filter": "frame.number == 1898", "timestamp_epoch": "1583961789.286717000" } ], "is_private": false, "observable_id": "observable-8de04fe6c964dfafd4738ed5", "last_seen_epoch": "1583961789.286717000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961789.286717000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.98.81.2", "evidence": [ { "udp_stream": 66, "frame_number": 1898, "display_filter": "frame.number == 1898", "timestamp_epoch": "1583961789.286717000" } ], "is_private": false, "observable_id": "observable-b6e773759ee8f83e2ca88c0f", "last_seen_epoch": "1583961789.286717000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961789.286717000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.98.93.2", "evidence": [ { "udp_stream": 66, "frame_number": 1898, "display_filter": "frame.number == 1898", "timestamp_epoch": "1583961789.286717000" } ], "is_private": false, "observable_id": "observable-d401b9d080f87c39fe6294e6", "last_seen_epoch": "1583961789.286717000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961789.286717000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "54.153.98.238", "evidence": [ { "udp_stream": 145, "frame_number": 4543, "display_filter": "frame.number == 4543", "timestamp_epoch": "1583961854.926971000" }, { "udp_stream": 281, "frame_number": 16284, "display_filter": "frame.number == 16284", "timestamp_epoch": "1583962457.871573000" }, { "udp_stream": 311, "frame_number": 21128, "display_filter": "frame.number == 21128", "timestamp_epoch": "1583962650.340100000" } ], "is_private": false, "observable_id": "observable-c905906a982fb82f9af661d4", "last_seen_epoch": "1583962650.340100000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961854.926971000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.173.98.209", "evidence": [ { "udp_stream": 395, "frame_number": 26128, "display_filter": "frame.number == 26128", "timestamp_epoch": "1583962657.176778000" } ], "is_private": false, "observable_id": "observable-011d56c6b0c2e29279ffc532", "last_seen_epoch": "1583962657.176778000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962657.176778000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.175.87.114", "evidence": [ { "udp_stream": 398, "frame_number": 26392, "display_filter": "frame.number == 26392", "timestamp_epoch": "1583962657.788154000" } ], "is_private": false, "observable_id": "observable-ba092c79f590d914609ddf66", "last_seen_epoch": "1583962657.788154000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962657.788154000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.197.51.7", "evidence": [ { "udp_stream": 389, "frame_number": 26098, "display_filter": "frame.number == 26098", "timestamp_epoch": "1583962657.137080000" } ], "is_private": false, "observable_id": "observable-739a1b04a5e2d8e490e3a9c3", "last_seen_epoch": "1583962657.137080000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962657.137080000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.213.212.101", "evidence": [ { "udp_stream": 402, "frame_number": 26577, "display_filter": "frame.number == 26577", "timestamp_epoch": "1583962661.873966000" } ], "is_private": false, "observable_id": "observable-841104cd06b068235b239530", "last_seen_epoch": "1583962661.873966000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962661.873966000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "54.244.36.123", "evidence": [ { "udp_stream": 402, "frame_number": 26577, "display_filter": "frame.number == 26577", "timestamp_epoch": "1583962661.873966000" } ], "is_private": false, "observable_id": "observable-f7a9c523ffe4ab9176320edd", "last_seen_epoch": "1583962661.873966000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962661.873966000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.68.183.142", "evidence": [ { "udp_stream": 402, "frame_number": 26577, "display_filter": "frame.number == 26577", "timestamp_epoch": "1583962661.873966000" } ], "is_private": false, "observable_id": "observable-1925176da8b005304f178a61", "last_seen_epoch": "1583962661.873966000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962661.873966000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.83.179.223", "evidence": [ { "udp_stream": 386, "frame_number": 26010, "display_filter": "frame.number == 26010", "timestamp_epoch": "1583962656.960973000" } ], "is_private": false, "observable_id": "observable-cde9406325fb1e81bb2a7fb1", "last_seen_epoch": "1583962656.960973000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962656.960973000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.83.97.43", "evidence": [ { "udp_stream": 385, "frame_number": 26007, "display_filter": "frame.number == 26007", "timestamp_epoch": "1583962656.958475000" } ], "is_private": false, "observable_id": "observable-515ebb6775fc345726119657", "last_seen_epoch": "1583962656.958475000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962656.958475000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.86.220.14", "evidence": [ { "udp_stream": 386, "frame_number": 26010, "display_filter": "frame.number == 26010", "timestamp_epoch": "1583962656.960973000" } ], "is_private": false, "observable_id": "observable-c0866de89a145dbcc5058eb3", "last_seen_epoch": "1583962656.960973000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962656.960973000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "63.148.46.76", "evidence": [ { "udp_stream": 370, "frame_number": 25244, "display_filter": "frame.number == 25244", "timestamp_epoch": "1583962655.496790000" } ], "is_private": false, "observable_id": "observable-78cc5ffa294e3dc95a58cdc9", "last_seen_epoch": "1583962655.496790000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962655.496790000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "64.4.54.254", "evidence": [ { "udp_stream": 205, "frame_number": 12946, "display_filter": "frame.number == 12946", "timestamp_epoch": "1583962015.928169000" } ], "is_private": false, "observable_id": "observable-2b5322d3090e87ff1451242d", "last_seen_epoch": "1583962015.928169000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962015.928169000" }, { "type": "ipv4", "roles": [ "http-host", "network-endpoint" ], "value": "64.44.133.131", "evidence": [ { "tcp_stream": 434, "frame_number": 18431, "display_filter": "frame.number == 18431", "timestamp_epoch": "1583962605.820456000" }, { "tcp_stream": 434, "frame_number": 19014, "display_filter": "frame.number == 19014", "timestamp_epoch": "1583962612.268574000" }, { "tcp_stream": 450, "frame_number": 19562, "display_filter": "frame.number == 19562", "timestamp_epoch": "1583962617.337739000" } ], "is_private": false, "observable_id": "observable-f0ae0595f3e5d7ee92b7e4a8", "last_seen_epoch": "1583962617.337739000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962605.820456000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "65.254.227.240", "evidence": [ { "udp_stream": 207, "frame_number": 13302, "display_filter": "frame.number == 13302", "timestamp_epoch": "1583962027.252924000" }, { "udp_stream": 209, "frame_number": 13391, "display_filter": "frame.number == 13391", "timestamp_epoch": "1583962027.518423000" } ], "is_private": false, "observable_id": "observable-a832b5529f07b9238f3eca48", "last_seen_epoch": "1583962027.518423000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962027.252924000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "67.27.98.254", "evidence": [ { "udp_stream": 189, "frame_number": 10325, "display_filter": "frame.number == 10325", "timestamp_epoch": "1583961934.209558000" } ], "is_private": false, "observable_id": "observable-266225aa53818a8996c40267", "last_seen_epoch": "1583961934.209558000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961934.209558000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "67.27.99.254", "evidence": [ { "udp_stream": 189, "frame_number": 10325, "display_filter": "frame.number == 10325", "timestamp_epoch": "1583961934.209558000" } ], "is_private": false, "observable_id": "observable-6b5fcf86249dd1e55c8f6d7b", "last_seen_epoch": "1583961934.209558000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961934.209558000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "72.167.191.69", "evidence": [ { "udp_stream": 136, "frame_number": 4348, "display_filter": "frame.number == 4348", "timestamp_epoch": "1583961854.572439000" }, { "udp_stream": 148, "frame_number": 4916, "display_filter": "frame.number == 4916", "timestamp_epoch": "1583961856.009855000" }, { "udp_stream": 326, "frame_number": 21211, "display_filter": "frame.number == 21211", "timestamp_epoch": "1583962650.607967000" } ], "is_private": false, "observable_id": "observable-6d3d535011aa12da5a499567", "last_seen_epoch": "1583962650.607967000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961854.572439000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "72.21.81.200", "evidence": [ { "udp_stream": 126, "frame_number": 4063, "display_filter": "frame.number == 4063", "timestamp_epoch": "1583961837.210365000" } ], "is_private": false, "observable_id": "observable-f9e110a17e3abe42402d2476", "last_seen_epoch": "1583961837.210365000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961837.210365000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "72.21.91.29", "evidence": [ { "udp_stream": 193, "frame_number": 10496, "display_filter": "frame.number == 10496", "timestamp_epoch": "1583961955.805772000" } ], "is_private": false, "observable_id": "observable-2d15c69530a7d6f765352cca", "last_seen_epoch": "1583961955.805772000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961955.805772000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "72.21.91.66", "evidence": [ { "udp_stream": 156, "frame_number": 6069, "display_filter": "frame.number == 6069", "timestamp_epoch": "1583961857.209794000" }, { "udp_stream": 321, "frame_number": 21194, "display_filter": "frame.number == 21194", "timestamp_epoch": "1583962650.527524000" } ], "is_private": false, "observable_id": "observable-0145cd1ecc3af00f7412298a", "last_seen_epoch": "1583962650.527524000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961857.209794000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "72.246.84.150", "evidence": [ { "udp_stream": 146, "frame_number": 4544, "display_filter": "frame.number == 4544", "timestamp_epoch": "1583961854.927021000" }, { "udp_stream": 138, "frame_number": 5213, "display_filter": "frame.number == 5213", "timestamp_epoch": "1583961856.360527000" }, { "udp_stream": 151, "frame_number": 5227, "display_filter": "frame.number == 5227", "timestamp_epoch": "1583961856.360811000" }, { "udp_stream": 153, "frame_number": 5937, "display_filter": "frame.number == 5937", "timestamp_epoch": "1583961856.889136000" }, { "udp_stream": 309, "frame_number": 21127, "display_filter": "frame.number == 21127", "timestamp_epoch": "1583962650.340042000" }, { "udp_stream": 322, "frame_number": 21187, "display_filter": "frame.number == 21187", "timestamp_epoch": "1583962650.507613000" }, { "udp_stream": 324, "frame_number": 21204, "display_filter": "frame.number == 21204", "timestamp_epoch": "1583962650.557545000" } ], "is_private": false, "observable_id": "observable-83e0e6eb8c3fd268f10dee36", "last_seen_epoch": "1583962650.557545000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961854.927021000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "72.246.84.229", "evidence": [ { "udp_stream": 323, "frame_number": 21195, "display_filter": "frame.number == 21195", "timestamp_epoch": "1583962650.527591000" }, { "udp_stream": 330, "frame_number": 21289, "display_filter": "frame.number == 21289", "timestamp_epoch": "1583962650.943689000" }, { "udp_stream": 329, "frame_number": 21290, "display_filter": "frame.number == 21290", "timestamp_epoch": "1583962650.943765000" }, { "udp_stream": 333, "frame_number": 21364, "display_filter": "frame.number == 21364", "timestamp_epoch": "1583962651.000088000" }, { "udp_stream": 331, "frame_number": 21376, "display_filter": "frame.number == 21376", "timestamp_epoch": "1583962651.053207000" }, { "udp_stream": 337, "frame_number": 21385, "display_filter": "frame.number == 21385", "timestamp_epoch": "1583962651.092134000" }, { "udp_stream": 334, "frame_number": 21479, "display_filter": "frame.number == 21479", "timestamp_epoch": "1583962651.129702000" }, { "udp_stream": 340, "frame_number": 21486, "display_filter": "frame.number == 21486", "timestamp_epoch": "1583962651.132407000" }, { "udp_stream": 339, "frame_number": 21566, "display_filter": "frame.number == 21566", "timestamp_epoch": "1583962651.194645000" }, { "udp_stream": 341, "frame_number": 21634, "display_filter": "frame.number == 21634", "timestamp_epoch": "1583962651.199027000" } ], "is_private": false, "observable_id": "observable-adbbfb70d7b4cca1d3ac730a", "last_seen_epoch": "1583962651.199027000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962650.527591000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "8.253.112.120", "evidence": [ { "udp_stream": 189, "frame_number": 10325, "display_filter": "frame.number == 10325", "timestamp_epoch": "1583961934.209558000" } ], "is_private": false, "observable_id": "observable-05be0fd501cf93d815b15d11", "last_seen_epoch": "1583961934.209558000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961934.209558000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "8.253.164.240", "evidence": [ { "udp_stream": 189, "frame_number": 10325, "display_filter": "frame.number == 10325", "timestamp_epoch": "1583961934.209558000" } ], "is_private": false, "observable_id": "observable-b20149df43cda8a66537d7c4", "last_seen_epoch": "1583961934.209558000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961934.209558000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "8.253.164.248", "evidence": [ { "udp_stream": 189, "frame_number": 10325, "display_filter": "frame.number == 10325", "timestamp_epoch": "1583961934.209558000" } ], "is_private": false, "observable_id": "observable-c981880b162c784cdab9eb2e", "last_seen_epoch": "1583961934.209558000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961934.209558000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "8.43.72.97", "evidence": [ { "udp_stream": 390, "frame_number": 26082, "display_filter": "frame.number == 26082", "timestamp_epoch": "1583962657.125860000" } ], "is_private": false, "observable_id": "observable-e99f7359be9d982b795daadb", "last_seen_epoch": "1583962657.125860000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962657.125860000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "8.43.72.98", "evidence": [ { "udp_stream": 390, "frame_number": 26082, "display_filter": "frame.number == 26082", "timestamp_epoch": "1583962657.125860000" } ], "is_private": false, "observable_id": "observable-fee7e5ceb1c600cc1b3dde8a", "last_seen_epoch": "1583962657.125860000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962657.125860000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "89.187.164.37", "evidence": [ { "udp_stream": 387, "frame_number": 26089, "display_filter": "frame.number == 26089", "timestamp_epoch": "1583962657.131237000" } ], "is_private": false, "observable_id": "observable-efbb0da9faee18dd3c7e6c7d", "last_seen_epoch": "1583962657.131237000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962657.131237000" }, { "type": "ja3", "roles": [ "tls-client-fingerprint" ], "value": "0ae18052c288c1bd39910255598ed827", "evidence": [ { "tcp_stream": 513, "frame_number": 25255, "display_filter": "frame.number == 25255", "timestamp_epoch": "1583962655.507108000" }, { "tcp_stream": 530, "frame_number": 25891, "display_filter": "frame.number == 25891", "timestamp_epoch": "1583962656.695963000" } ], "is_private": null, "observable_id": "observable-2898c719395d07f48f7411f5", "last_seen_epoch": "1583962656.695963000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962655.507108000" }, { "type": "ja3", "roles": [ "tls-client-fingerprint" ], "value": "10ee8d30a5d01c042afd7b2b205facc4", "evidence": [ { "tcp_stream": 189, "frame_number": 4042, "display_filter": "frame.number == 4042", "timestamp_epoch": "1583961837.147559000" }, { "tcp_stream": 190, "frame_number": 4061, "display_filter": "frame.number == 4061", "timestamp_epoch": "1583961837.193573000" }, { "tcp_stream": 191, "frame_number": 4078, "display_filter": "frame.number == 4078", "timestamp_epoch": "1583961837.245010000" }, { "tcp_stream": 192, "frame_number": 4084, "display_filter": "frame.number == 4084", "timestamp_epoch": "1583961837.246764000" } ], "is_private": null, "observable_id": "observable-621ac377a3addb50bee1f7ae", "last_seen_epoch": "1583961837.246764000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961837.147559000" }, { "type": "ja3", "roles": [ "tls-client-fingerprint" ], "value": "28a2c9bd18a11de089ef85a160da29e4", "evidence": [ { "tcp_stream": 27, "frame_number": 530, "display_filter": "frame.number == 530", "timestamp_epoch": "1583961757.985150000" }, { "tcp_stream": 31, "frame_number": 636, "display_filter": "frame.number == 636", "timestamp_epoch": "1583961758.676091000" }, { "tcp_stream": 33, "frame_number": 662, "display_filter": "frame.number == 662", "timestamp_epoch": "1583961759.168742000" }, { "tcp_stream": 34, "frame_number": 687, "display_filter": "frame.number == 687", "timestamp_epoch": "1583961759.341157000" }, { "tcp_stream": 35, "frame_number": 697, "display_filter": "frame.number == 697", "timestamp_epoch": "1583961759.392332000" }, { "tcp_stream": 37, "frame_number": 728, "display_filter": "frame.number == 728", "timestamp_epoch": "1583961759.638476000" }, { "tcp_stream": 36, "frame_number": 730, "display_filter": "frame.number == 730", "timestamp_epoch": "1583961759.638656000" }, { "tcp_stream": 38, "frame_number": 763, "display_filter": "frame.number == 763", "timestamp_epoch": "1583961759.819059000" }, { "tcp_stream": 39, "frame_number": 792, "display_filter": "frame.number == 792", "timestamp_epoch": "1583961760.021836000" }, { "tcp_stream": 41, "frame_number": 794, "display_filter": "frame.number == 794", "timestamp_epoch": "1583961760.022112000" }, { "tcp_stream": 40, "frame_number": 799, "display_filter": "frame.number == 799", "timestamp_epoch": "1583961760.022422000" }, { "tcp_stream": 42, "frame_number": 868, "display_filter": "frame.number == 868", "timestamp_epoch": "1583961760.475144000" }, { "tcp_stream": 43, "frame_number": 883, "display_filter": "frame.number == 883", "timestamp_epoch": "1583961760.712168000" }, { "tcp_stream": 44, "frame_number": 904, "display_filter": "frame.number == 904", "timestamp_epoch": "1583961760.850310000" }, { "tcp_stream": 142, "frame_number": 3011, "display_filter": "frame.number == 3011", "timestamp_epoch": "1583961815.375939000" }, { "tcp_stream": 148, "frame_number": 3126, "display_filter": "frame.number == 3126", "timestamp_epoch": "1583961816.796778000" }, { "tcp_stream": 147, "frame_number": 3145, "display_filter": "frame.number == 3145", "timestamp_epoch": "1583961817.068136000" }, { "tcp_stream": 149, "frame_number": 3169, "display_filter": "frame.number == 3169", "timestamp_epoch": "1583961817.254324000" }, { "tcp_stream": 151, "frame_number": 3196, "display_filter": "frame.number == 3196", "timestamp_epoch": "1583961817.414873000" }, { "tcp_stream": 150, "frame_number": 3197, "display_filter": "frame.number == 3197", "timestamp_epoch": "1583961817.414916000" } ], "is_private": null, "observable_id": "observable-2f90069c6930912268518362", "last_seen_epoch": "1583964262.889030000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961757.985150000" }, { "type": "ja3", "roles": [ "tls-client-fingerprint" ], "value": "37f463bf4616ecd445d4a1937da06e19", "evidence": [ { "tcp_stream": 260, "frame_number": 9010, "display_filter": "frame.number == 9010", "timestamp_epoch": "1583961880.113934000" }, { "tcp_stream": 373, "frame_number": 14512, "display_filter": "frame.number == 14512", "timestamp_epoch": "1583962155.990990000" }, { "tcp_stream": 592, "frame_number": 28325, "display_filter": "frame.number == 28325", "timestamp_epoch": "1583963031.337903000" }, { "tcp_stream": 593, "frame_number": 28568, "display_filter": "frame.number == 28568", "timestamp_epoch": "1583963032.456885000" }, { "tcp_stream": 595, "frame_number": 28593, "display_filter": "frame.number == 28593", "timestamp_epoch": "1583963038.380480000" }, { "tcp_stream": 598, "frame_number": 28731, "display_filter": "frame.number == 28731", "timestamp_epoch": "1583963044.340672000" }, { "tcp_stream": 599, "frame_number": 28754, "display_filter": "frame.number == 28754", "timestamp_epoch": "1583963050.026088000" }, { "tcp_stream": 603, "frame_number": 28800, "display_filter": "frame.number == 28800", "timestamp_epoch": "1583963055.686781000" }, { "tcp_stream": 605, "frame_number": 28824, "display_filter": "frame.number == 28824", "timestamp_epoch": "1583963061.330535000" }, { "tcp_stream": 607, "frame_number": 28851, "display_filter": "frame.number == 28851", "timestamp_epoch": "1583963066.986810000" }, { "tcp_stream": 608, "frame_number": 28874, "display_filter": "frame.number == 28874", "timestamp_epoch": "1583963072.718134000" }, { "tcp_stream": 610, "frame_number": 29109, "display_filter": "frame.number == 29109", "timestamp_epoch": "1583963076.561312000" }, { "tcp_stream": 612, "frame_number": 29140, "display_filter": "frame.number == 29140", "timestamp_epoch": "1583963082.191127000" }, { "tcp_stream": 613, "frame_number": 29157, "display_filter": "frame.number == 29157", "timestamp_epoch": "1583963082.833470000" }, { "tcp_stream": 615, "frame_number": 29188, "display_filter": "frame.number == 29188", "timestamp_epoch": "1583963088.543433000" }, { "tcp_stream": 619, "frame_number": 29237, "display_filter": "frame.number == 29237", "timestamp_epoch": "1583963094.199022000" }, { "tcp_stream": 620, "frame_number": 29254, "display_filter": "frame.number == 29254", "timestamp_epoch": "1583963099.794939000" }, { "tcp_stream": 623, "frame_number": 29297, "display_filter": "frame.number == 29297", "timestamp_epoch": "1583963105.686170000" }, { "tcp_stream": 625, "frame_number": 29330, "display_filter": "frame.number == 29330", "timestamp_epoch": "1583963111.295175000" }, { "tcp_stream": 627, "frame_number": 29359, "display_filter": "frame.number == 29359", "timestamp_epoch": "1583963116.920691000" } ], "is_private": null, "observable_id": "observable-583081f5dae7866c27228174", "last_seen_epoch": "1583963123.115052000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961880.113934000" }, { "type": "ja3", "roles": [ "tls-client-fingerprint" ], "value": "3b5074b1b5d032e5620f69f9f700ff0e", "evidence": [ { "tcp_stream": 320, "frame_number": 12361, "display_filter": "frame.number == 12361", "timestamp_epoch": "1583961994.771137000" }, { "tcp_stream": 359, "frame_number": 14085, "display_filter": "frame.number == 14085", "timestamp_epoch": "1583962054.624999000" }, { "tcp_stream": 380, "frame_number": 14752, "display_filter": "frame.number == 14752", "timestamp_epoch": "1583962291.287376000" }, { "tcp_stream": 388, "frame_number": 14936, "display_filter": "frame.number == 14936", "timestamp_epoch": "1583962320.006168000" }, { "tcp_stream": 392, "frame_number": 15140, "display_filter": "frame.number == 15140", "timestamp_epoch": "1583962351.787373000" }, { "tcp_stream": 395, "frame_number": 15382, "display_filter": "frame.number == 15382", "timestamp_epoch": "1583962380.339986000" }, { "tcp_stream": 408, "frame_number": 15752, "display_filter": "frame.number == 15752", "timestamp_epoch": "1583962387.508138000" }, { "tcp_stream": 412, "frame_number": 16118, "display_filter": "frame.number == 16118", "timestamp_epoch": "1583962434.543570000" }, { "tcp_stream": 418, "frame_number": 16408, "display_filter": "frame.number == 16408", "timestamp_epoch": "1583962545.481010000" }, { "tcp_stream": 419, "frame_number": 16449, "display_filter": "frame.number == 16449", "timestamp_epoch": "1583962545.791547000" } ], "is_private": null, "observable_id": "observable-4c1cecb17ec757ff68ff7816", "last_seen_epoch": "1583962545.791547000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961994.771137000" }, { "type": "ja3", "roles": [ "tls-client-fingerprint" ], "value": "554719594ba90b02ae410c297c6e50ad", "evidence": [ { "tcp_stream": 493, "frame_number": 23124, "display_filter": "frame.number == 23124", "timestamp_epoch": "1583962651.740172000" }, { "tcp_stream": 494, "frame_number": 23172, "display_filter": "frame.number == 23172", "timestamp_epoch": "1583962651.760798000" } ], "is_private": null, "observable_id": "observable-911ccb2ec2f66251907a83a7", "last_seen_epoch": "1583962651.760798000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962651.740172000" }, { "type": "ja3", "roles": [ "tls-client-fingerprint" ], "value": "66918128f1b9b03303d77c6f2eefd128", "evidence": [ { "tcp_stream": 199, "frame_number": 4346, "display_filter": "frame.number == 4346", "timestamp_epoch": "1583961854.558232000" }, { "tcp_stream": 202, "frame_number": 4402, "display_filter": "frame.number == 4402", "timestamp_epoch": "1583961854.778012000" }, { "tcp_stream": 203, "frame_number": 4406, "display_filter": "frame.number == 4406", "timestamp_epoch": "1583961854.782581000" }, { "tcp_stream": 204, "frame_number": 4410, "display_filter": "frame.number == 4410", "timestamp_epoch": "1583961854.790146000" }, { "tcp_stream": 209, "frame_number": 4473, "display_filter": "frame.number == 4473", "timestamp_epoch": "1583961854.850374000" }, { "tcp_stream": 213, "frame_number": 4483, "display_filter": "frame.number == 4483", "timestamp_epoch": "1583961854.852181000" }, { "tcp_stream": 214, "frame_number": 4494, "display_filter": "frame.number == 4494", "timestamp_epoch": "1583961854.862048000" }, { "tcp_stream": 217, "frame_number": 4563, "display_filter": "frame.number == 4563", "timestamp_epoch": "1583961854.999425000" }, { "tcp_stream": 218, "frame_number": 4572, "display_filter": "frame.number == 4572", "timestamp_epoch": "1583961855.058332000" }, { "tcp_stream": 219, "frame_number": 4731, "display_filter": "frame.number == 4731", "timestamp_epoch": "1583961855.227464000" }, { "tcp_stream": 229, "frame_number": 5234, "display_filter": "frame.number == 5234", "timestamp_epoch": "1583961856.361784000" }, { "tcp_stream": 228, "frame_number": 5236, "display_filter": "frame.number == 5236", "timestamp_epoch": "1583961856.362025000" }, { "tcp_stream": 227, "frame_number": 5238, "display_filter": "frame.number == 5238", "timestamp_epoch": "1583961856.362599000" }, { "tcp_stream": 226, "frame_number": 5240, "display_filter": "frame.number == 5240", "timestamp_epoch": "1583961856.362849000" }, { "tcp_stream": 225, "frame_number": 5242, "display_filter": "frame.number == 5242", "timestamp_epoch": "1583961856.363062000" }, { "tcp_stream": 230, "frame_number": 5257, "display_filter": "frame.number == 5257", "timestamp_epoch": "1583961856.395511000" }, { "tcp_stream": 235, "frame_number": 6025, "display_filter": "frame.number == 6025", "timestamp_epoch": "1583961857.085776000" }, { "tcp_stream": 233, "frame_number": 6063, "display_filter": "frame.number == 6063", "timestamp_epoch": "1583961857.209451000" }, { "tcp_stream": 236, "frame_number": 6070, "display_filter": "frame.number == 6070", "timestamp_epoch": "1583961857.209880000" }, { "tcp_stream": 234, "frame_number": 6072, "display_filter": "frame.number == 6072", "timestamp_epoch": "1583961857.210102000" } ], "is_private": null, "observable_id": "observable-a976a4bc3aeac7a182e9e39c", "last_seen_epoch": "1583962663.632257000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961854.558232000" }, { "type": "ja3", "roles": [ "tls-client-fingerprint" ], "value": "72a589da586844d7f0818ce684948eea", "evidence": [ { "tcp_stream": 385, "frame_number": 14837, "display_filter": "frame.number == 14837", "timestamp_epoch": "1583962318.356428000" }, { "tcp_stream": 386, "frame_number": 14905, "display_filter": "frame.number == 14905", "timestamp_epoch": "1583962319.541662000" }, { "tcp_stream": 391, "frame_number": 15091, "display_filter": "frame.number == 15091", "timestamp_epoch": "1583962328.193347000" }, { "tcp_stream": 426, "frame_number": 16623, "display_filter": "frame.number == 16623", "timestamp_epoch": "1583962553.540512000" }, { "tcp_stream": 427, "frame_number": 17529, "display_filter": "frame.number == 17529", "timestamp_epoch": "1583962556.162562000" }, { "tcp_stream": 428, "frame_number": 17553, "display_filter": "frame.number == 17553", "timestamp_epoch": "1583962558.378835000" }, { "tcp_stream": 460, "frame_number": 20684, "display_filter": "frame.number == 20684", "timestamp_epoch": "1583962621.648089000" }, { "tcp_stream": 573, "frame_number": 27568, "display_filter": "frame.number == 27568", "timestamp_epoch": "1583962932.874828000" }, { "tcp_stream": 574, "frame_number": 27581, "display_filter": "frame.number == 27581", "timestamp_epoch": "1583962934.022591000" }, { "tcp_stream": 575, "frame_number": 27612, "display_filter": "frame.number == 27612", "timestamp_epoch": "1583962937.710734000" }, { "tcp_stream": 597, "frame_number": 28626, "display_filter": "frame.number == 28626", "timestamp_epoch": "1583963042.872381000" } ], "is_private": null, "observable_id": "observable-344b1c43f9d0400dcdf79702", "last_seen_epoch": "1583963042.872381000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962318.356428000" }, { "type": "ja3", "roles": [ "tls-client-fingerprint" ], "value": "9e10692f1b7f78228b2d4e424db3a98c", "evidence": [ { "tcp_stream": 88, "frame_number": 1808, "display_filter": "frame.number == 1808", "timestamp_epoch": "1583961788.875575000" }, { "tcp_stream": 89, "frame_number": 1830, "display_filter": "frame.number == 1830", "timestamp_epoch": "1583961789.129686000" }, { "tcp_stream": 90, "frame_number": 1848, "display_filter": "frame.number == 1848", "timestamp_epoch": "1583961789.173140000" }, { "tcp_stream": 91, "frame_number": 1865, "display_filter": "frame.number == 1865", "timestamp_epoch": "1583961789.206292000" }, { "tcp_stream": 92, "frame_number": 1892, "display_filter": "frame.number == 1892", "timestamp_epoch": "1583961789.278144000" }, { "tcp_stream": 93, "frame_number": 1896, "display_filter": "frame.number == 1896", "timestamp_epoch": "1583961789.281231000" }, { "tcp_stream": 94, "frame_number": 1940, "display_filter": "frame.number == 1940", "timestamp_epoch": "1583961789.543776000" }, { "tcp_stream": 111, "frame_number": 2285, "display_filter": "frame.number == 2285", "timestamp_epoch": "1583961806.201646000" }, { "tcp_stream": 112, "frame_number": 2309, "display_filter": "frame.number == 2309", "timestamp_epoch": "1583961806.316069000" }, { "tcp_stream": 116, "frame_number": 2350, "display_filter": "frame.number == 2350", "timestamp_epoch": "1583961806.556626000" }, { "tcp_stream": 114, "frame_number": 2352, "display_filter": "frame.number == 2352", "timestamp_epoch": "1583961806.556962000" }, { "tcp_stream": 115, "frame_number": 2371, "display_filter": "frame.number == 2371", "timestamp_epoch": "1583961806.629972000" }, { "tcp_stream": 113, "frame_number": 2373, "display_filter": "frame.number == 2373", "timestamp_epoch": "1583961806.630592000" }, { "tcp_stream": 117, "frame_number": 2397, "display_filter": "frame.number == 2397", "timestamp_epoch": "1583961806.671116000" }, { "tcp_stream": 187, "frame_number": 3984, "display_filter": "frame.number == 3984", "timestamp_epoch": "1583961832.930417000" }, { "tcp_stream": 188, "frame_number": 4013, "display_filter": "frame.number == 4013", "timestamp_epoch": "1583961833.340258000" }, { "tcp_stream": 197, "frame_number": 4261, "display_filter": "frame.number == 4261", "timestamp_epoch": "1583961848.585761000" }, { "tcp_stream": 198, "frame_number": 4288, "display_filter": "frame.number == 4288", "timestamp_epoch": "1583961848.891023000" }, { "tcp_stream": 255, "frame_number": 8142, "display_filter": "frame.number == 8142", "timestamp_epoch": "1583961870.514628000" }, { "tcp_stream": 270, "frame_number": 10361, "display_filter": "frame.number == 10361", "timestamp_epoch": "1583961938.572660000" } ], "is_private": null, "observable_id": "observable-deabea121bc477c6c9747a7a", "last_seen_epoch": "1583963186.465756000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961788.875575000" }, { "type": "ja3", "roles": [ "tls-client-fingerprint" ], "value": "a0e9f5d64349fb13191bc781f81f42e1", "evidence": [ { "tcp_stream": 50, "frame_number": 1023, "display_filter": "frame.number == 1023", "timestamp_epoch": "1583961766.883291000" }, { "tcp_stream": 99, "frame_number": 2024, "display_filter": "frame.number == 2024", "timestamp_epoch": "1583961792.836242000" }, { "tcp_stream": 174, "frame_number": 3703, "display_filter": "frame.number == 3703", "timestamp_epoch": "1583961823.830970000" }, { "tcp_stream": 175, "frame_number": 3710, "display_filter": "frame.number == 3710", "timestamp_epoch": "1583961824.060099000" }, { "tcp_stream": 269, "frame_number": 10343, "display_filter": "frame.number == 10343", "timestamp_epoch": "1583961936.268519000" }, { "tcp_stream": 365, "frame_number": 14262, "display_filter": "frame.number == 14262", "timestamp_epoch": "1583962086.400945000" }, { "tcp_stream": 366, "frame_number": 14319, "display_filter": "frame.number == 14319", "timestamp_epoch": "1583962112.351640000" }, { "tcp_stream": 372, "frame_number": 14483, "display_filter": "frame.number == 14483", "timestamp_epoch": "1583962143.682391000" }, { "tcp_stream": 558, "frame_number": 26770, "display_filter": "frame.number == 26770", "timestamp_epoch": "1583962684.378942000" }, { "tcp_stream": 559, "frame_number": 26799, "display_filter": "frame.number == 26799", "timestamp_epoch": "1583962685.627144000" }, { "tcp_stream": 560, "frame_number": 26833, "display_filter": "frame.number == 26833", "timestamp_epoch": "1583962685.853264000" }, { "tcp_stream": 561, "frame_number": 26853, "display_filter": "frame.number == 26853", "timestamp_epoch": "1583962685.883420000" }, { "tcp_stream": 562, "frame_number": 26855, "display_filter": "frame.number == 26855", "timestamp_epoch": "1583962685.883687000" }, { "tcp_stream": 563, "frame_number": 26857, "display_filter": "frame.number == 26857", "timestamp_epoch": "1583962685.883957000" }, { "tcp_stream": 565, "frame_number": 27318, "display_filter": "frame.number == 27318", "timestamp_epoch": "1583962732.931229000" }, { "tcp_stream": 566, "frame_number": 27331, "display_filter": "frame.number == 27331", "timestamp_epoch": "1583962732.970807000" }, { "tcp_stream": 589, "frame_number": 27780, "display_filter": "frame.number == 27780", "timestamp_epoch": "1583963020.547148000" } ], "is_private": null, "observable_id": "observable-a9636c23c1f110bb09a9322a", "last_seen_epoch": "1583963020.547148000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961766.883291000" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "00b3e28e084717e5fb9ba1f8a9cf7e9a854ded1b7b4721ed31110513013461dc", "evidence": [], "is_private": null, "observable_id": "observable-a4fd938c033f7e4794d725fa", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "01428897745e7b37849d922e35e28ad8585aca2a254d55f3b5adaecb0b3cb526", "evidence": [], "is_private": null, "observable_id": "observable-2e5f3d5d154e82bc467b7294", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "02db3c6b9aff73bf8a11c41107c836b6c800c919c5d3d1304f336aee03f79f4c", "evidence": [], "is_private": null, "observable_id": "observable-85340b2b43a54acdc129ba7f", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "06cb95758d706e8359a137118c05fb38af14616f870a0448d327c3203ee69973", "evidence": [], "is_private": null, "observable_id": "observable-43b391507bda6928f5370960", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "088111ecdfb3a045b7d594f7c4632561d30b72e15bc771d79812c172ea77e0de", "evidence": [], "is_private": null, "observable_id": "observable-e86f3c2e5cc50cda536ad411", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "0e687e2d9d394d7247d63b61aa33895b436f347eb73d8d1d1f99c199d2a0486e", "evidence": [], "is_private": null, "observable_id": "observable-aaf1d73959c6a9d75dd5e40a", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "0e7a2be431ec48b8483bf126741dba1fc74260a35d944a1b8f0f6c2e0adfc9dd", "evidence": [], "is_private": null, "observable_id": "observable-ed183895d54b237b74c2bd81", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "1ca2faaa4a7ba86c934c337dcb47ebd521dd5721a9f62302ef36f074c1a4c8d8", "evidence": [], "is_private": null, "observable_id": "observable-bb90e25f4a050fb1c116e7c0", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "1e7a8021a029a0b1b97d9df2c059ad4fe80ff8d9db9564c593bdde97df48f5ff", "evidence": [], "is_private": null, "observable_id": "observable-c657bfc8c9fd3ab5d54c4b2c", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "21bd143d38dbbae427615a7266a86a18dc95c417f3e510632d7a9180d98d3571", "evidence": [], "is_private": null, "observable_id": "observable-471ac6cd6672a92b554a17a4", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "232066e3f6f1351afdaee1acb70c409766641fd5669e0b55ce7c77fac0a857ef", "evidence": [], "is_private": null, "observable_id": "observable-e1498f67e46f3fd67f244430", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "2458ec1dbcd980f7d484f0140f1d88e2088249eacf3411b2b2359afdf7774318", "evidence": [], "is_private": null, "observable_id": "observable-1e34c6c7ef3948c2d6bd773a", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "2aa0809ab9f586e743514b0ef60ece6f30dc7d5583d64c1d90cfb87c7019a2bf", "evidence": [], "is_private": null, "observable_id": "observable-dcf7dac4aab970de1bbbe603", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "2ac97370caeb512780c9e407128aaa48e9ea92e34acfb427888e1a8027aa7723", "evidence": [], "is_private": null, "observable_id": "observable-12ac1c27281d4271edaf8a30", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "2e8b2448de2607edfbeba46bc40bdf5ff8a97afc21e36e0f2a8faaeb7802651d", "evidence": [], "is_private": null, "observable_id": "observable-52b72ce068b22af58a0a99f3", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "3291b96690178e55e4114c78a6241d3a6bd18aa7361626ff803b54064d178122", "evidence": [], "is_private": null, "observable_id": "observable-5305bcfeca2373b9ccc5948a", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "34efd2a999616fb13ef5fadece4481e978c68f2f3416713a4364a21fe81d3243", "evidence": [], "is_private": null, "observable_id": "observable-6e39d71744289702f8a9bb46", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "34fc3b82e17c69e3cefd908d8e85848f2cdfcb180ba5c05a84ccd2c65e943e09", "evidence": [], "is_private": null, "observable_id": "observable-0774e27fbd5cbb024f0befc8", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "361c9f80feaefdda9eb1bb7ee61de56d922188898f69af4cf8a76c64fb0183ad", "evidence": [], "is_private": null, "observable_id": "observable-ac4a1c8b66d7f01fa319b8f7", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "3ddb722a10d4664abeb93659beefa009255d6cda0975a47944665976ad9e64cd", "evidence": [], "is_private": null, "observable_id": "observable-ff0746f31ead3cf9f7442aac", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "3fd2858003c32f1542e7f330cfd1ef2dcd578f20c39bfdd22d70c57a801502b0", "evidence": [], "is_private": null, "observable_id": "observable-287190b56af5427b67e1f61b", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "49c45399074a6af07b176d55bb85b3de42b2c2889bf9efa37310b4e71cf14f43", "evidence": [], "is_private": null, "observable_id": "observable-28dba225bfe2b3e8b92b83c1", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "4a0ba027a8859545d3caf300e4c8293248c6e878758cacb14f34e1cdc3d2e24d", "evidence": [], "is_private": null, "observable_id": "observable-349e4489ecc529830167d83f", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "4b2f13582e24aa18d80a7efd5ca0862cbb68b414a3d9d37a9138c3873bdbbba8", "evidence": [], "is_private": null, "observable_id": "observable-3c3697534acd4c4cfeb8c9bd", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "5638ee72bed581aec1cf09b1e7fdeb37a23b69d8f5927ca00b84f2286a695066", "evidence": [], "is_private": null, "observable_id": "observable-90e67161e4374a86a235355c", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "567b1b26bdc881dbbae6afca179ba2597c243a6a045984bb61c8138a00389792", "evidence": [], "is_private": null, "observable_id": "observable-bce57ae9850382626ad95ac8", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "5adbad4e799ade940d96f6f293fc1ea535b504a6151555c879c5e183aeac1018", "evidence": [], "is_private": null, "observable_id": "observable-479939467ff23ecd759d926d", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "5b0d6fc1a80187419cfcc2340e6bf1a3e7704e8d65b44bee45a1caaab91138d2", "evidence": [], "is_private": null, "observable_id": "observable-1873c72c8e646510bd670d20", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "5c06f9a4898eae08a070b18d66d2162fd031833e993d1c0bf3bd9e7e83a6c526", "evidence": [], "is_private": null, "observable_id": "observable-e28f78c24779bf9d5b531d8d", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "626211f63483c4d5717e680816bc56119bcb9cdb3446c6d9241b119037ae724e", "evidence": [], "is_private": null, "observable_id": "observable-d1a8bfd3bdba5146ec89e038", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "68798ccf8e2a5f9682a4e011bec288ad9b3f900244f82c6ae5e8ca538725f92e", "evidence": [], "is_private": null, "observable_id": "observable-7eda0f2160c7166adbe45a69", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "7c41a77c81ad105a586ea655d38846277c13e59341f0d572b8f0eb5ce8af2000", "evidence": [], "is_private": null, "observable_id": "observable-781d6056175d0c42acccf308", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "855a518348bdb64df2ac2fc743b2f2479d4b6fb69d9f87dcdc740ee5d5e03a40", "evidence": [], "is_private": null, "observable_id": "observable-8b35ea3f1662f319106fafee", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "85c54a570e292f19e17fc817bdfdd11f501a95534b8e483629d91c605f38c896", "evidence": [], "is_private": null, "observable_id": "observable-6477de7db11afaf479448964", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "876adf01df542fb8b0f263b3c41b1bf5b0c928f5b8a1205f5cb116b650843906", "evidence": [], "is_private": null, "observable_id": "observable-7141c85050a3bc6c3b3e7902", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "89c5625aa0ecfeaa47ae9da990cda5ab80fe8088ab1cd55ee7394e870de5eafa", "evidence": [], "is_private": null, "observable_id": "observable-577a49446ace9ca8f1786def", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "8aa9c596dd3eb7560bc7416ba181e858f1174fcbcb5432050f3f9a663ed1ffa2", "evidence": [], "is_private": null, "observable_id": "observable-2efb80932910ed9446f560a4", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "8c1c0d96e26bb0fe8578afd07244eae11bab36021b8484862ed81010b97a873d", "evidence": [], "is_private": null, "observable_id": "observable-f5395457e476483cc402d7ac", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "8c426b04cd3debee6a21646f14d72a09db7ad335d1cf348484a654a7905760f5", "evidence": [], "is_private": null, "observable_id": "observable-9fdeaf36aa1f2b99783aeb16", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "95562c2db2cc4094800540ee79790996a5e1fab12a5a3a99432545af45eb2be8", "evidence": [], "is_private": null, "observable_id": "observable-37a5b4b8d7e81efe20c48b8c", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "974ec9b1a263ff7658a88da7dc41e55989ff284562111577e0b1fd36144c8bd7", "evidence": [], "is_private": null, "observable_id": "observable-d2aaa3794e041135b0b64a51", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "9b7024bd4a97fed7a3823a6d98653f66ec959b8e5b73aa533f7e78d0900f9e6d", "evidence": [], "is_private": null, "observable_id": "observable-c9d07eb9c18fa2fab43b77b9", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "9c50a96c859b9beea47b71740bd14e7f69a4df586d015f47434037f8def53b52", "evidence": [], "is_private": null, "observable_id": "observable-ffbb1714e92263a78f0ee808", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "a219ef1a0091feb8ab30c92f4a25833c4f431001bdec691af31878cdcaa1e43d", "evidence": [], "is_private": null, "observable_id": "observable-eec4713ca2415a80dd7870a8", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "a869f2e254fb5a41a1745f2ad858148a990c11f543012e43f14780a0e3b57538", "evidence": [], "is_private": null, "observable_id": "observable-4dbe0c92895033cc153468e2", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "b42b0d8a915682fe8b49af799d072001ddc761191069bd18b2f2974c77a8cf65", "evidence": [], "is_private": null, "observable_id": "observable-f4a7bde78b2effd766512763", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "b6c573fcecf8b4204abd88d9076ae381da57f8969c241e9f08215d3016adc612", "evidence": [], "is_private": null, "observable_id": "observable-8847efcc70dfbc32f3ca82ee", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "be8eb05fd0a2321d069099b171050e5b03effc735dcb43da10d0751ca721a026", "evidence": [], "is_private": null, "observable_id": "observable-84230f61622febf22adab21b", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "c3bdfe5de3424f3d07872f6ecb6de79015e4301a4eb72803fbff251c41311f88", "evidence": [], "is_private": null, "observable_id": "observable-87629e6c9710b2d4910af7e6", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "c4015f58592d68396095b177ad8dd20f7c3910e2e08c0c81b24a9efd0f40c0c8", "evidence": [], "is_private": null, "observable_id": "observable-56bcee48fd3dffba445c2e66", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "c623c1144c540ad5f5ee378220c6237026df828fa5d63c95e072de454aa1113a", "evidence": [], "is_private": null, "observable_id": "observable-e6c5f6e014b81e33ac58d824", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "c683bc3d52a2a1a0b299fe17e0ccddf7fdc01d8b246fb1652ea258904a8bff7f", "evidence": [], "is_private": null, "observable_id": "observable-87780ebde50f911be1ef83f2", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "c76ea8b0db60dcccfdc0217059e37eb5b10d10940e649f9bc1d07d4ddcc797d1", "evidence": [], "is_private": null, "observable_id": "observable-0ec5abc100d17cbcbdac37c0", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "c942686010e285633d77a24341c43850ccd6162fcc7e8281ae8a70c2921a9af5", "evidence": [], "is_private": null, "observable_id": "observable-9d518921fb2f718809849782", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "cf0d2bf5ac3284cc068e414be2a74d56bc5c1543413d3965aa96075114817a7a", "evidence": [], "is_private": null, "observable_id": "observable-f9d22b81db3b2691d42127d9", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "d34dc64266e873c506a07bb00c46b2eef77d812e9c312bd12717fbb67b9740c2", "evidence": [], "is_private": null, "observable_id": "observable-cdd4d2dcda904b1c7c66ee35", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "d5fd173d00d9733900834e0e1083de86b532e048b15c0420ba5c2db0623644b8", "evidence": [], "is_private": null, "observable_id": "observable-eb0fce0251c8981ec6dfdeed", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "d774beebaea68f3e3be399e441d6f5bf073ce036a8cce8a90b444c60d2985f04", "evidence": [], "is_private": null, "observable_id": "observable-06b845b1a6520a8ebd08e1c1", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "f0f761f95b7d8b5f5b64d8c078bb7e9274a0d248d73094d7d16581213c3fb7ef", "evidence": [], "is_private": null, "observable_id": "observable-a61e6283d1417d174fe45e28", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "f1a04b0b791b515d66978d2f6d2980bec1455795486bb71b19e7ad8a84aab865", "evidence": [], "is_private": null, "observable_id": "observable-083d838da0eec950a3a79fd7", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "f1d535264c136ef79dcbc92b30a25b313ed312dc611c92cd70d6470a1609ee88", "evidence": [], "is_private": null, "observable_id": "observable-982db7932a9e3be05374897b", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "fe4428ffba8707caf8541a0ca37cfc96234012a10d051e3362d9d05fbbd9e659", "evidence": [], "is_private": null, "observable_id": "observable-22dd927b89b05e0ea7a5d400", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "fef9b646dba5c7372fe92b6a9d227833c1d15d8cc3a73fd22be9d1869b21cd67", "evidence": [], "is_private": null, "observable_id": "observable-d3c3ed12a0a52664cd402487", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "url", "roles": [ "http-request" ], "value": "http://203.176.135.102:8082/yas20/LAPTOP-7XMV2SN_W10018363.CF3A0EAB425F1927835EF064A69CAED6/81/", "evidence": [ { "tcp_stream": 448, "frame_number": 19116, "display_filter": "frame.number == 19116", "timestamp_epoch": "1583962613.434697000" }, { "tcp_stream": 449, "frame_number": 19547, "display_filter": "frame.number == 19547", "timestamp_epoch": "1583962615.812536000" }, { "tcp_stream": 465, "frame_number": 21096, "display_filter": "frame.number == 21096", "timestamp_epoch": "1583962639.795666000" }, { "tcp_stream": 555, "frame_number": 26673, "display_filter": "frame.number == 26673", "timestamp_epoch": "1583962672.861852000" } ], "is_private": null, "observable_id": "observable-7c9504aadc9234c303483941", "last_seen_epoch": "1583962672.861852000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962613.434697000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://203.176.135.102:8082/yas20/LAPTOP-7XMV2SN_W10018363.CF3A0EAB425F1927835EF064A69CAED6/90", "evidence": [ { "tcp_stream": 459, "frame_number": 20660, "display_filter": "frame.number == 20660", "timestamp_epoch": "1583962620.007347000" } ], "is_private": null, "observable_id": "observable-cfd1d057764f36cdb5c6a9d3", "last_seen_epoch": "1583962620.007347000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962620.007347000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://239.255.255.250:1900*", "evidence": [ { "frame_number": 516, "display_filter": "frame.number == 516", "timestamp_epoch": "1583961757.053472000" }, { "frame_number": 518, "display_filter": "frame.number == 518", "timestamp_epoch": "1583961757.141829000" }, { "frame_number": 521, "display_filter": "frame.number == 521", "timestamp_epoch": "1583961757.317110000" }, { "frame_number": 522, "display_filter": "frame.number == 522", "timestamp_epoch": "1583961757.339046000" }, { "frame_number": 523, "display_filter": "frame.number == 523", "timestamp_epoch": "1583961757.467307000" }, { "frame_number": 806, "display_filter": "frame.number == 806", "timestamp_epoch": "1583961760.039998000" }, { "frame_number": 827, "display_filter": "frame.number == 827", "timestamp_epoch": "1583961760.150356000" }, { "frame_number": 832, "display_filter": "frame.number == 832", "timestamp_epoch": "1583961760.353574000" }, { "frame_number": 851, "display_filter": "frame.number == 851", "timestamp_epoch": "1583961760.385437000" }, { "frame_number": 865, "display_filter": "frame.number == 865", "timestamp_epoch": "1583961760.462907000" }, { "frame_number": 936, "display_filter": "frame.number == 936", "timestamp_epoch": "1583961763.041172000" }, { "frame_number": 937, "display_filter": "frame.number == 937", "timestamp_epoch": "1583961763.150914000" }, { "frame_number": 938, "display_filter": "frame.number == 938", "timestamp_epoch": "1583961763.478458000" }, { "frame_number": 1018, "display_filter": "frame.number == 1018", "timestamp_epoch": "1583961766.496768000" }, { "frame_number": 1047, "display_filter": "frame.number == 1047", "timestamp_epoch": "1583961769.510883000" }, { "frame_number": 1048, "display_filter": "frame.number == 1048", "timestamp_epoch": "1583961772.526214000" }, { "frame_number": 4311, "display_filter": "frame.number == 4311", "timestamp_epoch": "1583961851.807484000" }, { "frame_number": 4314, "display_filter": "frame.number == 4314", "timestamp_epoch": "1583961852.809426000" }, { "frame_number": 4331, "display_filter": "frame.number == 4331", "timestamp_epoch": "1583961853.810540000" }, { "frame_number": 4427, "display_filter": "frame.number == 4427", "timestamp_epoch": "1583961854.810945000" } ], "is_private": null, "observable_id": "observable-cc20400a8f2ed86b5688bcf5", "last_seen_epoch": "1583963092.293061000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961757.053472000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://64.44.133.131/images/cursor.png", "evidence": [ { "tcp_stream": 434, "frame_number": 19014, "display_filter": "frame.number == 19014", "timestamp_epoch": "1583962612.268574000" }, { "tcp_stream": 450, "frame_number": 19562, "display_filter": "frame.number == 19562", "timestamp_epoch": "1583962617.337739000" } ], "is_private": null, "observable_id": "observable-eeb4337a8dbb1b3007ca3c8f", "last_seen_epoch": "1583962617.337739000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962612.268574000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://64.44.133.131/images/imgpaper.png", "evidence": [ { "tcp_stream": 434, "frame_number": 18431, "display_filter": "frame.number == 18431", "timestamp_epoch": "1583962605.820456000" } ], "is_private": null, "observable_id": "observable-3138fdd2e3ee4fbe214f6c94", "last_seen_epoch": "1583962605.820456000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962605.820456000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://ajax.googleapis.com/ajax/libs/jquery/1.6.4/jquery.min.js", "evidence": [ { "tcp_stream": 358, "frame_number": 13836, "display_filter": "frame.number == 13836", "timestamp_epoch": "1583962031.485239000" } ], "is_private": null, "observable_id": "observable-9646aed15b817ab7a3b816bb", "last_seen_epoch": "1583962031.485239000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962031.485239000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://bolton-tech.com/YAS20.exe", "evidence": [ { "tcp_stream": 259, "frame_number": 8616, "display_filter": "frame.number == 8616", "timestamp_epoch": "1583961876.516400000" } ], "is_private": null, "observable_id": "observable-24fc96d0fd5d080503a39f60", "last_seen_epoch": "1583961876.516400000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961876.516400000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://checkip.amazonaws.com/", "evidence": [ { "tcp_stream": 389, "frame_number": 14981, "display_filter": "frame.number == 14981", "timestamp_epoch": "1583962320.240229000" } ], "is_private": null, "observable_id": "observable-f1404294eb97d21e15a16104", "last_seen_epoch": "1583962320.240229000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962320.240229000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://crl.securetrust.com/STCA.crl", "evidence": [ { "tcp_stream": 491, "frame_number": 21909, "display_filter": "frame.number == 21909", "timestamp_epoch": "1583962651.430770000" } ], "is_private": null, "observable_id": "observable-6e267d8df231953becc38b30", "last_seen_epoch": "1583962651.430770000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962651.430770000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?51a531bedcde571d", "evidence": [ { "tcp_stream": 567, "frame_number": 27391, "display_filter": "frame.number == 27391", "timestamp_epoch": "1583962744.531400000" } ], "is_private": null, "observable_id": "observable-4755b93462d3f85bdd580050", "last_seen_epoch": "1583962744.531400000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962744.531400000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?5674bbec2b11449f", "evidence": [ { "tcp_stream": 268, "frame_number": 10329, "display_filter": "frame.number == 10329", "timestamp_epoch": "1583961934.226577000" } ], "is_private": null, "observable_id": "observable-4f3122566cf019fc99ad6889", "last_seen_epoch": "1583961934.226577000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961934.226577000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/pinrulesstl.cab?38fdc717233a6bf2", "evidence": [ { "tcp_stream": 567, "frame_number": 27394, "display_filter": "frame.number == 27394", "timestamp_epoch": "1583962744.555361000" } ], "is_private": null, "observable_id": "observable-444088229dc88c13202ec653", "last_seen_epoch": "1583962744.555361000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962744.555361000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/pinrulesstl.cab?f0500d790de01784", "evidence": [ { "tcp_stream": 268, "frame_number": 10332, "display_filter": "frame.number == 10332", "timestamp_epoch": "1583961934.251616000" } ], "is_private": null, "observable_id": "observable-75a31165961d4e4f933d06c7", "last_seen_epoch": "1583961934.251616000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961934.251616000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://files.markerly.com/main_toolbar_cdn.min.css", "evidence": [ { "tcp_stream": 351, "frame_number": 13984, "display_filter": "frame.number == 13984", "timestamp_epoch": "1583962031.744315000" } ], "is_private": null, "observable_id": "observable-92f0e0707f82db9d80d697a4", "last_seen_epoch": "1583962031.744315000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962031.744315000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://files.markerly.com/markerly-cdn.js", "evidence": [ { "tcp_stream": 351, "frame_number": 13377, "display_filter": "frame.number == 13377", "timestamp_epoch": "1583962027.490893000" } ], "is_private": null, "observable_id": "observable-c58b71a5f02cbe8544e70052", "last_seen_epoch": "1583962027.490893000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962027.490893000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://files.markerly.com/toolbar.cdn.min.js", "evidence": [ { "tcp_stream": 351, "frame_number": 13902, "display_filter": "frame.number == 13902", "timestamp_epoch": "1583962031.571744000" } ], "is_private": null, "observable_id": "observable-b582ad9c58b849af7f1399e3", "last_seen_epoch": "1583962031.571744000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962031.571744000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://fonts.googleapis.com/css?family=Fredericka+the+Great|Allura|Amatic+SC|Arizonia|Averia+Sans+Libre|Cabin+Sketch|Francois+One|Jacques+Francois+Shadow|Josefin+Slab|Kaushan+Script|Love+Ya+Like+A+Sister|Merriweather|Offside|Open+Sans|Open+Sans+Condensed|Oswald|Over+the+Rainbow|Pacifico|Romanesco|Sacramento|Seaweed+Script|Special+Elite", "evidence": [ { "tcp_stream": 205, "frame_number": 4433, "display_filter": "frame.number == 4433", "timestamp_epoch": "1583961854.835217000" } ], "is_private": null, "observable_id": "observable-b236e6d880311cb22e969e2f", "last_seen_epoch": "1583961854.835217000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961854.835217000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://fonts.googleapis.com/css?family=News+Cycle|Bangers|Raleway:200", "evidence": [ { "tcp_stream": 206, "frame_number": 4439, "display_filter": "frame.number == 4439", "timestamp_epoch": "1583961854.840436000" } ], "is_private": null, "observable_id": "observable-dc4796b008a1e00021983df9", "last_seen_epoch": "1583961854.840436000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961854.840436000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://fonts.gstatic.com/s/amaticsc/v13/TUZyzwprpvBS1izr_vOECuSf.woff2", "evidence": [ { "tcp_stream": 220, "frame_number": 5066, "display_filter": "frame.number == 5066", "timestamp_epoch": "1583961856.201519000" } ], "is_private": null, "observable_id": "observable-df8ed075ec28999badfac8ed", "last_seen_epoch": "1583961856.201519000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961856.201519000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://fonts.gstatic.com/s/averiasanslibre/v8/ga6XaxZG_G5OvCf_rt7FH3B6BHLMEdVOEoI.woff2", "evidence": [ { "tcp_stream": 222, "frame_number": 4958, "display_filter": "frame.number == 4958", "timestamp_epoch": "1583961856.075895000" } ], "is_private": null, "observable_id": "observable-ce32aeac02693d7a3e6fb1ef", "last_seen_epoch": "1583961856.075895000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961856.075895000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://fonts.gstatic.com/s/bangers/v12/FeVQS0BTqb0h60ACH55Q2A.woff2", "evidence": [ { "tcp_stream": 215, "frame_number": 5062, "display_filter": "frame.number == 5062", "timestamp_epoch": "1583961856.177877000" } ], "is_private": null, "observable_id": "observable-c84af60ffcc734467bc9a2d4", "last_seen_epoch": "1583961856.177877000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961856.177877000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://fonts.gstatic.com/s/kaushanscript/v8/vm8vdRfvXFLG3OLnsO15WYS5DG74wNI.woff2", "evidence": [ { "tcp_stream": 224, "frame_number": 5071, "display_filter": "frame.number == 5071", "timestamp_epoch": "1583961856.209888000" } ], "is_private": null, "observable_id": "observable-6627db43e3eab3028515c593", "last_seen_epoch": "1583961856.209888000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961856.209888000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://fonts.gstatic.com/s/loveyalikeasister/v10/R70EjzUBlOqPeouhFDfR80-0FhOqJubN-BeL9Xxd.woff2", "evidence": [ { "tcp_stream": 220, "frame_number": 4956, "display_filter": "frame.number == 4956", "timestamp_epoch": "1583961856.075659000" } ], "is_private": null, "observable_id": "observable-3740838f308b39c4e686952a", "last_seen_epoch": "1583961856.075659000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961856.075659000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://fonts.gstatic.com/s/newscycle/v16/CSR64z1Qlv-GDxkbKVQ_fOAKTQ.woff2", "evidence": [ { "tcp_stream": 222, "frame_number": 5065, "display_filter": "frame.number == 5065", "timestamp_epoch": "1583961856.201369000" } ], "is_private": null, "observable_id": "observable-67a9276f3197a33b3ec55177", "last_seen_epoch": "1583961856.201369000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961856.201369000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://fonts.gstatic.com/s/opensans/v17/mem8YaGs126MiZpBA-UFVZ0b.woff2", "evidence": [ { "tcp_stream": 215, "frame_number": 4917, "display_filter": "frame.number == 4917", "timestamp_epoch": "1583961856.047515000" } ], "is_private": null, "observable_id": "observable-19b71387f53b1e5dce798a22", "last_seen_epoch": "1583961856.047515000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961856.047515000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://img.secureserver.net/t/1/tl/event?cts=1583961855884&ap=WSBv7&ds=1000&tce=1583961854653&tcs=1583961854581&tdc=1583961859120&tdclee=1583961855914&tdcles=1583961855886&tdi=1583961855886&tdl=1583961854740&tdle=1583961854581&tdls=1583961854506&tfs=1583961851561&tns=1583961851537&trqs=1583961854653&tre=1583961854727&trps=1583961854719&tles=1583961859120&tlee=1583961859184&dh=www.tuscaloosabarnyard.com&dp=%2F&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F80.0.3987.132%20Safari%2F537.36%20Edg%2F80.0.361.66&feedtype=perf&z=649269160", "evidence": [ { "tcp_stream": 247, "frame_number": 7633, "display_filter": "frame.number == 7633", "timestamp_epoch": "1583961859.275730000" } ], "is_private": null, "observable_id": "observable-a03511dec88d3b5190c8fef0", "last_seen_epoch": "1583961859.275730000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961859.275730000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://img1.wsimg.com/starfield/duel/v2.5.8/duel.js?appid=O3BkA5J1", "evidence": [ { "tcp_stream": 207, "frame_number": 4475, "display_filter": "frame.number == 4475", "timestamp_epoch": "1583961854.850635000" } ], "is_private": null, "observable_id": "observable-47c5921591f178e6608a9c46", "last_seen_epoch": "1583961854.850635000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961854.850635000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://img1.wsimg.com/tcc/tcc_l.combined.1.0.5.min.js", "evidence": [ { "tcp_stream": 207, "frame_number": 4638, "display_filter": "frame.number == 4638", "timestamp_epoch": "1583961855.179664000" } ], "is_private": null, "observable_id": "observable-4d1a22ddfe484344189e9729", "last_seen_epoch": "1583961855.179664000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961855.179664000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://img1.wsimg.com/wst/v7/WSB7_J_20200225_2323_DEP-18389_2679/v1/images/wsb-slideshow-arrows.png", "evidence": [ { "tcp_stream": 207, "frame_number": 5450, "display_filter": "frame.number == 5450", "timestamp_epoch": "1583961856.581467000" } ], "is_private": null, "observable_id": "observable-deb4e3a48c51726d385f2e81", "last_seen_epoch": "1583961856.581467000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961856.581467000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://img2.wsimg.com/starfield/duel/v2.5.8/sf.core/app.css", "evidence": [ { "tcp_stream": 232, "frame_number": 5856, "display_filter": "frame.number == 5856", "timestamp_epoch": "1583961856.754926000" } ], "is_private": null, "observable_id": "observable-6d04b1f1715318d78cd8761d", "last_seen_epoch": "1583961856.754926000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961856.754926000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://img4.wsimg.com/starfield/duel/v2.5.8/sf.core/sf.core.pkg.js", "evidence": [ { "tcp_stream": 231, "frame_number": 5551, "display_filter": "frame.number == 5551", "timestamp_epoch": "1583961856.605293000" } ], "is_private": null, "observable_id": "observable-f926585840583f21be65f264", "last_seen_epoch": "1583961856.605293000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961856.605293000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://nebula.wsimg.com/18385e97e118628cd32e2d0c189f6eee?AccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1", "evidence": [ { "tcp_stream": 239, "frame_number": 6158, "display_filter": "frame.number == 6158", "timestamp_epoch": "1583961857.286584000" } ], "is_private": null, "observable_id": "observable-1996f3861e33dfa5b6d4c801", "last_seen_epoch": "1583961857.286584000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961857.286584000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://nebula.wsimg.com/1a4f5564116de9920433f700c2a9c20c?AccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1", "evidence": [ { "tcp_stream": 211, "frame_number": 4640, "display_filter": "frame.number == 4640", "timestamp_epoch": "1583961855.181740000" } ], "is_private": null, "observable_id": "observable-2c8dc4c23daec70ff415211b", "last_seen_epoch": "1583961855.181740000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961855.181740000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://nebula.wsimg.com/21eea24a60f7c8fb7ed4dcca63aca4f5?AccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1", "evidence": [ { "tcp_stream": 210, "frame_number": 9419, "display_filter": "frame.number == 9419", "timestamp_epoch": "1583961887.693830000" } ], "is_private": null, "observable_id": "observable-d345038f85321b163707fb4e", "last_seen_epoch": "1583961887.693830000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961887.693830000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://nebula.wsimg.com/25a1c16c05755eb2ec17846b91efa5fe?AccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1", "evidence": [ { "tcp_stream": 211, "frame_number": 4477, "display_filter": "frame.number == 4477", "timestamp_epoch": "1583961854.851083000" } ], "is_private": null, "observable_id": "observable-cdeafcf04834828e9d3314db", "last_seen_epoch": "1583961854.851083000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961854.851083000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://nebula.wsimg.com/2b8f0431afda995f993087c8ec231ddf?AccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1", "evidence": [ { "tcp_stream": 210, "frame_number": 9821, "display_filter": "frame.number == 9821", "timestamp_epoch": "1583961895.296505000" } ], "is_private": null, "observable_id": "observable-687d7fcacfba4f292b5cd787", "last_seen_epoch": "1583961895.296505000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961895.296505000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://nebula.wsimg.com/3f2de843c79e006d37fb2ff42ab0d18c?AccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1", "evidence": [ { "tcp_stream": 210, "frame_number": 9006, "display_filter": "frame.number == 9006", "timestamp_epoch": "1583961880.076800000" } ], "is_private": null, "observable_id": "observable-a0f719b147307ec767e4d4a8", "last_seen_epoch": "1583961880.076800000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961880.076800000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://nebula.wsimg.com/5e2ea9aae9a1ca943046a6868cb3002b?AccessKeyId=531592D248B589D87A56&alloworigin=1", "evidence": [ { "tcp_stream": 210, "frame_number": 4815, "display_filter": "frame.number == 4815", "timestamp_epoch": "1583961855.664609000" } ], "is_private": null, "observable_id": "observable-71ea331c379588a441c2c981", "last_seen_epoch": "1583961855.664609000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961855.664609000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://nebula.wsimg.com/6843f2b90530e6ec9ea7f397b0375735?AccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1", "evidence": [ { "tcp_stream": 211, "frame_number": 6077, "display_filter": "frame.number == 6077", "timestamp_epoch": "1583961857.236854000" } ], "is_private": null, "observable_id": "observable-a49befeb682d8ae2e6ca5193", "last_seen_epoch": "1583961857.236854000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961857.236854000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://nebula.wsimg.com/6e2b4120ae0b4dbcac9541ce80c5dd24?AccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1", "evidence": [ { "tcp_stream": 210, "frame_number": 6075, "display_filter": "frame.number == 6075", "timestamp_epoch": "1583961857.236308000" } ], "is_private": null, "observable_id": "observable-0bf4b0af8560e0e3bf899360", "last_seen_epoch": "1583961857.236308000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961857.236308000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://nebula.wsimg.com/893e2501ed5504c59ddf5b5352855b87?AccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1", "evidence": [ { "tcp_stream": 210, "frame_number": 8195, "display_filter": "frame.number == 8195", "timestamp_epoch": "1583961872.460195000" } ], "is_private": null, "observable_id": "observable-66853a657a67893d57bf3a51", "last_seen_epoch": "1583961872.460195000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961872.460195000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://nebula.wsimg.com/90d173a36db4dc5268be43fbed9cde77?AccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1", "evidence": [ { "tcp_stream": 210, "frame_number": 4481, "display_filter": "frame.number == 4481", "timestamp_epoch": "1583961854.851687000" } ], "is_private": null, "observable_id": "observable-64f0667143917a630ab0f82d", "last_seen_epoch": "1583961854.851687000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961854.851687000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://nebula.wsimg.com/98b20fd6aed4cfc29e428d4dd8e00930?AccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1", "evidence": [ { "tcp_stream": 238, "frame_number": 6156, "display_filter": "frame.number == 6156", "timestamp_epoch": "1583961857.286384000" } ], "is_private": null, "observable_id": "observable-d9efc0c6c16d2fa2b14ba798", "last_seen_epoch": "1583961857.286384000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961857.286384000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://nebula.wsimg.com/c92f917c785f8c03f78b627d46aa8dc2?AccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1", "evidence": [ { "tcp_stream": 210, "frame_number": 7726, "display_filter": "frame.number == 7726", "timestamp_epoch": "1583961864.845032000" } ], "is_private": null, "observable_id": "observable-d9386c3e37148fbf7e89dd9c", "last_seen_epoch": "1583961864.845032000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961864.845032000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://nebula.wsimg.com/d0c5998dd42685ef31a2dbd195b7220e?AccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1", "evidence": [ { "tcp_stream": 210, "frame_number": 5452, "display_filter": "frame.number == 5452", "timestamp_epoch": "1583961856.581965000" } ], "is_private": null, "observable_id": "observable-c1ea4c006a4246c855d0d540", "last_seen_epoch": "1583961856.581965000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961856.581965000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://nebula.wsimg.com/eea2577ebdcc219fe1962915e163ee72?AccessKeyId=531592D248B589D87A56&disposition=0&alloworigin=1", "evidence": [ { "tcp_stream": 210, "frame_number": 4642, "display_filter": "frame.number == 4642", "timestamp_epoch": "1583961855.182260000" } ], "is_private": null, "observable_id": "observable-22940737a6f2b5a7a5b0b85d", "last_seen_epoch": "1583961855.182260000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961855.182260000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://newegg.com/", "evidence": [ { "tcp_stream": 467, "frame_number": 21154, "display_filter": "frame.number == 21154", "timestamp_epoch": "1583962650.405381000" } ], "is_private": null, "observable_id": "observable-50f6fd81a520981f8a7567ec", "last_seen_epoch": "1583962650.405381000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962650.405381000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://notable-quotes.com/", "evidence": [ { "tcp_stream": 344, "frame_number": 13309, "display_filter": "frame.number == 13309", "timestamp_epoch": "1583962027.316706000" } ], "is_private": null, "observable_id": "observable-5d0130a845bbbf3e42b28a44", "last_seen_epoch": "1583962027.316706000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962027.316706000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://notable-quotes.com/css/bootstrap.css", "evidence": [ { "tcp_stream": 345, "frame_number": 13326, "display_filter": "frame.number == 13326", "timestamp_epoch": "1583962027.431505000" } ], "is_private": null, "observable_id": "observable-a496e71aa773a88bd14c9c26", "last_seen_epoch": "1583962027.431505000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962027.431505000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://notable-quotes.com/css/style.css", "evidence": [ { "tcp_stream": 344, "frame_number": 13363, "display_filter": "frame.number == 13363", "timestamp_epoch": "1583962027.488515000" } ], "is_private": null, "observable_id": "observable-97c0d1be303e11051a57276d", "last_seen_epoch": "1583962027.488515000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962027.488515000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://notable-quotes.com/favicon.ico", "evidence": [ { "tcp_stream": 345, "frame_number": 14008, "display_filter": "frame.number == 14008", "timestamp_epoch": "1583962031.859675000" } ], "is_private": null, "observable_id": "observable-4ea918ba5d388a4f23a03992", "last_seen_epoch": "1583962031.859675000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962031.859675000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://notable-quotes.com/images/facebook.png", "evidence": [ { "tcp_stream": 346, "frame_number": 13369, "display_filter": "frame.number == 13369", "timestamp_epoch": "1583962027.489267000" } ], "is_private": null, "observable_id": "observable-7aff9e8a6f9a798225f853a1", "last_seen_epoch": "1583962027.489267000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962027.489267000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://notable-quotes.com/images/googleplus.png", "evidence": [ { "tcp_stream": 349, "frame_number": 13384, "display_filter": "frame.number == 13384", "timestamp_epoch": "1583962027.493415000" } ], "is_private": null, "observable_id": "observable-6259223e0967ab46a2b247a0", "last_seen_epoch": "1583962027.493415000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962027.493415000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://notable-quotes.com/images/nqlogo2.png", "evidence": [ { "tcp_stream": 347, "frame_number": 13371, "display_filter": "frame.number == 13371", "timestamp_epoch": "1583962027.489469000" } ], "is_private": null, "observable_id": "observable-8dfa75dc8cf922dc9082c5a9", "last_seen_epoch": "1583962027.489469000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962027.489469000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://notable-quotes.com/images/twitter.png", "evidence": [ { "tcp_stream": 348, "frame_number": 13383, "display_filter": "frame.number == 13383", "timestamp_epoch": "1583962027.493360000" } ], "is_private": null, "observable_id": "observable-f027f47347c52b879a5bd4db", "last_seen_epoch": "1583962027.493360000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962027.493360000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://notable-quotes.com/js/bootstrap.min.js", "evidence": [ { "tcp_stream": 344, "frame_number": 13453, "display_filter": "frame.number == 13453", "timestamp_epoch": "1583962027.547622000" } ], "is_private": null, "observable_id": "observable-d7ab0a96e05ec5e9e940041c", "last_seen_epoch": "1583962027.547622000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962027.547622000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D", "evidence": [ { "tcp_stream": 273, "frame_number": 10500, "display_filter": "frame.number == 10500", "timestamp_epoch": "1583961955.838319000" } ], "is_private": null, "observable_id": "observable-38acb49d88cfb0e87a1ca41b", "last_seen_epoch": "1583961955.838319000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961955.838319000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://platform.twitter.com/widgets.js", "evidence": [ { "tcp_stream": 237, "frame_number": 6154, "display_filter": "frame.number == 6154", "timestamp_epoch": "1583961857.286196000" } ], "is_private": null, "observable_id": "observable-97f4a01818aa61df5d8207d8", "last_seen_epoch": "1583961857.286196000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961857.286196000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://s7.addthis.com/js/300/addthis_widget.js", "evidence": [ { "tcp_stream": 216, "frame_number": 4559, "display_filter": "frame.number == 4559", "timestamp_epoch": "1583961854.985134000" } ], "is_private": null, "observable_id": "observable-804d843e4227adab325a4ae5", "last_seen_epoch": "1583961854.985134000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961854.985134000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.newegg.com/", "evidence": [ { "tcp_stream": 469, "frame_number": 21202, "display_filter": "frame.number == 21202", "timestamp_epoch": "1583962650.547673000" } ], "is_private": null, "observable_id": "observable-9ae556073743a5685f946ed8", "last_seen_epoch": "1583962650.547673000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962650.547673000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.notable-quotes.com/a/america_quote_8.jpg", "evidence": [ { "tcp_stream": 352, "frame_number": 13467, "display_filter": "frame.number == 13467", "timestamp_epoch": "1583962027.570033000" } ], "is_private": null, "observable_id": "observable-c01f01f2f54163be9e94b016", "last_seen_epoch": "1583962027.570033000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962027.570033000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.notable-quotes.com/a/apocalypse_quote_3.jpg", "evidence": [ { "tcp_stream": 355, "frame_number": 13473, "display_filter": "frame.number == 13473", "timestamp_epoch": "1583962027.570585000" } ], "is_private": null, "observable_id": "observable-a4f8858334104840455a9649", "last_seen_epoch": "1583962027.570585000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962027.570585000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.notable-quotes.com/w/wedding_quote.jpg", "evidence": [ { "tcp_stream": 354, "frame_number": 13477, "display_filter": "frame.number == 13477", "timestamp_epoch": "1583962027.572340000" } ], "is_private": null, "observable_id": "observable-ebd4191fb87bf6d5d7dc7051", "last_seen_epoch": "1583962027.572340000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962027.572340000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.notable-quotes.com/w/wisdom_quote.jpg", "evidence": [ { "tcp_stream": 353, "frame_number": 13468, "display_filter": "frame.number == 13468", "timestamp_epoch": "1583962027.570077000" } ], "is_private": null, "observable_id": "observable-12209ee671e6e10715c51d92", "last_seen_epoch": "1583962027.570077000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962027.570077000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.tuscaloosabarnyard.com/", "evidence": [ { "tcp_stream": 200, "frame_number": 4366, "display_filter": "frame.number == 4366", "timestamp_epoch": "1583961854.645117000" } ], "is_private": null, "observable_id": "observable-83adef5610506e78aa3e659a", "last_seen_epoch": "1583961854.645117000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961854.645117000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.tuscaloosabarnyard.com/favicon.ico", "evidence": [ { "tcp_stream": 200, "frame_number": 7675, "display_filter": "frame.number == 7675", "timestamp_epoch": "1583961859.573307000" } ], "is_private": null, "observable_id": "observable-ed0606890d7c6aee88c030f8", "last_seen_epoch": "1583961859.573307000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961859.573307000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.tuscaloosabarnyard.com/site.css?v=", "evidence": [ { "tcp_stream": 200, "frame_number": 4398, "display_filter": "frame.number == 4398", "timestamp_epoch": "1583961854.770626000" } ], "is_private": null, "observable_id": "observable-7bd7d4ac851a59fe034c808c", "last_seen_epoch": "1583961854.770626000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961854.770626000" }, { "type": "user_agent", "roles": [ "http-client" ], "value": "KSKJJGJ", "evidence": [ { "tcp_stream": 459, "frame_number": 20660, "display_filter": "frame.number == 20660", "timestamp_epoch": "1583962620.007347000" } ], "is_private": null, "observable_id": "observable-489af50be9f8fc62702bf93c", "last_seen_epoch": "1583962620.007347000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962620.007347000" }, { "type": "user_agent", "roles": [ "http-client" ], "value": "Microsoft Edge/80.0.361.66 Windows", "evidence": [ { "frame_number": 4311, "display_filter": "frame.number == 4311", "timestamp_epoch": "1583961851.807484000" }, { "frame_number": 4314, "display_filter": "frame.number == 4314", "timestamp_epoch": "1583961852.809426000" }, { "frame_number": 4331, "display_filter": "frame.number == 4331", "timestamp_epoch": "1583961853.810540000" }, { "frame_number": 4427, "display_filter": "frame.number == 4427", "timestamp_epoch": "1583961854.810945000" }, { "frame_number": 11771, "display_filter": "frame.number == 11771", "timestamp_epoch": "1583961971.717394000" }, { "frame_number": 11809, "display_filter": "frame.number == 11809", "timestamp_epoch": "1583961972.718068000" }, { "frame_number": 11886, "display_filter": "frame.number == 11886", "timestamp_epoch": "1583961973.718859000" }, { "frame_number": 11924, "display_filter": "frame.number == 11924", "timestamp_epoch": "1583961974.719978000" }, { "frame_number": 14288, "display_filter": "frame.number == 14288", "timestamp_epoch": "1583962091.721089000" }, { "frame_number": 14289, "display_filter": "frame.number == 14289", "timestamp_epoch": "1583962092.722480000" }, { "frame_number": 14290, "display_filter": "frame.number == 14290", "timestamp_epoch": "1583962093.724344000" }, { "frame_number": 14295, "display_filter": "frame.number == 14295", "timestamp_epoch": "1583962094.725001000" }, { "frame_number": 14606, "display_filter": "frame.number == 14606", "timestamp_epoch": "1583962211.723631000" }, { "frame_number": 14607, "display_filter": "frame.number == 14607", "timestamp_epoch": "1583962212.725179000" }, { "frame_number": 14608, "display_filter": "frame.number == 14608", "timestamp_epoch": "1583962213.726629000" }, { "frame_number": 14609, "display_filter": "frame.number == 14609", "timestamp_epoch": "1583962214.727240000" }, { "frame_number": 15124, "display_filter": "frame.number == 15124", "timestamp_epoch": "1583962331.726183000" }, { "frame_number": 15125, "display_filter": "frame.number == 15125", "timestamp_epoch": "1583962332.727285000" }, { "frame_number": 15126, "display_filter": "frame.number == 15126", "timestamp_epoch": "1583962333.728776000" }, { "frame_number": 15127, "display_filter": "frame.number == 15127", "timestamp_epoch": "1583962334.730492000" } ], "is_private": null, "observable_id": "observable-df7f35ce028786d39ee13627", "last_seen_epoch": "1583962681.898250000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961851.807484000" }, { "type": "user_agent", "roles": [ "http-client" ], "value": "Microsoft-CryptoAPI/10.0", "evidence": [ { "tcp_stream": 268, "frame_number": 10329, "display_filter": "frame.number == 10329", "timestamp_epoch": "1583961934.226577000" }, { "tcp_stream": 268, "frame_number": 10332, "display_filter": "frame.number == 10332", "timestamp_epoch": "1583961934.251616000" }, { "tcp_stream": 273, "frame_number": 10500, "display_filter": "frame.number == 10500", "timestamp_epoch": "1583961955.838319000" }, { "tcp_stream": 491, "frame_number": 21909, "display_filter": "frame.number == 21909", "timestamp_epoch": "1583962651.430770000" }, { "tcp_stream": 567, "frame_number": 27391, "display_filter": "frame.number == 27391", "timestamp_epoch": "1583962744.531400000" }, { "tcp_stream": 567, "frame_number": 27394, "display_filter": "frame.number == 27394", "timestamp_epoch": "1583962744.555361000" } ], "is_private": null, "observable_id": "observable-9fdbaaab2e926e3bfbe7ede3", "last_seen_epoch": "1583962744.555361000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961934.226577000" }, { "type": "user_agent", "roles": [ "http-client" ], "value": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E)", "evidence": [ { "tcp_stream": 448, "frame_number": 19116, "display_filter": "frame.number == 19116", "timestamp_epoch": "1583962613.434697000" }, { "tcp_stream": 449, "frame_number": 19547, "display_filter": "frame.number == 19547", "timestamp_epoch": "1583962615.812536000" }, { "tcp_stream": 465, "frame_number": 21096, "display_filter": "frame.number == 21096", "timestamp_epoch": "1583962639.795666000" }, { "tcp_stream": 555, "frame_number": 26673, "display_filter": "frame.number == 26673", "timestamp_epoch": "1583962672.861852000" } ], "is_private": null, "observable_id": "observable-f1534d3ff3a1b29d985b2b71", "last_seen_epoch": "1583962672.861852000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962613.434697000" }, { "type": "user_agent", "roles": [ "http-client" ], "value": "Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)", "evidence": [ { "tcp_stream": 259, "frame_number": 8616, "display_filter": "frame.number == 8616", "timestamp_epoch": "1583961876.516400000" } ], "is_private": null, "observable_id": "observable-3f2a35c7be9ed83a937f66cc", "last_seen_epoch": "1583961876.516400000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961876.516400000" }, { "type": "user_agent", "roles": [ "http-client" ], "value": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.79 Safari/537.36", "evidence": [ { "tcp_stream": 389, "frame_number": 14981, "display_filter": "frame.number == 14981", "timestamp_epoch": "1583962320.240229000" } ], "is_private": null, "observable_id": "observable-ebecdc3cce03abc174f3bc7a", "last_seen_epoch": "1583962320.240229000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962320.240229000" }, { "type": "user_agent", "roles": [ "http-client" ], "value": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.132 Safari/537.36 Edg/80.0.361.66", "evidence": [ { "tcp_stream": 200, "frame_number": 4366, "display_filter": "frame.number == 4366", "timestamp_epoch": "1583961854.645117000" }, { "tcp_stream": 200, "frame_number": 4398, "display_filter": "frame.number == 4398", "timestamp_epoch": "1583961854.770626000" }, { "tcp_stream": 205, "frame_number": 4433, "display_filter": "frame.number == 4433", "timestamp_epoch": "1583961854.835217000" }, { "tcp_stream": 206, "frame_number": 4439, "display_filter": "frame.number == 4439", "timestamp_epoch": "1583961854.840436000" }, { "tcp_stream": 207, "frame_number": 4475, "display_filter": "frame.number == 4475", "timestamp_epoch": "1583961854.850635000" }, { "tcp_stream": 211, "frame_number": 4477, "display_filter": "frame.number == 4477", "timestamp_epoch": "1583961854.851083000" }, { "tcp_stream": 210, "frame_number": 4481, "display_filter": "frame.number == 4481", "timestamp_epoch": "1583961854.851687000" }, { "tcp_stream": 216, "frame_number": 4559, "display_filter": "frame.number == 4559", "timestamp_epoch": "1583961854.985134000" }, { "tcp_stream": 207, "frame_number": 4638, "display_filter": "frame.number == 4638", "timestamp_epoch": "1583961855.179664000" }, { "tcp_stream": 211, "frame_number": 4640, "display_filter": "frame.number == 4640", "timestamp_epoch": "1583961855.181740000" }, { "tcp_stream": 210, "frame_number": 4642, "display_filter": "frame.number == 4642", "timestamp_epoch": "1583961855.182260000" }, { "tcp_stream": 210, "frame_number": 4815, "display_filter": "frame.number == 4815", "timestamp_epoch": "1583961855.664609000" }, { "tcp_stream": 215, "frame_number": 4917, "display_filter": "frame.number == 4917", "timestamp_epoch": "1583961856.047515000" }, { "tcp_stream": 220, "frame_number": 4956, "display_filter": "frame.number == 4956", "timestamp_epoch": "1583961856.075659000" }, { "tcp_stream": 222, "frame_number": 4958, "display_filter": "frame.number == 4958", "timestamp_epoch": "1583961856.075895000" }, { "tcp_stream": 215, "frame_number": 5062, "display_filter": "frame.number == 5062", "timestamp_epoch": "1583961856.177877000" }, { "tcp_stream": 222, "frame_number": 5065, "display_filter": "frame.number == 5065", "timestamp_epoch": "1583961856.201369000" }, { "tcp_stream": 220, "frame_number": 5066, "display_filter": "frame.number == 5066", "timestamp_epoch": "1583961856.201519000" }, { "tcp_stream": 224, "frame_number": 5071, "display_filter": "frame.number == 5071", "timestamp_epoch": "1583961856.209888000" }, { "tcp_stream": 207, "frame_number": 5450, "display_filter": "frame.number == 5450", "timestamp_epoch": "1583961856.581467000" } ], "is_private": null, "observable_id": "observable-a9402d20f65902c59c5c1b00", "last_seen_epoch": "1583962650.547673000", "enrichment_state": "not_requested", "first_seen_epoch": "1583961854.645117000" }, { "type": "user_agent", "roles": [ "http-client" ], "value": "Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko", "evidence": [ { "tcp_stream": 344, "frame_number": 13309, "display_filter": "frame.number == 13309", "timestamp_epoch": "1583962027.316706000" }, { "tcp_stream": 345, "frame_number": 13326, "display_filter": "frame.number == 13326", "timestamp_epoch": "1583962027.431505000" }, { "tcp_stream": 344, "frame_number": 13363, "display_filter": "frame.number == 13363", "timestamp_epoch": "1583962027.488515000" }, { "tcp_stream": 346, "frame_number": 13369, "display_filter": "frame.number == 13369", "timestamp_epoch": "1583962027.489267000" }, { "tcp_stream": 347, "frame_number": 13371, "display_filter": "frame.number == 13371", "timestamp_epoch": "1583962027.489469000" }, { "tcp_stream": 351, "frame_number": 13377, "display_filter": "frame.number == 13377", "timestamp_epoch": "1583962027.490893000" }, { "tcp_stream": 348, "frame_number": 13383, "display_filter": "frame.number == 13383", "timestamp_epoch": "1583962027.493360000" }, { "tcp_stream": 349, "frame_number": 13384, "display_filter": "frame.number == 13384", "timestamp_epoch": "1583962027.493415000" }, { "tcp_stream": 344, "frame_number": 13453, "display_filter": "frame.number == 13453", "timestamp_epoch": "1583962027.547622000" }, { "tcp_stream": 352, "frame_number": 13467, "display_filter": "frame.number == 13467", "timestamp_epoch": "1583962027.570033000" }, { "tcp_stream": 353, "frame_number": 13468, "display_filter": "frame.number == 13468", "timestamp_epoch": "1583962027.570077000" }, { "tcp_stream": 355, "frame_number": 13473, "display_filter": "frame.number == 13473", "timestamp_epoch": "1583962027.570585000" }, { "tcp_stream": 354, "frame_number": 13477, "display_filter": "frame.number == 13477", "timestamp_epoch": "1583962027.572340000" }, { "tcp_stream": 358, "frame_number": 13836, "display_filter": "frame.number == 13836", "timestamp_epoch": "1583962031.485239000" }, { "tcp_stream": 351, "frame_number": 13902, "display_filter": "frame.number == 13902", "timestamp_epoch": "1583962031.571744000" }, { "tcp_stream": 351, "frame_number": 13984, "display_filter": "frame.number == 13984", "timestamp_epoch": "1583962031.744315000" }, { "tcp_stream": 345, "frame_number": 14008, "display_filter": "frame.number == 14008", "timestamp_epoch": "1583962031.859675000" } ], "is_private": null, "observable_id": "observable-6f31f0ecbd85bb54cdbbfb62", "last_seen_epoch": "1583962031.859675000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962027.316706000" }, { "type": "user_agent", "roles": [ "http-client" ], "value": "WinHTTP loader/1.0", "evidence": [ { "tcp_stream": 434, "frame_number": 18431, "display_filter": "frame.number == 18431", "timestamp_epoch": "1583962605.820456000" }, { "tcp_stream": 434, "frame_number": 19014, "display_filter": "frame.number == 19014", "timestamp_epoch": "1583962612.268574000" } ], "is_private": null, "observable_id": "observable-2d68ef928738f9949e04f8fd", "last_seen_epoch": "1583962612.268574000", "enrichment_state": "not_requested", "first_seen_epoch": "1583962605.820456000" } ], "schema_version": "pcap-analysis-v1", "semantic_sha256": "205701a0e6aebd9492fa2877a3bf42135b1ae3bbda7370a93eeabc0345e40639", "analyzer_manifest": { "limits": { "max_flows": 50000, "max_endpoints": 20000, "max_upload_bytes": 536870912, "max_exported_files": 50000, "max_events_per_kind": 50000, "max_exported_objects": 500, "tool_timeout_seconds": 300, "max_object_hash_index": 50000, "max_tool_output_bytes": 268435456, "max_exported_total_bytes": 268435456, "max_exported_object_bytes": 52428800 }, "profile_id": "tshark-evidence-v6", "profile_sha256": "aff64bf3786902d5d7a2c1a9be158a5246cc81aecea6c44eda74701431070465", "schema_version": "pcap-analyzer-manifest-v1", "tshark_version": "TShark (Wireshark) 4.4.18.", "manifest_sha256": "1f3c02483cfea06d85bd326f6e225f3f41a4ab703677d40537577e8bb85c1ce0", "capinfos_version": "Capinfos (Wireshark) 4.4.18.", "rulepack_version": "pcap-rules-v5", "implementation_sha256": "1a7d19199ff58059a12b34656620481b502fadc52d115b5f4b42fc28e5817c3c", "requested_fields_sha256": "e7a6eff11f7ae2101845897ce7e3b0a0e9cea31bdea4a824734869f39f3fb4f3", "supported_profile_fields_sha256": "6d94b9bc3aea93d5f7f4f815bdd025560ceba0d5e27b380ad14da28b44947994" }, "attack_candidates": [ { "name": "Ingress Tool Transfer", "status": "suggested", "tactic": "command-and-control", "evidence": [ { "tcp_stream": 351, "frame_number": 13377, "display_filter": "frame.number == 13377", "timestamp_epoch": "1583962027.490893000" }, { "tcp_stream": 351, "frame_number": 13389, "display_filter": "frame.number == 13389", "timestamp_epoch": "1583962027.518133000" }, { "tcp_stream": 344, "frame_number": 13453, "display_filter": "frame.number == 13453", "timestamp_epoch": "1583962027.547622000" }, { "tcp_stream": 344, "frame_number": 13559, "display_filter": "frame.number == 13559", "timestamp_epoch": "1583962027.622723000" }, { "tcp_stream": 358, "frame_number": 13836, "display_filter": "frame.number == 13836", "timestamp_epoch": "1583962031.485239000" }, { "tcp_stream": 358, "frame_number": 13891, "display_filter": "frame.number == 13891", "timestamp_epoch": "1583962031.543194000" }, { "tcp_stream": 351, "frame_number": 13902, "display_filter": "frame.number == 13902", "timestamp_epoch": "1583962031.571744000" }, { "tcp_stream": 351, "frame_number": 13981, "display_filter": "frame.number == 13981", "timestamp_epoch": "1583962031.731453000" }, { "tcp_stream": 207, "frame_number": 4475, "display_filter": "frame.number == 4475", "timestamp_epoch": "1583961854.850635000" }, { "tcp_stream": 216, "frame_number": 4559, "display_filter": "frame.number == 4559", "timestamp_epoch": "1583961854.985134000" }, { "tcp_stream": 216, "frame_number": 4568, "display_filter": "frame.number == 4568", "timestamp_epoch": "1583961855.033448000" }, { "tcp_stream": 207, "frame_number": 4616, "display_filter": "frame.number == 4616", "timestamp_epoch": "1583961855.132596000" }, { "tcp_stream": 207, "frame_number": 4638, "display_filter": "frame.number == 4638", "timestamp_epoch": "1583961855.179664000" }, { "tcp_stream": 207, "frame_number": 4679, "display_filter": "frame.number == 4679", "timestamp_epoch": "1583961855.206585000" }, { "tcp_stream": 231, "frame_number": 5551, "display_filter": "frame.number == 5551", "timestamp_epoch": "1583961856.605293000" }, { "tcp_stream": 231, "frame_number": 5791, "display_filter": "frame.number == 5791", "timestamp_epoch": "1583961856.703926000" }, { "tcp_stream": 237, "frame_number": 6154, "display_filter": "frame.number == 6154", "timestamp_epoch": "1583961857.286196000" }, { "tcp_stream": 237, "frame_number": 6254, "display_filter": "frame.number == 6254", "timestamp_epoch": "1583961857.339599000" }, { "tcp_stream": 259, "frame_number": 8616, "display_filter": "frame.number == 8616", "timestamp_epoch": "1583961876.516400000" }, { "tcp_stream": 259, "frame_number": 8998, "display_filter": "frame.number == 8998", "timestamp_epoch": "1583961876.987327000" } ], "attack_id": "T1105", "confidence": 0.8, "finding_ids": [ "finding-00fe5f4c7aefd26b811e3ed4", "finding-1b49952f56bd846c20797136", "finding-1b856a7e84adb279afa011a2", "finding-58449113e255a2130114c983", "finding-6ca9b7acd7ff212a21ca0d96", "finding-9d1007f2a8ad5e4cd409b66a", "finding-a4929b2939a774b5be00f563", "finding-b719ff0cc4815abb825ef07d", "finding-cb44e1bfa4c5fe319a17101f", "finding-f26f0d5b59b803e0a19770bc" ], "mapping_basis": "versioned-deterministic-rule" } ], "analysis_key_material": { "source_sha256": "8df815a53e873e01803010c33752080414b0975709c1c02327e12661eec883a4", "rulepack_version": "pcap-rules-v5", "analyzer_manifest_sha256": "1f3c02483cfea06d85bd326f6e225f3f41a4ab703677d40537577e8bb85c1ce0" } }, "context": { "mode": "local-only", "matches": [], "coverage": { "truncated": false, "no_exact_match": 617, "observable_limit": 5000, "observables_total": 617, "matched_observables": 0, "observables_checked": 617, "prior_cases_checked": 50, "prior_case_limit_reached": true }, "created_at": "2026-09-22T16:01:25.777364+00:00", "session_id": "72835fb7-8eb2-480d-ac51-fb873339ae0c", "techniques": [ { "url": "https://attack.mitre.org/techniques/T1105", "name": "Ingress Tool Transfer", "status": "catalog-context-not-validation-of-behavior", "attack_id": "T1105", "detection": "", "platforms": [ "ESXi", "Linux", "macOS", "Network Devices", "Windows" ], "data_sources": [ "WinEventLog:Sysmon", "auditd:SYSCALL", "iptables:LOG", "macos:endpointsecurity", "macos:unifiedlog", "esxi:hostd", "esxi:vmkernel", "NSM:Flow", "snmp:syslog" ], "catalog_version_id": 851, "detection_strategies": [ { "name": "Detect Ingress Tool Transfers via Behavioral Chain", "stix_id": "x-mitre-detection-strategy--67677c4c-5778-49eb-ae74-1920645b8554", "attack_id": "DET0060" } ], "detection_links_truncated": false } ], "interpretation": "No match means unknown in this corpus. Local CTI may postdate the capture. Matches and shared infrastructure require review; no automatic promotion or attribution.", "schema_version": "pcap-context-v1", "snapshot_sha256": "49a1c4d42d02f7a98d3e8223de9c81c1d38d4198bf1402d947d0407feed5ef70", "source_actor_links": [], "external_enrichment": { "reason": "Requires explicit provider consent and privacy review", "status": "not-requested", "requests": 0 }, "source_semantic_sha256": "205701a0e6aebd9492fa2877a3bf42135b1ae3bbda7370a93eeabc0345e40639", "cross_case_correlations": [ { "shared_count": 98, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 9, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 23, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 18, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 27, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 23, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 28, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 29, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 43, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 25, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 39, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 37, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 8, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 14, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 14, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 16, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 29, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 28, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 34, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 41, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 14, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 20, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 32, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 25, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 12, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 20, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 12, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 19, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." } ] }, "assessment": { "policy_version": "pcap-assessment-v3", "source_semantic_sha256": "205701a0e6aebd9492fa2877a3bf42135b1ae3bbda7370a93eeabc0345e40639", "items": [ { "observable_id": "observable-0ae370cb268a03b560abddcf", "type": "domain", "value": "112.146.166.173.b.barracudacentral.org", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 231, "frame_number": 15114, "display_filter": "frame.number == 15114", "timestamp_epoch": "1583962330.620991000" }, { "udp_stream": 231, "frame_number": 15115, "display_filter": "frame.number == 15115", "timestamp_epoch": "1583962330.679154000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e9156ac12fe3d43eef54ec27", "type": "domain", "value": "112.146.166.173.cbl.abuseat.org", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 230, "frame_number": 15111, "display_filter": "frame.number == 15111", "timestamp_epoch": "1583962330.571726000" }, { "udp_stream": 230, "frame_number": 15113, "display_filter": "frame.number == 15113", "timestamp_epoch": "1583962330.620313000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c9d1d2a47f934606c8214c66", "type": "domain", "value": "112.146.166.173.dnsbl-1.uceprotect.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 232, "frame_number": 15116, "display_filter": "frame.number == 15116", "timestamp_epoch": "1583962330.679973000" }, { "udp_stream": 232, "frame_number": 15117, "display_filter": "frame.number == 15117", "timestamp_epoch": "1583962330.724772000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f6f11aff95e520a1108fd336", "type": "domain", "value": "112.146.166.173.spam.dnsbl.sorbs.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 233, "frame_number": 15118, "display_filter": "frame.number == 15118", "timestamp_epoch": "1583962330.725520000" }, { "udp_stream": 233, "frame_number": 15119, "display_filter": "frame.number == 15119", "timestamp_epoch": "1583962330.755632000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-05b72742a034fe11edc59623", "type": "domain", "value": "112.146.166.173.zen.spamhaus.org", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 229, "frame_number": 15109, "display_filter": "frame.number == 15109", "timestamp_epoch": "1583962330.537921000" }, { "udp_stream": 229, "frame_number": 15110, "display_filter": "frame.number == 15110", "timestamp_epoch": "1583962330.571003000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-76f59dc21699281723c0c5c3", "type": "domain", "value": "1605158521.rsc.cdn77.org", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 387, "frame_number": 26089, "display_filter": "frame.number == 26089", "timestamp_epoch": "1583962657.131237000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-41204ee1d75e0b6e880227c2", "type": "domain", "value": "3750657afd7bdc4d4398b8849268b8a3.nrb.footprintdns.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:09.002145+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:08.999115+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 66, "frame_number": 1876, "display_filter": "frame.number == 1876", "timestamp_epoch": "1583961789.240565000" }, { "udp_stream": 66, "frame_number": 1898, "display_filter": "frame.number == 1898", "timestamp_epoch": "1583961789.286717000" }, { "tcp_stream": 94, "frame_number": 1940, "display_filter": "frame.number == 1940", "timestamp_epoch": "1583961789.543776000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:08.996052+00:00" }, { "observable_id": "observable-32208ce5507d21c89db7990e", "type": "domain", "value": "3af21bab922f1a3fff13816e3eed341a.clo.footprintdns.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:09.203021+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:09.200242+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 203, "frame_number": 12622, "display_filter": "frame.number == 12622", "timestamp_epoch": "1583962015.215242000" }, { "udp_stream": 203, "frame_number": 12625, "display_filter": "frame.number == 12625", "timestamp_epoch": "1583962015.260881000" }, { "tcp_stream": 328, "frame_number": 12631, "display_filter": "frame.number == 12631", "timestamp_epoch": "1583962015.382586000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:09.197514+00:00" }, { "observable_id": "observable-0191862f5d2c7a51df93d6c9", "type": "domain", "value": "7754def074cd4b67fe16c8cfdb10e874.clo.footprintdns.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:09.407553+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:09.402033+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 65, "frame_number": 1868, "display_filter": "frame.number == 1868", "timestamp_epoch": "1583961789.225566000" }, { "udp_stream": 65, "frame_number": 1888, "display_filter": "frame.number == 1888", "timestamp_epoch": "1583961789.266116000" }, { "tcp_stream": 93, "frame_number": 1896, "display_filter": "frame.number == 1896", "timestamp_epoch": "1583961789.281231000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:09.396227+00:00" }, { "observable_id": "observable-604f3c7b82d84a07d610fc10", "type": "domain", "value": "a-ring.msedge.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:09.908536+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:09.906001+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 62, "frame_number": 1832, "display_filter": "frame.number == 1832", "timestamp_epoch": "1583961789.140910000" }, { "udp_stream": 62, "frame_number": 1838, "display_filter": "frame.number == 1838", "timestamp_epoch": "1583961789.154954000" }, { "tcp_stream": 90, "frame_number": 1848, "display_filter": "frame.number == 1848", "timestamp_epoch": "1583961789.173140000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:09.903052+00:00" }, { "observable_id": "observable-65e20b1da385060b3d5293ac", "type": "domain", "value": "act-us.rd.linksynergy.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:10.144569+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:10.140168+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 330, "frame_number": 25994, "display_filter": "frame.number == 25994", "timestamp_epoch": "1583962656.928365000" }, { "udp_stream": 330, "frame_number": 26006, "display_filter": "frame.number == 26006", "timestamp_epoch": "1583962656.958202000" }, { "tcp_stream": 533, "frame_number": 26020, "display_filter": "frame.number == 26020", "timestamp_epoch": "1583962656.976931000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:10.135647+00:00" }, { "observable_id": "observable-4a0f0cd02d740dbca8387a46", "type": "domain", "value": "adhcinqls.mondogreek.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 269, "frame_number": 16218, "display_filter": "frame.number == 16218", "timestamp_epoch": "1583962439.873489000" }, { "udp_stream": 269, "frame_number": 16219, "display_filter": "frame.number == 16219", "timestamp_epoch": "1583962439.873745000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-78901863fb1c158c12fb435a", "type": "domain", "value": "ads-bid.l.doubleclick.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 371, "frame_number": 25284, "display_filter": "frame.number == 25284", "timestamp_epoch": "1583962655.597976000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-585bd071d4dee9cd569191f3", "type": "domain", "value": "adservice.google.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:44:49.436607+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:10.326544+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 354, "frame_number": 24221, "display_filter": "frame.number == 24221", "timestamp_epoch": "1583962653.095219000" }, { "udp_stream": 354, "frame_number": 24224, "display_filter": "frame.number == 24224", "timestamp_epoch": "1583962653.126042000" }, { "udp_stream": 354, "frame_number": 24232, "display_filter": "frame.number == 24232", "timestamp_epoch": "1583962653.141217000" }, { "tcp_stream": 504, "frame_number": 24244, "display_filter": "frame.number == 24244", "timestamp_epoch": "1583962653.171689000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:10.321648+00:00" }, { "observable_id": "observable-17eddbab547f394592b74c04", "type": "domain", "value": "ajax.googleapis.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:10.341533+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:10.336684+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 210, "frame_number": 13387, "display_filter": "frame.number == 13387", "timestamp_epoch": "1583962027.497850000" }, { "udp_stream": 210, "frame_number": 13824, "display_filter": "frame.number == 13824", "timestamp_epoch": "1583962028.498159000" }, { "udp_stream": 210, "frame_number": 13825, "display_filter": "frame.number == 13825", "timestamp_epoch": "1583962029.498523000" }, { "udp_stream": 210, "frame_number": 13828, "display_filter": "frame.number == 13828", "timestamp_epoch": "1583962031.453069000" }, { "tcp_stream": 358, "frame_number": 13836, "display_filter": "frame.number == 13836", "timestamp_epoch": "1583962031.485239000" }, { "tcp_stream": 357, "frame_number": 13838, "display_filter": "frame.number == 13838", "timestamp_epoch": "1583962031.485558000" }, { "tcp_stream": 356, "frame_number": 13842, "display_filter": "frame.number == 13842", "timestamp_epoch": "1583962031.489355000" } ], "roles": [ "dns-query", "http-host", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:10.331194+00:00" }, { "observable_id": "observable-43e7c41d5fa5db1d10ab694e", "type": "domain", "value": "api.bing.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:10.545520+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:10.538625+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 199, "frame_number": 12475, "display_filter": "frame.number == 12475", "timestamp_epoch": "1583962013.754640000" }, { "udp_stream": 199, "frame_number": 12477, "display_filter": "frame.number == 12477", "timestamp_epoch": "1583962013.872494000" }, { "tcp_stream": 342, "frame_number": 13138, "display_filter": "frame.number == 13138", "timestamp_epoch": "1583962020.851264000" }, { "tcp_stream": 343, "frame_number": 13147, "display_filter": "frame.number == 13147", "timestamp_epoch": "1583962020.904625000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:10.533068+00:00" }, { "observable_id": "observable-15f9c9217630fff58412e4d0", "type": "domain", "value": "apis.google.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:44:52.412014+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:10.763854+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 356, "frame_number": 24434, "display_filter": "frame.number == 24434", "timestamp_epoch": "1583962654.458457000" }, { "udp_stream": 356, "frame_number": 24522, "display_filter": "frame.number == 24522", "timestamp_epoch": "1583962654.490285000" }, { "udp_stream": 356, "frame_number": 24523, "display_filter": "frame.number == 24523", "timestamp_epoch": "1583962654.493084000" }, { "tcp_stream": 508, "frame_number": 24535, "display_filter": "frame.number == 24535", "timestamp_epoch": "1583962654.507148000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:10.760848+00:00" }, { "observable_id": "observable-544f05eadedd9cba76d91c5d", "type": "domain", "value": "arc.msn.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:44:53.249652+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:10.770192+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 123, "frame_number": 4008, "display_filter": "frame.number == 4008", "timestamp_epoch": "1583961833.271472000" }, { "udp_stream": 123, "frame_number": 4009, "display_filter": "frame.number == 4009", "timestamp_epoch": "1583961833.292679000" }, { "udp_stream": 131, "frame_number": 4283, "display_filter": "frame.number == 4283", "timestamp_epoch": "1583961848.816890000" }, { "udp_stream": 131, "frame_number": 4284, "display_filter": "frame.number == 4284", "timestamp_epoch": "1583961848.817143000" }, { "tcp_stream": 188, "frame_number": 4013, "display_filter": "frame.number == 4013", "timestamp_epoch": "1583961833.340258000" }, { "tcp_stream": 198, "frame_number": 4288, "display_filter": "frame.number == 4288", "timestamp_epoch": "1583961848.891023000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:10.767353+00:00" }, { "observable_id": "observable-a0a89ac65764adc7f94bc1ac", "type": "domain", "value": "arc.msn.com.nsatc.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 123, "frame_number": 4009, "display_filter": "frame.number == 4009", "timestamp_epoch": "1583961833.292679000" }, { "udp_stream": 131, "frame_number": 4284, "display_filter": "frame.number == 4284", "timestamp_epoch": "1583961848.817143000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-245b597dbb970839092a032e", "type": "domain", "value": "array801.prod.do.dsp.mp.microsoft.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:10.777110+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:10.774132+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 25, "frame_number": 752, "display_filter": "frame.number == 752", "timestamp_epoch": "1583961759.710732000" }, { "udp_stream": 25, "frame_number": 753, "display_filter": "frame.number == 753", "timestamp_epoch": "1583961759.735456000" }, { "udp_stream": 113, "frame_number": 3230, "display_filter": "frame.number == 3230", "timestamp_epoch": "1583961817.509957000" }, { "udp_stream": 113, "frame_number": 3231, "display_filter": "frame.number == 3231", "timestamp_epoch": "1583961817.510251000" }, { "tcp_stream": 38, "frame_number": 763, "display_filter": "frame.number == 763", "timestamp_epoch": "1583961759.819059000" }, { "tcp_stream": 39, "frame_number": 792, "display_filter": "frame.number == 792", "timestamp_epoch": "1583961760.021836000" }, { "tcp_stream": 44, "frame_number": 904, "display_filter": "frame.number == 904", "timestamp_epoch": "1583961760.850310000" }, { "tcp_stream": 152, "frame_number": 3245, "display_filter": "frame.number == 3245", "timestamp_epoch": "1583961817.609710000" }, { "tcp_stream": 160, "frame_number": 3391, "display_filter": "frame.number == 3391", "timestamp_epoch": "1583961817.934203000" }, { "tcp_stream": 161, "frame_number": 3433, "display_filter": "frame.number == 3433", "timestamp_epoch": "1583961818.069474000" }, { "tcp_stream": 167, "frame_number": 3578, "display_filter": "frame.number == 3578", "timestamp_epoch": "1583961818.884505000" }, { "tcp_stream": 652, "frame_number": 29984, "display_filter": "frame.number == 29984", "timestamp_epoch": "1583963646.363909000" }, { "tcp_stream": 654, "frame_number": 30039, "display_filter": "frame.number == 30039", "timestamp_epoch": "1583963756.619519000" }, { "tcp_stream": 655, "frame_number": 30072, "display_filter": "frame.number == 30072", "timestamp_epoch": "1583963838.012937000" }, { "tcp_stream": 656, "frame_number": 30112, "display_filter": "frame.number == 30112", "timestamp_epoch": "1583964000.153219000" }, { "tcp_stream": 657, "frame_number": 30149, "display_filter": "frame.number == 30149", "timestamp_epoch": "1583964094.984345000" }, { "tcp_stream": 658, "frame_number": 30173, "display_filter": "frame.number == 30173", "timestamp_epoch": "1583964109.370351000" }, { "tcp_stream": 659, "frame_number": 30203, "display_filter": "frame.number == 30203", "timestamp_epoch": "1583964262.889030000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:10.772313+00:00" }, { "observable_id": "observable-0a0e108c1217475396615e9a", "type": "domain", "value": "array802.prod.do.dsp.mp.microsoft.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:10.960475+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:10.958502+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 114, "frame_number": 3299, "display_filter": "frame.number == 3299", "timestamp_epoch": "1583961817.708162000" }, { "udp_stream": 114, "frame_number": 3304, "display_filter": "frame.number == 3304", "timestamp_epoch": "1583961817.728584000" }, { "tcp_stream": 157, "frame_number": 3324, "display_filter": "frame.number == 3324", "timestamp_epoch": "1583961817.766377000" }, { "tcp_stream": 653, "frame_number": 30011, "display_filter": "frame.number == 30011", "timestamp_epoch": "1583963703.402183000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:10.955741+00:00" }, { "observable_id": "observable-2a19bbce2fa3cf90d33d60ca", "type": "domain", "value": "array803.prod.do.dsp.mp.microsoft.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:11.173642+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:11.171015+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 115, "frame_number": 3503, "display_filter": "frame.number == 3503", "timestamp_epoch": "1583961818.470160000" }, { "udp_stream": 115, "frame_number": 3512, "display_filter": "frame.number == 3512", "timestamp_epoch": "1583961818.499999000" }, { "tcp_stream": 166, "frame_number": 3532, "display_filter": "frame.number == 3532", "timestamp_epoch": "1583961818.592581000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:11.167971+00:00" }, { "observable_id": "observable-1d67d6de284f0bdbade853f6", "type": "domain", "value": "array807.prod.do.dsp.mp.microsoft.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:11.571915+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:11.569603+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 26, "frame_number": 862, "display_filter": "frame.number == 862", "timestamp_epoch": "1583961760.436616000" }, { "udp_stream": 26, "frame_number": 863, "display_filter": "frame.number == 863", "timestamp_epoch": "1583961760.453103000" }, { "tcp_stream": 43, "frame_number": 883, "display_filter": "frame.number == 883", "timestamp_epoch": "1583961760.712168000" }, { "tcp_stream": 649, "frame_number": 29900, "display_filter": "frame.number == 29900", "timestamp_epoch": "1583963577.962639000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:11.565984+00:00" }, { "observable_id": "observable-b58abbea21a98641535af6c9", "type": "domain", "value": "assets.adobedtm.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:11.736475+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:11.734368+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 328, "frame_number": 21274, "display_filter": "frame.number == 21274", "timestamp_epoch": "1583962650.898819000" }, { "udp_stream": 328, "frame_number": 21288, "display_filter": "frame.number == 21288", "timestamp_epoch": "1583962650.943602000" }, { "tcp_stream": 473, "frame_number": 21340, "display_filter": "frame.number == 21340", "timestamp_epoch": "1583962650.990680000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:11.731959+00:00" }, { "observable_id": "observable-5d3e59cc7011ccb30047b5b9", "type": "domain", "value": "az725175.vo.msecnd.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:11.954868+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:11.952952+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 204, "frame_number": 12659, "display_filter": "frame.number == 12659", "timestamp_epoch": "1583962015.493983000" }, { "udp_stream": 204, "frame_number": 12660, "display_filter": "frame.number == 12660", "timestamp_epoch": "1583962015.538643000" }, { "tcp_stream": 333, "frame_number": 12731, "display_filter": "frame.number == 12731", "timestamp_epoch": "1583962015.559942000" }, { "tcp_stream": 332, "frame_number": 12733, "display_filter": "frame.number == 12733", "timestamp_epoch": "1583962015.561629000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:11.950841+00:00" }, { "observable_id": "observable-66fcfd3b0edf7b64db4f5e0b", "type": "domain", "value": "b-ring.msedge.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:44:54.560020+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:12.108190+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 77, "frame_number": 2334, "display_filter": "frame.number == 2334", "timestamp_epoch": "1583961806.477891000" }, { "udp_stream": 77, "frame_number": 2336, "display_filter": "frame.number == 2336", "timestamp_epoch": "1583961806.493595000" }, { "tcp_stream": 115, "frame_number": 2371, "display_filter": "frame.number == 2371", "timestamp_epoch": "1583961806.629972000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:12.105915+00:00" }, { "observable_id": "observable-27951bda77b95e7ec6e47c33", "type": "domain", "value": "bid.g.doubleclick.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 371, "frame_number": 25262, "display_filter": "frame.number == 25262", "timestamp_epoch": "1583962655.531120000" }, { "udp_stream": 371, "frame_number": 25277, "display_filter": "frame.number == 25277", "timestamp_epoch": "1583962655.563393000" }, { "udp_stream": 371, "frame_number": 25284, "display_filter": "frame.number == 25284", "timestamp_epoch": "1583962655.597976000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-4cda9a6c6ae54c3360daafe8", "type": "domain", "value": "bolton-tech.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:06.586518+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:06.396436+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:06.391982+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 179, "frame_number": 8611, "display_filter": "frame.number == 8611", "timestamp_epoch": "1583961876.384749000" }, { "udp_stream": 179, "frame_number": 8612, "display_filter": "frame.number == 8612", "timestamp_epoch": "1583961876.430841000" }, { "tcp_stream": 259, "frame_number": 8616, "display_filter": "frame.number == 8616", "timestamp_epoch": "1583961876.516400000" } ], "roles": [ "dns-query", "http-host" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:06.386904+00:00" }, { "observable_id": "observable-da0310415f379e8f0dc82c7e", "type": "domain", "value": "c.storage.googleapis.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 208, "frame_number": 13334, "display_filter": "frame.number == 13334", "timestamp_epoch": "1583962027.473726000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-7113586740877f7bdc0118df", "type": "domain", "value": "c1.neweggimages.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:12.119955+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:12.118227+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 330, "frame_number": 21282, "display_filter": "frame.number == 21282", "timestamp_epoch": "1583962650.899589000" }, { "udp_stream": 330, "frame_number": 21289, "display_filter": "frame.number == 21289", "timestamp_epoch": "1583962650.943689000" }, { "tcp_stream": 472, "frame_number": 21304, "display_filter": "frame.number == 21304", "timestamp_epoch": "1583962650.966874000" }, { "tcp_stream": 476, "frame_number": 21347, "display_filter": "frame.number == 21347", "timestamp_epoch": "1583962650.991222000" }, { "tcp_stream": 475, "frame_number": 21352, "display_filter": "frame.number == 21352", "timestamp_epoch": "1583962650.991571000" }, { "tcp_stream": 474, "frame_number": 21355, "display_filter": "frame.number == 21355", "timestamp_epoch": "1583962650.991880000" }, { "tcp_stream": 479, "frame_number": 21357, "display_filter": "frame.number == 21357", "timestamp_epoch": "1583962650.992120000" }, { "tcp_stream": 478, "frame_number": 21359, "display_filter": "frame.number == 21359", "timestamp_epoch": "1583962650.992366000" }, { "tcp_stream": 477, "frame_number": 21361, "display_filter": "frame.number == 21361", "timestamp_epoch": "1583962650.992708000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:12.116199+00:00" }, { "observable_id": "observable-f0382da974f4947210d0bfda", "type": "domain", "value": "checkip.amazonaws.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:12.374426+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:12.370123+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 228, "frame_number": 14966, "display_filter": "frame.number == 14966", "timestamp_epoch": "1583962320.148514000" }, { "udp_stream": 228, "frame_number": 14974, "display_filter": "frame.number == 14974", "timestamp_epoch": "1583962320.197469000" }, { "tcp_stream": 389, "frame_number": 14981, "display_filter": "frame.number == 14981", "timestamp_epoch": "1583962320.240229000" } ], "roles": [ "dns-query", "http-host" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:12.364602+00:00" }, { "observable_id": "observable-f8b1236ba7d07fae4345bdd8", "type": "domain", "value": "client.wns.windows.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:12.580326+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:12.569902+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 196, "frame_number": 12354, "display_filter": "frame.number == 12354", "timestamp_epoch": "1583961994.562581000" }, { "udp_stream": 196, "frame_number": 12357, "display_filter": "frame.number == 12357", "timestamp_epoch": "1583961994.711946000" }, { "udp_stream": 211, "frame_number": 14080, "display_filter": "frame.number == 14080", "timestamp_epoch": "1583962054.455424000" }, { "udp_stream": 211, "frame_number": 14081, "display_filter": "frame.number == 14081", "timestamp_epoch": "1583962054.581731000" }, { "udp_stream": 224, "frame_number": 14738, "display_filter": "frame.number == 14738", "timestamp_epoch": "1583962291.158736000" }, { "udp_stream": 224, "frame_number": 14739, "display_filter": "frame.number == 14739", "timestamp_epoch": "1583962291.199928000" }, { "udp_stream": 224, "frame_number": 14741, "display_filter": "frame.number == 14741", "timestamp_epoch": "1583962291.242182000" }, { "udp_stream": 226, "frame_number": 14913, "display_filter": "frame.number == 14913", "timestamp_epoch": "1583962319.845278000" }, { "udp_stream": 226, "frame_number": 14921, "display_filter": "frame.number == 14921", "timestamp_epoch": "1583962319.963750000" }, { "udp_stream": 235, "frame_number": 15134, "display_filter": "frame.number == 15134", "timestamp_epoch": "1583962351.651049000" }, { "udp_stream": 235, "frame_number": 15135, "display_filter": "frame.number == 15135", "timestamp_epoch": "1583962351.681707000" }, { "udp_stream": 235, "frame_number": 15136, "display_filter": "frame.number == 15136", "timestamp_epoch": "1583962351.740704000" }, { "udp_stream": 238, "frame_number": 15375, "display_filter": "frame.number == 15375", "timestamp_epoch": "1583962380.291791000" }, { "udp_stream": 238, "frame_number": 15376, "display_filter": "frame.number == 15376", "timestamp_epoch": "1583962380.292101000" }, { "udp_stream": 254, "frame_number": 15743, "display_filter": "frame.number == 15743", "timestamp_epoch": "1583962387.466379000" }, { "udp_stream": 254, "frame_number": 15744, "display_filter": "frame.number == 15744", "timestamp_epoch": "1583962387.466826000" }, { "udp_stream": 262, "frame_number": 16109, "display_filter": "frame.number == 16109", "timestamp_epoch": "1583962433.733151000" }, { "udp_stream": 262, "frame_number": 16110, "display_filter": "frame.number == 16110", "timestamp_epoch": "1583962433.763569000" }, { "udp_stream": 262, "frame_number": 16114, "display_filter": "frame.number == 16114", "timestamp_epoch": "1583962434.184347000" }, { "udp_stream": 290, "frame_number": 16380, "display_filter": "frame.number == 16380", "timestamp_epoch": "1583962545.186625000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:12.557319+00:00" }, { "observable_id": "observable-2544d55789420327e442a050", "type": "domain", "value": "cm.everesttech.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:12.881423+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:12.879367+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 350, "frame_number": 23846, "display_filter": "frame.number == 23846", "timestamp_epoch": "1583962652.619274000" }, { "udp_stream": 350, "frame_number": 23889, "display_filter": "frame.number == 23889", "timestamp_epoch": "1583962652.649600000" }, { "udp_stream": 350, "frame_number": 23890, "display_filter": "frame.number == 23890", "timestamp_epoch": "1583962652.656673000" }, { "tcp_stream": 497, "frame_number": 24019, "display_filter": "frame.number == 24019", "timestamp_epoch": "1583962652.735242000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:12.875157+00:00" }, { "observable_id": "observable-25d92732f145f581a9ce651a", "type": "domain", "value": "cm.everesttech.net.akadns.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 350, "frame_number": 23890, "display_filter": "frame.number == 23890", "timestamp_epoch": "1583962652.656673000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f9a97b240d38b14d02f7925c", "type": "domain", "value": "cm.g.doubleclick.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:13.189219+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:13.185894+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 392, "frame_number": 26061, "display_filter": "frame.number == 26061", "timestamp_epoch": "1583962657.105888000" }, { "udp_stream": 392, "frame_number": 26090, "display_filter": "frame.number == 26090", "timestamp_epoch": "1583962657.131301000" }, { "tcp_stream": 539, "frame_number": 26103, "display_filter": "frame.number == 26103", "timestamp_epoch": "1583962657.150270000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:13.181441+00:00" }, { "observable_id": "observable-c23ee5a2dfccf76f561af69d", "type": "domain", "value": "combsscreenprinting.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 148, "frame_number": 4916, "display_filter": "frame.number == 4916", "timestamp_epoch": "1583961856.009855000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b34e47e49b9d4dca6459389b", "type": "domain", "value": "config.edge.skype.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:13.482784+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:13.477746+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 137, "frame_number": 4339, "display_filter": "frame.number == 4339", "timestamp_epoch": "1583961854.499941000" }, { "udp_stream": 137, "frame_number": 4342, "display_filter": "frame.number == 4342", "timestamp_epoch": "1583961854.516637000" }, { "udp_stream": 406, "frame_number": 26794, "display_filter": "frame.number == 26794", "timestamp_epoch": "1583962685.572318000" }, { "udp_stream": 406, "frame_number": 26795, "display_filter": "frame.number == 26795", "timestamp_epoch": "1583962685.586418000" }, { "udp_stream": 407, "frame_number": 27313, "display_filter": "frame.number == 27313", "timestamp_epoch": "1583962732.810115000" }, { "udp_stream": 407, "frame_number": 27314, "display_filter": "frame.number == 27314", "timestamp_epoch": "1583962732.810552000" }, { "tcp_stream": 199, "frame_number": 4346, "display_filter": "frame.number == 4346", "timestamp_epoch": "1583961854.558232000" }, { "tcp_stream": 559, "frame_number": 26799, "display_filter": "frame.number == 26799", "timestamp_epoch": "1583962685.627144000" }, { "tcp_stream": 560, "frame_number": 26833, "display_filter": "frame.number == 26833", "timestamp_epoch": "1583962685.853264000" }, { "tcp_stream": 561, "frame_number": 26853, "display_filter": "frame.number == 26853", "timestamp_epoch": "1583962685.883420000" }, { "tcp_stream": 562, "frame_number": 26855, "display_filter": "frame.number == 26855", "timestamp_epoch": "1583962685.883687000" }, { "tcp_stream": 563, "frame_number": 26857, "display_filter": "frame.number == 26857", "timestamp_epoch": "1583962685.883957000" }, { "tcp_stream": 565, "frame_number": 27318, "display_filter": "frame.number == 27318", "timestamp_epoch": "1583962732.931229000" }, { "tcp_stream": 566, "frame_number": 27331, "display_filter": "frame.number == 27331", "timestamp_epoch": "1583962732.970807000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:13.473252+00:00" }, { "observable_id": "observable-097426c7715099a8e7103cf4", "type": "domain", "value": "connect.facebook.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:14.006547+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:14.004031+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 155, "frame_number": 5939, "display_filter": "frame.number == 5939", "timestamp_epoch": "1583961856.894261000" }, { "udp_stream": 155, "frame_number": 5989, "display_filter": "frame.number == 5989", "timestamp_epoch": "1583961856.974342000" }, { "udp_stream": 310, "frame_number": 21116, "display_filter": "frame.number == 21116", "timestamp_epoch": "1583962650.284728000" }, { "udp_stream": 310, "frame_number": 21125, "display_filter": "frame.number == 21125", "timestamp_epoch": "1583962650.316511000" }, { "udp_stream": 310, "frame_number": 21130, "display_filter": "frame.number == 21130", "timestamp_epoch": "1583962650.341046000" }, { "tcp_stream": 233, "frame_number": 6063, "display_filter": "frame.number == 6063", "timestamp_epoch": "1583961857.209451000" }, { "tcp_stream": 236, "frame_number": 6070, "display_filter": "frame.number == 6070", "timestamp_epoch": "1583961857.209880000" }, { "tcp_stream": 242, "frame_number": 6969, "display_filter": "frame.number == 6969", "timestamp_epoch": "1583961857.606073000" }, { "tcp_stream": 513, "frame_number": 25255, "display_filter": "frame.number == 25255", "timestamp_epoch": "1583962655.507108000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:14.000598+00:00" }, { "observable_id": "observable-76152bf96069bc445aac9ffe", "type": "domain", "value": "consent.dc-storm.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:14.312283+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:14.309568+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 381, "frame_number": 25544, "display_filter": "frame.number == 25544", "timestamp_epoch": "1583962655.937905000" }, { "udp_stream": 381, "frame_number": 25557, "display_filter": "frame.number == 25557", "timestamp_epoch": "1583962655.958527000" }, { "tcp_stream": 525, "frame_number": 25599, "display_filter": "frame.number == 25599", "timestamp_epoch": "1583962655.996983000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:14.306696+00:00" }, { "observable_id": "observable-036bcf14e458ef91ddbd8a0b", "type": "domain", "value": "consent.jrs5.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:14.517491+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:14.514632+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 380, "frame_number": 25512, "display_filter": "frame.number == 25512", "timestamp_epoch": "1583962655.896748000" }, { "udp_stream": 380, "frame_number": 25526, "display_filter": "frame.number == 25526", "timestamp_epoch": "1583962655.921391000" }, { "udp_stream": 380, "frame_number": 25541, "display_filter": "frame.number == 25541", "timestamp_epoch": "1583962655.936519000" }, { "tcp_stream": 520, "frame_number": 25722, "display_filter": "frame.number == 25722", "timestamp_epoch": "1583962656.143522000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:14.511625+00:00" }, { "observable_id": "observable-7d2ae74abd75181862da750c", "type": "domain", "value": "consent.linksynergy.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:14.674546+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:14.672659+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 377, "frame_number": 25509, "display_filter": "frame.number == 25509", "timestamp_epoch": "1583962655.895821000" }, { "udp_stream": 377, "frame_number": 25529, "display_filter": "frame.number == 25529", "timestamp_epoch": "1583962655.921656000" }, { "udp_stream": 377, "frame_number": 25648, "display_filter": "frame.number == 25648", "timestamp_epoch": "1583962656.140330000" }, { "tcp_stream": 527, "frame_number": 25739, "display_filter": "frame.number == 25739", "timestamp_epoch": "1583962656.160004000" }, { "tcp_stream": 528, "frame_number": 25752, "display_filter": "frame.number == 25752", "timestamp_epoch": "1583962656.163391000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:14.670515+00:00" }, { "observable_id": "observable-80b2ac8a6e80132067fb44d4", "type": "domain", "value": "consent.mediaforge.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:14.925570+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:14.923580+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 379, "frame_number": 25511, "display_filter": "frame.number == 25511", "timestamp_epoch": "1583962655.896684000" }, { "udp_stream": 379, "frame_number": 25527, "display_filter": "frame.number == 25527", "timestamp_epoch": "1583962655.921483000" }, { "udp_stream": 379, "frame_number": 25542, "display_filter": "frame.number == 25542", "timestamp_epoch": "1583962655.936624000" }, { "tcp_stream": 524, "frame_number": 25559, "display_filter": "frame.number == 25559", "timestamp_epoch": "1583962655.959394000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:14.921076+00:00" }, { "observable_id": "observable-0e61e6d1985d312211428cd4", "type": "domain", "value": "consent.nxtck.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:15.099412+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:15.097334+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 378, "frame_number": 25510, "display_filter": "frame.number == 25510", "timestamp_epoch": "1583962655.895972000" }, { "udp_stream": 378, "frame_number": 25528, "display_filter": "frame.number == 25528", "timestamp_epoch": "1583962655.921556000" }, { "udp_stream": 378, "frame_number": 25540, "display_filter": "frame.number == 25540", "timestamp_epoch": "1583962655.936451000" }, { "tcp_stream": 523, "frame_number": 25718, "display_filter": "frame.number == 25718", "timestamp_epoch": "1583962656.142900000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:15.094770+00:00" }, { "observable_id": "observable-a66273e03527b18aa0d9cf08", "type": "domain", "value": "cookie-sync-service-prod.steelhousemedia.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:15.275417+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:15.273541+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 402, "frame_number": 26574, "display_filter": "frame.number == 26574", "timestamp_epoch": "1583962661.807697000" }, { "udp_stream": 402, "frame_number": 26575, "display_filter": "frame.number == 26575", "timestamp_epoch": "1583962661.827699000" }, { "udp_stream": 402, "frame_number": 26577, "display_filter": "frame.number == 26577", "timestamp_epoch": "1583962661.873966000" }, { "tcp_stream": 553, "frame_number": 26581, "display_filter": "frame.number == 26581", "timestamp_epoch": "1583962661.942793000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:15.271209+00:00" }, { "observable_id": "observable-f4cd96e137b9d8a9477bf743", "type": "domain", "value": "cookie.coreprod.west2.steelhouse.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 402, "frame_number": 26577, "display_filter": "frame.number == 26577", "timestamp_epoch": "1583962661.873966000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-06b4160fe8f02466535caf5e", "type": "domain", "value": "cp801.prod.do.dsp.mp.microsoft.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:15.538258+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:15.536582+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 22, "frame_number": 654, "display_filter": "frame.number == 654", "timestamp_epoch": "1583961758.998718000" }, { "udp_stream": 22, "frame_number": 657, "display_filter": "frame.number == 657", "timestamp_epoch": "1583961759.040026000" }, { "udp_stream": 111, "frame_number": 3162, "display_filter": "frame.number == 3162", "timestamp_epoch": "1583961817.237735000" }, { "udp_stream": 111, "frame_number": 3163, "display_filter": "frame.number == 3163", "timestamp_epoch": "1583961817.238134000" }, { "tcp_stream": 33, "frame_number": 662, "display_filter": "frame.number == 662", "timestamp_epoch": "1583961759.168742000" }, { "tcp_stream": 34, "frame_number": 687, "display_filter": "frame.number == 687", "timestamp_epoch": "1583961759.341157000" }, { "tcp_stream": 37, "frame_number": 728, "display_filter": "frame.number == 728", "timestamp_epoch": "1583961759.638476000" }, { "tcp_stream": 41, "frame_number": 794, "display_filter": "frame.number == 794", "timestamp_epoch": "1583961760.022112000" }, { "tcp_stream": 149, "frame_number": 3169, "display_filter": "frame.number == 3169", "timestamp_epoch": "1583961817.254324000" }, { "tcp_stream": 151, "frame_number": 3196, "display_filter": "frame.number == 3196", "timestamp_epoch": "1583961817.414873000" }, { "tcp_stream": 154, "frame_number": 3249, "display_filter": "frame.number == 3249", "timestamp_epoch": "1583961817.610179000" }, { "tcp_stream": 156, "frame_number": 3311, "display_filter": "frame.number == 3311", "timestamp_epoch": "1583961817.732630000" }, { "tcp_stream": 159, "frame_number": 3378, "display_filter": "frame.number == 3378", "timestamp_epoch": "1583961817.868436000" }, { "tcp_stream": 163, "frame_number": 3455, "display_filter": "frame.number == 3455", "timestamp_epoch": "1583961818.252446000" }, { "tcp_stream": 165, "frame_number": 3522, "display_filter": "frame.number == 3522", "timestamp_epoch": "1583961818.522859000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:15.534496+00:00" }, { "observable_id": "observable-d0add20799ca79c7bb7aeda7", "type": "domain", "value": "crl.securetrust.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:15.693251+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:15.691661+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 342, "frame_number": 21822, "display_filter": "frame.number == 21822", "timestamp_epoch": "1583962651.315788000" }, { "udp_stream": 342, "frame_number": 21890, "display_filter": "frame.number == 21890", "timestamp_epoch": "1583962651.357204000" }, { "udp_stream": 342, "frame_number": 21898, "display_filter": "frame.number == 21898", "timestamp_epoch": "1583962651.368700000" }, { "tcp_stream": 491, "frame_number": 21909, "display_filter": "frame.number == 21909", "timestamp_epoch": "1583962651.430770000" } ], "roles": [ "dns-query", "http-host" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:15.689568+00:00" }, { "observable_id": "observable-943dc40f2a94a7d25cf5e991", "type": "domain", "value": "cs2005.wpc.alphacdn.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 332, "frame_number": 21318, "display_filter": "frame.number == 21318", "timestamp_epoch": "1583962650.986719000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2ea6a0128f9f1f1e08a8ce77", "type": "domain", "value": "cs22.wpc.v0cdn.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 204, "frame_number": 12660, "display_filter": "frame.number == 12660", "timestamp_epoch": "1583962015.538643000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b387642262723218d7f6c8fb", "type": "domain", "value": "cs9.wac.phicdn.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 193, "frame_number": 10496, "display_filter": "frame.number == 10496", "timestamp_epoch": "1583961955.805772000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a5716e3c4855000d423c0b10", "type": "domain", "value": "ctldl.windowsupdate.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:15.866753+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:15.862074+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 189, "frame_number": 10324, "display_filter": "frame.number == 10324", "timestamp_epoch": "1583961934.167029000" }, { "udp_stream": 189, "frame_number": 10325, "display_filter": "frame.number == 10325", "timestamp_epoch": "1583961934.209558000" }, { "udp_stream": 408, "frame_number": 27386, "display_filter": "frame.number == 27386", "timestamp_epoch": "1583962744.495077000" }, { "udp_stream": 408, "frame_number": 27387, "display_filter": "frame.number == 27387", "timestamp_epoch": "1583962744.515705000" }, { "tcp_stream": 268, "frame_number": 10329, "display_filter": "frame.number == 10329", "timestamp_epoch": "1583961934.226577000" }, { "tcp_stream": 268, "frame_number": 10332, "display_filter": "frame.number == 10332", "timestamp_epoch": "1583961934.251616000" }, { "tcp_stream": 567, "frame_number": 27391, "display_filter": "frame.number == 27391", "timestamp_epoch": "1583962744.531400000" }, { "tcp_stream": 567, "frame_number": 27394, "display_filter": "frame.number == 27394", "timestamp_epoch": "1583962744.555361000" } ], "roles": [ "dns-query", "http-host" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:15.856488+00:00" }, { "observable_id": "observable-971b077dcad87d68e277ce9c", "type": "domain", "value": "disc801.prod.do.dsp.mp.microsoft.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:16.482572+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:16.478807+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 24, "frame_number": 679, "display_filter": "frame.number == 679", "timestamp_epoch": "1583961759.292702000" }, { "udp_stream": 24, "frame_number": 683, "display_filter": "frame.number == 683", "timestamp_epoch": "1583961759.326791000" }, { "udp_stream": 112, "frame_number": 3186, "display_filter": "frame.number == 3186", "timestamp_epoch": "1583961817.390295000" }, { "udp_stream": 112, "frame_number": 3187, "display_filter": "frame.number == 3187", "timestamp_epoch": "1583961817.390606000" }, { "tcp_stream": 35, "frame_number": 697, "display_filter": "frame.number == 697", "timestamp_epoch": "1583961759.392332000" }, { "tcp_stream": 36, "frame_number": 730, "display_filter": "frame.number == 730", "timestamp_epoch": "1583961759.638656000" }, { "tcp_stream": 40, "frame_number": 799, "display_filter": "frame.number == 799", "timestamp_epoch": "1583961760.022422000" }, { "tcp_stream": 42, "frame_number": 868, "display_filter": "frame.number == 868", "timestamp_epoch": "1583961760.475144000" }, { "tcp_stream": 150, "frame_number": 3197, "display_filter": "frame.number == 3197", "timestamp_epoch": "1583961817.414916000" }, { "tcp_stream": 153, "frame_number": 3247, "display_filter": "frame.number == 3247", "timestamp_epoch": "1583961817.610058000" }, { "tcp_stream": 155, "frame_number": 3306, "display_filter": "frame.number == 3306", "timestamp_epoch": "1583961817.729255000" }, { "tcp_stream": 158, "frame_number": 3371, "display_filter": "frame.number == 3371", "timestamp_epoch": "1583961817.853953000" }, { "tcp_stream": 162, "frame_number": 3457, "display_filter": "frame.number == 3457", "timestamp_epoch": "1583961818.252809000" }, { "tcp_stream": 164, "frame_number": 3509, "display_filter": "frame.number == 3509", "timestamp_epoch": "1583961818.471038000" }, { "tcp_stream": 168, "frame_number": 3576, "display_filter": "frame.number == 3576", "timestamp_epoch": "1583961818.884193000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:16.475145+00:00" }, { "observable_id": "observable-50a552d0927c85adb0bd6caa", "type": "domain", "value": "dns.msftncsi.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 36, "frame_number": 1079, "display_filter": "frame.number == 1079", "timestamp_epoch": "1583961779.925743000" }, { "udp_stream": 36, "frame_number": 1080, "display_filter": "frame.number == 1080", "timestamp_epoch": "1583961779.950820000" }, { "udp_stream": 84, "frame_number": 2497, "display_filter": "frame.number == 2497", "timestamp_epoch": "1583961811.168733000" }, { "udp_stream": 84, "frame_number": 2498, "display_filter": "frame.number == 2498", "timestamp_epoch": "1583961811.185698000" }, { "udp_stream": 220, "frame_number": 14614, "display_filter": "frame.number == 14614", "timestamp_epoch": "1583962215.914197000" }, { "udp_stream": 220, "frame_number": 14615, "display_filter": "frame.number == 14615", "timestamp_epoch": "1583962215.989692000" }, { "udp_stream": 223, "frame_number": 14724, "display_filter": "frame.number == 14724", "timestamp_epoch": "1583962275.915845000" }, { "udp_stream": 223, "frame_number": 14725, "display_filter": "frame.number == 14725", "timestamp_epoch": "1583962275.929534000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-868b982523a66112cca36b0b", "type": "domain", "value": "dp58aslhmbcib.cloudfront.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:16.672653+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:16.668466+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 152, "frame_number": 5033, "display_filter": "frame.number == 5033", "timestamp_epoch": "1583961856.143539000" }, { "udp_stream": 152, "frame_number": 5064, "display_filter": "frame.number == 5064", "timestamp_epoch": "1583961856.184965000" }, { "tcp_stream": 229, "frame_number": 5234, "display_filter": "frame.number == 5234", "timestamp_epoch": "1583961856.361784000" }, { "tcp_stream": 228, "frame_number": 5236, "display_filter": "frame.number == 5236", "timestamp_epoch": "1583961856.362025000" }, { "tcp_stream": 227, "frame_number": 5238, "display_filter": "frame.number == 5238", "timestamp_epoch": "1583961856.362599000" }, { "tcp_stream": 226, "frame_number": 5240, "display_filter": "frame.number == 5240", "timestamp_epoch": "1583961856.362849000" }, { "tcp_stream": 225, "frame_number": 5242, "display_filter": "frame.number == 5242", "timestamp_epoch": "1583961856.363062000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:16.664059+00:00" }, { "observable_id": "observable-5fb817e280a1925ed15c1d17", "type": "domain", "value": "dpm.demdex.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:16.880908+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:16.874591+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 343, "frame_number": 21903, "display_filter": "frame.number == 21903", "timestamp_epoch": "1583962651.419370000" }, { "udp_stream": 343, "frame_number": 21913, "display_filter": "frame.number == 21913", "timestamp_epoch": "1583962651.451829000" }, { "udp_stream": 343, "frame_number": 21915, "display_filter": "frame.number == 21915", "timestamp_epoch": "1583962651.475025000" }, { "tcp_stream": 492, "frame_number": 22169, "display_filter": "frame.number == 22169", "timestamp_epoch": "1583962651.577149000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:16.870226+00:00" }, { "observable_id": "observable-d03ab386fad7cbafb5fbf028", "type": "domain", "value": "dsum-sec.casalemedia.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:17.077543+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:17.073176+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 393, "frame_number": 26085, "display_filter": "frame.number == 26085", "timestamp_epoch": "1583962657.127019000" }, { "udp_stream": 393, "frame_number": 26109, "display_filter": "frame.number == 26109", "timestamp_epoch": "1583962657.157861000" }, { "udp_stream": 393, "frame_number": 26147, "display_filter": "frame.number == 26147", "timestamp_epoch": "1583962657.208179000" }, { "tcp_stream": 543, "frame_number": 26187, "display_filter": "frame.number == 26187", "timestamp_epoch": "1583962657.268445000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:17.068180+00:00" }, { "observable_id": "observable-384e3809ea37cafc57b8af9e", "type": "domain", "value": "dualstack.com.imgix.map.fastly.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 159, "frame_number": 6020, "display_filter": "frame.number == 6020", "timestamp_epoch": "1583961857.068008000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a6a385ab23ca13e828a5ed07", "type": "domain", "value": "dx.steelhousemedia.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:17.270568+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:17.266083+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 366, "frame_number": 25216, "display_filter": "frame.number == 25216", "timestamp_epoch": "1583962655.433700000" }, { "udp_stream": 366, "frame_number": 25225, "display_filter": "frame.number == 25225", "timestamp_epoch": "1583962655.464475000" }, { "udp_stream": 366, "frame_number": 25242, "display_filter": "frame.number == 25242", "timestamp_epoch": "1583962655.496520000" }, { "tcp_stream": 517, "frame_number": 25270, "display_filter": "frame.number == 25270", "timestamp_epoch": "1583962655.536065000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:17.261613+00:00" }, { "observable_id": "observable-fbbbca3371089da6171e98db", "type": "domain", "value": "ec-apis.newegg.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:17.476664+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:17.472560+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 339, "frame_number": 21387, "display_filter": "frame.number == 21387", "timestamp_epoch": "1583962651.094883000" }, { "udp_stream": 339, "frame_number": 21402, "display_filter": "frame.number == 21402", "timestamp_epoch": "1583962651.125734000" }, { "udp_stream": 339, "frame_number": 21566, "display_filter": "frame.number == 21566", "timestamp_epoch": "1583962651.194645000" }, { "tcp_stream": 489, "frame_number": 21684, "display_filter": "frame.number == 21684", "timestamp_epoch": "1583962651.226524000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:17.468086+00:00" }, { "observable_id": "observable-b8156b9826eb0e7ac59cfeb4", "type": "domain", "value": "edge.microsoft.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:17.653359+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:17.648103+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 186, "frame_number": 10206, "display_filter": "frame.number == 10206", "timestamp_epoch": "1583961911.711934000" }, { "udp_stream": 186, "frame_number": 10212, "display_filter": "frame.number == 10212", "timestamp_epoch": "1583961911.739107000" }, { "udp_stream": 349, "frame_number": 23844, "display_filter": "frame.number == 23844", "timestamp_epoch": "1583962652.593652000" }, { "udp_stream": 349, "frame_number": 23849, "display_filter": "frame.number == 23849", "timestamp_epoch": "1583962652.620832000" }, { "tcp_stream": 267, "frame_number": 10216, "display_filter": "frame.number == 10216", "timestamp_epoch": "1583961911.827180000" }, { "tcp_stream": 496, "frame_number": 23959, "display_filter": "frame.number == 23959", "timestamp_epoch": "1583962652.682957000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:17.641963+00:00" }, { "observable_id": "observable-a9f3b5dee051b894dcb70668", "type": "domain", "value": "eu-u.openx.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:17.902233+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:17.898126+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 388, "frame_number": 26057, "display_filter": "frame.number == 26057", "timestamp_epoch": "1583962657.102978000" }, { "udp_stream": 388, "frame_number": 26094, "display_filter": "frame.number == 26094", "timestamp_epoch": "1583962657.134765000" }, { "udp_stream": 388, "frame_number": 26097, "display_filter": "frame.number == 26097", "timestamp_epoch": "1583962657.136998000" }, { "tcp_stream": 540, "frame_number": 26107, "display_filter": "frame.number == 26107", "timestamp_epoch": "1583962657.152339000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:17.892611+00:00" }, { "observable_id": "observable-11bfdbf09a08e9ab40200fd4", "type": "domain", "value": "f.monetate.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:18.098570+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:18.093724+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 345, "frame_number": 23645, "display_filter": "frame.number == 23645", "timestamp_epoch": "1583962652.091134000" }, { "udp_stream": 345, "frame_number": 23651, "display_filter": "frame.number == 23651", "timestamp_epoch": "1583962652.122192000" }, { "udp_stream": 345, "frame_number": 23659, "display_filter": "frame.number == 23659", "timestamp_epoch": "1583962652.155462000" }, { "tcp_stream": 501, "frame_number": 24150, "display_filter": "frame.number == 24150", "timestamp_epoch": "1583962652.979663000" }, { "tcp_stream": 507, "frame_number": 24610, "display_filter": "frame.number == 24610", "timestamp_epoch": "1583962654.547506000" }, { "tcp_stream": 506, "frame_number": 24612, "display_filter": "frame.number == 24612", "timestamp_epoch": "1583962654.547981000" }, { "tcp_stream": 505, "frame_number": 24614, "display_filter": "frame.number == 24614", "timestamp_epoch": "1583962654.548269000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:18.089070+00:00" }, { "observable_id": "observable-fdb5485f3b86bcc9a06dec97", "type": "domain", "value": "fareharbor.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:18.313468+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:18.308738+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 145, "frame_number": 4537, "display_filter": "frame.number == 4537", "timestamp_epoch": "1583961854.904733000" }, { "udp_stream": 145, "frame_number": 4543, "display_filter": "frame.number == 4543", "timestamp_epoch": "1583961854.926971000" }, { "udp_stream": 281, "frame_number": 16283, "display_filter": "frame.number == 16283", "timestamp_epoch": "1583962457.841813000" }, { "udp_stream": 281, "frame_number": 16284, "display_filter": "frame.number == 16284", "timestamp_epoch": "1583962457.871573000" }, { "udp_stream": 311, "frame_number": 21117, "display_filter": "frame.number == 21117", "timestamp_epoch": "1583962650.284771000" }, { "udp_stream": 311, "frame_number": 21126, "display_filter": "frame.number == 21126", "timestamp_epoch": "1583962650.316555000" }, { "udp_stream": 311, "frame_number": 21128, "display_filter": "frame.number == 21128", "timestamp_epoch": "1583962650.340100000" }, { "tcp_stream": 217, "frame_number": 4563, "display_filter": "frame.number == 4563", "timestamp_epoch": "1583961854.999425000" }, { "tcp_stream": 413, "frame_number": 16288, "display_filter": "frame.number == 16288", "timestamp_epoch": "1583962457.989600000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:18.303635+00:00" }, { "observable_id": "observable-36821d46676685b73ef96232", "type": "domain", "value": "fe2cr.update.microsoft.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:18.790645+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:18.787595+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 236, "frame_number": 15202, "display_filter": "frame.number == 15202", "timestamp_epoch": "1583962359.615054000" }, { "udp_stream": 236, "frame_number": 15203, "display_filter": "frame.number == 15203", "timestamp_epoch": "1583962359.646100000" }, { "udp_stream": 236, "frame_number": 15204, "display_filter": "frame.number == 15204", "timestamp_epoch": "1583962359.660989000" }, { "udp_stream": 245, "frame_number": 15600, "display_filter": "frame.number == 15600", "timestamp_epoch": "1583962385.972164000" }, { "udp_stream": 245, "frame_number": 15601, "display_filter": "frame.number == 15601", "timestamp_epoch": "1583962385.972448000" }, { "udp_stream": 256, "frame_number": 15922, "display_filter": "frame.number == 15922", "timestamp_epoch": "1583962416.974187000" }, { "udp_stream": 256, "frame_number": 15923, "display_filter": "frame.number == 15923", "timestamp_epoch": "1583962416.974560000" }, { "tcp_stream": 393, "frame_number": 15208, "display_filter": "frame.number == 15208", "timestamp_epoch": "1583962359.799458000" }, { "tcp_stream": 403, "frame_number": 15605, "display_filter": "frame.number == 15605", "timestamp_epoch": "1583962386.178664000" }, { "tcp_stream": 409, "frame_number": 15927, "display_filter": "frame.number == 15927", "timestamp_epoch": "1583962417.015109000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:18.783568+00:00" }, { "observable_id": "observable-e2b873d086441fb6d3dfeb98", "type": "domain", "value": "fe2cr.update.microsoft.com.akadns.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 236, "frame_number": 15204, "display_filter": "frame.number == 15204", "timestamp_epoch": "1583962359.660989000" }, { "udp_stream": 245, "frame_number": 15601, "display_filter": "frame.number == 15601", "timestamp_epoch": "1583962385.972448000" }, { "udp_stream": 256, "frame_number": 15923, "display_filter": "frame.number == 15923", "timestamp_epoch": "1583962416.974560000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f350c583e37d4c9be78d65d4", "type": "domain", "value": "fe3cr.delivery.mp.microsoft.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:18.983978+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:18.978586+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 237, "frame_number": 15313, "display_filter": "frame.number == 15313", "timestamp_epoch": "1583962360.827395000" }, { "udp_stream": 237, "frame_number": 15314, "display_filter": "frame.number == 15314", "timestamp_epoch": "1583962360.848294000" }, { "udp_stream": 237, "frame_number": 15315, "display_filter": "frame.number == 15315", "timestamp_epoch": "1583962360.863226000" }, { "udp_stream": 252, "frame_number": 15725, "display_filter": "frame.number == 15725", "timestamp_epoch": "1583962387.327521000" }, { "udp_stream": 252, "frame_number": 15726, "display_filter": "frame.number == 15726", "timestamp_epoch": "1583962387.327849000" }, { "udp_stream": 257, "frame_number": 16027, "display_filter": "frame.number == 16027", "timestamp_epoch": "1583962418.343766000" }, { "udp_stream": 257, "frame_number": 16028, "display_filter": "frame.number == 16028", "timestamp_epoch": "1583962418.344091000" }, { "tcp_stream": 394, "frame_number": 15319, "display_filter": "frame.number == 15319", "timestamp_epoch": "1583962361.123697000" }, { "tcp_stream": 406, "frame_number": 15769, "display_filter": "frame.number == 15769", "timestamp_epoch": "1583962387.595655000" }, { "tcp_stream": 410, "frame_number": 16032, "display_filter": "frame.number == 16032", "timestamp_epoch": "1583962418.609032000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:18.973227+00:00" }, { "observable_id": "observable-b93bff5eb8f2a9044b5d0371", "type": "domain", "value": "fh-kit.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:19.188327+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:19.184097+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 143, "frame_number": 4415, "display_filter": "frame.number == 4415", "timestamp_epoch": "1583961854.795171000" }, { "udp_stream": 143, "frame_number": 4438, "display_filter": "frame.number == 4438", "timestamp_epoch": "1583961854.840055000" }, { "udp_stream": 314, "frame_number": 21131, "display_filter": "frame.number == 21131", "timestamp_epoch": "1583962650.341897000" }, { "udp_stream": 314, "frame_number": 21137, "display_filter": "frame.number == 21137", "timestamp_epoch": "1583962650.372744000" }, { "udp_stream": 314, "frame_number": 21145, "display_filter": "frame.number == 21145", "timestamp_epoch": "1583962650.385341000" }, { "tcp_stream": 213, "frame_number": 4483, "display_filter": "frame.number == 4483", "timestamp_epoch": "1583961854.852181000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:19.179552+00:00" }, { "observable_id": "observable-746486615a0c4b39cc3c774f", "type": "domain", "value": "fh-sites.imgix.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:19.434677+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:19.430591+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 159, "frame_number": 6006, "display_filter": "frame.number == 6006", "timestamp_epoch": "1583961857.017781000" }, { "udp_stream": 159, "frame_number": 6020, "display_filter": "frame.number == 6020", "timestamp_epoch": "1583961857.068008000" }, { "tcp_stream": 234, "frame_number": 6072, "display_filter": "frame.number == 6072", "timestamp_epoch": "1583961857.210102000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:19.426379+00:00" }, { "observable_id": "observable-0b31f0b17fe65eae874a44b4", "type": "domain", "value": "files.markerly.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:19.645748+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:19.639820+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 208, "frame_number": 13332, "display_filter": "frame.number == 13332", "timestamp_epoch": "1583962027.442392000" }, { "udp_stream": 208, "frame_number": 13334, "display_filter": "frame.number == 13334", "timestamp_epoch": "1583962027.473726000" }, { "tcp_stream": 351, "frame_number": 13377, "display_filter": "frame.number == 13377", "timestamp_epoch": "1583962027.490893000" }, { "tcp_stream": 351, "frame_number": 13902, "display_filter": "frame.number == 13902", "timestamp_epoch": "1583962031.571744000" }, { "tcp_stream": 351, "frame_number": 13984, "display_filter": "frame.number == 13984", "timestamp_epoch": "1583962031.744315000" } ], "roles": [ "dns-query", "http-host" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:19.634972+00:00" }, { "observable_id": "observable-a4a3a1f54b8c3b40fc765aaa", "type": "domain", "value": "fonts.googleapis.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:19.818148+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:19.816332+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 138, "frame_number": 4385, "display_filter": "frame.number == 4385", "timestamp_epoch": "1583961854.731137000" }, { "udp_stream": 138, "frame_number": 4390, "display_filter": "frame.number == 4390", "timestamp_epoch": "1583961854.757736000" }, { "udp_stream": 315, "frame_number": 21132, "display_filter": "frame.number == 21132", "timestamp_epoch": "1583962650.343191000" }, { "udp_stream": 315, "frame_number": 21138, "display_filter": "frame.number == 21138", "timestamp_epoch": "1583962650.373590000" }, { "udp_stream": 315, "frame_number": 21139, "display_filter": "frame.number == 21139", "timestamp_epoch": "1583962650.374617000" }, { "tcp_stream": 205, "frame_number": 4433, "display_filter": "frame.number == 4433", "timestamp_epoch": "1583961854.835217000" }, { "tcp_stream": 206, "frame_number": 4439, "display_filter": "frame.number == 4439", "timestamp_epoch": "1583961854.840436000" }, { "tcp_stream": 202, "frame_number": 4402, "display_filter": "frame.number == 4402", "timestamp_epoch": "1583961854.778012000" } ], "roles": [ "dns-query", "http-host", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:19.814239+00:00" }, { "observable_id": "observable-3ce1aed19b8676ac4483f0bb", "type": "domain", "value": "fonts.gstatic.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:19.985832+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:19.983395+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 139, "frame_number": 4386, "display_filter": "frame.number == 4386", "timestamp_epoch": "1583961854.731803000" }, { "udp_stream": 139, "frame_number": 4391, "display_filter": "frame.number == 4391", "timestamp_epoch": "1583961854.757824000" }, { "udp_stream": 316, "frame_number": 21136, "display_filter": "frame.number == 21136", "timestamp_epoch": "1583962650.352180000" }, { "udp_stream": 316, "frame_number": 21141, "display_filter": "frame.number == 21141", "timestamp_epoch": "1583962650.382634000" }, { "udp_stream": 316, "frame_number": 21142, "display_filter": "frame.number == 21142", "timestamp_epoch": "1583962650.383619000" }, { "tcp_stream": 215, "frame_number": 4917, "display_filter": "frame.number == 4917", "timestamp_epoch": "1583961856.047515000" }, { "tcp_stream": 220, "frame_number": 4956, "display_filter": "frame.number == 4956", "timestamp_epoch": "1583961856.075659000" }, { "tcp_stream": 222, "frame_number": 4958, "display_filter": "frame.number == 4958", "timestamp_epoch": "1583961856.075895000" }, { "tcp_stream": 215, "frame_number": 5062, "display_filter": "frame.number == 5062", "timestamp_epoch": "1583961856.177877000" }, { "tcp_stream": 222, "frame_number": 5065, "display_filter": "frame.number == 5065", "timestamp_epoch": "1583961856.201369000" }, { "tcp_stream": 220, "frame_number": 5066, "display_filter": "frame.number == 5066", "timestamp_epoch": "1583961856.201519000" }, { "tcp_stream": 224, "frame_number": 5071, "display_filter": "frame.number == 5071", "timestamp_epoch": "1583961856.209888000" }, { "tcp_stream": 203, "frame_number": 4406, "display_filter": "frame.number == 4406", "timestamp_epoch": "1583961854.782581000" }, { "tcp_stream": 481, "frame_number": 21370, "display_filter": "frame.number == 21370", "timestamp_epoch": "1583962651.019579000" }, { "tcp_stream": 493, "frame_number": 23124, "display_filter": "frame.number == 23124", "timestamp_epoch": "1583962651.740172000" }, { "tcp_stream": 494, "frame_number": 23172, "display_filter": "frame.number == 23172", "timestamp_epoch": "1583962651.760798000" } ], "roles": [ "dns-query", "http-host", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:19.980322+00:00" }, { "observable_id": "observable-23a9781200a3890a101cffbd", "type": "domain", "value": "fp-afd.azureedge.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:20.257825+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:20.252528+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 64, "frame_number": 1862, "display_filter": "frame.number == 1862", "timestamp_epoch": "1583961789.198151000" }, { "udp_stream": 64, "frame_number": 1867, "display_filter": "frame.number == 1867", "timestamp_epoch": "1583961789.224967000" }, { "tcp_stream": 92, "frame_number": 1892, "display_filter": "frame.number == 1892", "timestamp_epoch": "1583961789.278144000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:20.247471+00:00" }, { "observable_id": "observable-0f688f7f7e8ff4eb423f405c", "type": "domain", "value": "fp-as.azureedge.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:20.567068+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:20.563050+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 61, "frame_number": 1819, "display_filter": "frame.number == 1819", "timestamp_epoch": "1583961789.054029000" }, { "udp_stream": 61, "frame_number": 1820, "display_filter": "frame.number == 1820", "timestamp_epoch": "1583961789.088257000" }, { "tcp_stream": 89, "frame_number": 1830, "display_filter": "frame.number == 1830", "timestamp_epoch": "1583961789.129686000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:20.556357+00:00" }, { "observable_id": "observable-72aea44564d9fc3480a43963", "type": "domain", "value": "fp-vp.azureedge.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:20.879395+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:20.874919+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 126, "frame_number": 4045, "display_filter": "frame.number == 4045", "timestamp_epoch": "1583961837.160541000" }, { "udp_stream": 126, "frame_number": 4063, "display_filter": "frame.number == 4063", "timestamp_epoch": "1583961837.210365000" }, { "tcp_stream": 192, "frame_number": 4084, "display_filter": "frame.number == 4084", "timestamp_epoch": "1583961837.246764000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:20.870059+00:00" }, { "observable_id": "observable-0e8573cd0b6b47b4aece50cf", "type": "domain", "value": "fp.msedge.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:21.666722+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:21.664841+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 198, "frame_number": 12451, "display_filter": "frame.number == 12451", "timestamp_epoch": "1583962012.911857000" }, { "udp_stream": 198, "frame_number": 12452, "display_filter": "frame.number == 12452", "timestamp_epoch": "1583962012.938150000" }, { "tcp_stream": 322, "frame_number": 12456, "display_filter": "frame.number == 12456", "timestamp_epoch": "1583962013.030078000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:21.662122+00:00" }, { "observable_id": "observable-92abde5cd08edeadc2f99562", "type": "domain", "value": "geo.prod.do.dsp.mp.microsoft.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:21.871597+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:21.867167+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 15, "frame_number": 525, "display_filter": "frame.number == 525", "timestamp_epoch": "1583961757.819997000" }, { "udp_stream": 15, "frame_number": 526, "display_filter": "frame.number == 526", "timestamp_epoch": "1583961757.840619000" }, { "udp_stream": 102, "frame_number": 3006, "display_filter": "frame.number == 3006", "timestamp_epoch": "1583961815.246867000" }, { "udp_stream": 102, "frame_number": 3007, "display_filter": "frame.number == 3007", "timestamp_epoch": "1583961815.247099000" }, { "tcp_stream": 27, "frame_number": 530, "display_filter": "frame.number == 530", "timestamp_epoch": "1583961757.985150000" }, { "tcp_stream": 142, "frame_number": 3011, "display_filter": "frame.number == 3011", "timestamp_epoch": "1583961815.375939000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:21.862611+00:00" }, { "observable_id": "observable-522ef96dc30c20264516468e", "type": "domain", "value": "go.microsoft.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:22.062012+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:22.060222+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 201, "frame_number": 12479, "display_filter": "frame.number == 12479", "timestamp_epoch": "1583962013.966655000" }, { "udp_stream": 201, "frame_number": 12480, "display_filter": "frame.number == 12480", "timestamp_epoch": "1583962014.002923000" }, { "tcp_stream": 323, "frame_number": 12487, "display_filter": "frame.number == 12487", "timestamp_epoch": "1583962014.158514000" }, { "tcp_stream": 324, "frame_number": 12489, "display_filter": "frame.number == 12489", "timestamp_epoch": "1583962014.158741000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:22.057812+00:00" }, { "observable_id": "observable-5dc3e8eb2540b970c0b4760e", "type": "domain", "value": "googleads.g.doubleclick.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 372, "frame_number": 25263, "display_filter": "frame.number == 25263", "timestamp_epoch": "1583962655.532578000" }, { "udp_stream": 372, "frame_number": 25278, "display_filter": "frame.number == 25278", "timestamp_epoch": "1583962655.564369000" }, { "udp_stream": 372, "frame_number": 25283, "display_filter": "frame.number == 25283", "timestamp_epoch": "1583962655.597916000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-cce8ddf852f7735cde2f67b7", "type": "domain", "value": "gstaticadssl.l.google.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 139, "frame_number": 4391, "display_filter": "frame.number == 4391", "timestamp_epoch": "1583961854.757824000" }, { "udp_stream": 316, "frame_number": 21142, "display_filter": "frame.number == 21142", "timestamp_epoch": "1583962650.383619000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f7617f8cef59730032c2c46c", "type": "domain", "value": "hakunamatatata.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:22.303632+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:22.301085+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 412, "frame_number": 27773, "display_filter": "frame.number == 27773", "timestamp_epoch": "1583963020.371821000" }, { "udp_stream": 412, "frame_number": 27774, "display_filter": "frame.number == 27774", "timestamp_epoch": "1583963020.402252000" }, { "udp_stream": 412, "frame_number": 27775, "display_filter": "frame.number == 27775", "timestamp_epoch": "1583963020.430853000" }, { "tcp_stream": 589, "frame_number": 27780, "display_filter": "frame.number == 27780", "timestamp_epoch": "1583963020.547148000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:22.296130+00:00" }, { "observable_id": "observable-1fd8e066886a6c8af4164897", "type": "domain", "value": "help.newegg.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:22.510826+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:22.505357+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 337, "frame_number": 21366, "display_filter": "frame.number == 21366", "timestamp_epoch": "1583962651.002847000" }, { "udp_stream": 337, "frame_number": 21374, "display_filter": "frame.number == 21374", "timestamp_epoch": "1583962651.035144000" }, { "udp_stream": 337, "frame_number": 21385, "display_filter": "frame.number == 21385", "timestamp_epoch": "1583962651.092134000" }, { "tcp_stream": 485, "frame_number": 21487, "display_filter": "frame.number == 21487", "timestamp_epoch": "1583962651.135893000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:22.500770+00:00" }, { "observable_id": "observable-7c3a374c518e1e8f1ce8988c", "type": "domain", "value": "helpforyourservice.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 413, "frame_number": 28319, "display_filter": "frame.number == 28319", "timestamp_epoch": "1583963031.180089000" }, { "udp_stream": 413, "frame_number": 28320, "display_filter": "frame.number == 28320", "timestamp_epoch": "1583963031.199448000" }, { "udp_stream": 413, "frame_number": 28321, "display_filter": "frame.number == 28321", "timestamp_epoch": "1583963031.223332000" }, { "tcp_stream": 592, "frame_number": 28325, "display_filter": "frame.number == 28325", "timestamp_epoch": "1583963031.337903000" }, { "tcp_stream": 593, "frame_number": 28568, "display_filter": "frame.number == 28568", "timestamp_epoch": "1583963032.456885000" }, { "tcp_stream": 595, "frame_number": 28593, "display_filter": "frame.number == 28593", "timestamp_epoch": "1583963038.380480000" }, { "tcp_stream": 598, "frame_number": 28731, "display_filter": "frame.number == 28731", "timestamp_epoch": "1583963044.340672000" }, { "tcp_stream": 599, "frame_number": 28754, "display_filter": "frame.number == 28754", "timestamp_epoch": "1583963050.026088000" }, { "tcp_stream": 603, "frame_number": 28800, "display_filter": "frame.number == 28800", "timestamp_epoch": "1583963055.686781000" }, { "tcp_stream": 605, "frame_number": 28824, "display_filter": "frame.number == 28824", "timestamp_epoch": "1583963061.330535000" }, { "tcp_stream": 607, "frame_number": 28851, "display_filter": "frame.number == 28851", "timestamp_epoch": "1583963066.986810000" }, { "tcp_stream": 608, "frame_number": 28874, "display_filter": "frame.number == 28874", "timestamp_epoch": "1583963072.718134000" }, { "tcp_stream": 610, "frame_number": 29109, "display_filter": "frame.number == 29109", "timestamp_epoch": "1583963076.561312000" }, { "tcp_stream": 612, "frame_number": 29140, "display_filter": "frame.number == 29140", "timestamp_epoch": "1583963082.191127000" }, { "tcp_stream": 613, "frame_number": 29157, "display_filter": "frame.number == 29157", "timestamp_epoch": "1583963082.833470000" }, { "tcp_stream": 615, "frame_number": 29188, "display_filter": "frame.number == 29188", "timestamp_epoch": "1583963088.543433000" }, { "tcp_stream": 619, "frame_number": 29237, "display_filter": "frame.number == 29237", "timestamp_epoch": "1583963094.199022000" }, { "tcp_stream": 620, "frame_number": 29254, "display_filter": "frame.number == 29254", "timestamp_epoch": "1583963099.794939000" }, { "tcp_stream": 623, "frame_number": 29297, "display_filter": "frame.number == 29297", "timestamp_epoch": "1583963105.686170000" }, { "tcp_stream": 625, "frame_number": 29330, "display_filter": "frame.number == 29330", "timestamp_epoch": "1583963111.295175000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-fadb7cd5af8afbb4e006250c", "type": "domain", "value": "idsync.rlcdn.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 383, "frame_number": 25904, "display_filter": "frame.number == 25904", "timestamp_epoch": "1583962656.769038000" }, { "udp_stream": 383, "frame_number": 25912, "display_filter": "frame.number == 25912", "timestamp_epoch": "1583962656.790277000" }, { "tcp_stream": 531, "frame_number": 25920, "display_filter": "frame.number == 25920", "timestamp_epoch": "1583962656.815217000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1da897a56e11180802e489f3", "type": "domain", "value": "ie11welcome.microsoft.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 202, "frame_number": 12512, "display_filter": "frame.number == 12512", "timestamp_epoch": "1583962014.281442000" }, { "udp_stream": 202, "frame_number": 12513, "display_filter": "frame.number == 12513", "timestamp_epoch": "1583962014.306944000" }, { "tcp_stream": 326, "frame_number": 12520, "display_filter": "frame.number == 12520", "timestamp_epoch": "1583962014.639751000" }, { "tcp_stream": 325, "frame_number": 12521, "display_filter": "frame.number == 12521", "timestamp_epoch": "1583962014.639796000" }, { "tcp_stream": 327, "frame_number": 12582, "display_filter": "frame.number == 12582", "timestamp_epoch": "1583962015.029351000" }, { "tcp_stream": 329, "frame_number": 12708, "display_filter": "frame.number == 12708", "timestamp_epoch": "1583962015.557342000" }, { "tcp_stream": 330, "frame_number": 12717, "display_filter": "frame.number == 12717", "timestamp_epoch": "1583962015.557795000" }, { "tcp_stream": 331, "frame_number": 12721, "display_filter": "frame.number == 12721", "timestamp_epoch": "1583962015.558204000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-64d001a8850bdc20ade414e4", "type": "domain", "value": "image2.pubmatic.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 397, "frame_number": 26221, "display_filter": "frame.number == 26221", "timestamp_epoch": "1583962657.352782000" }, { "udp_stream": 397, "frame_number": 26254, "display_filter": "frame.number == 26254", "timestamp_epoch": "1583962657.367426000" }, { "tcp_stream": 547, "frame_number": 26337, "display_filter": "frame.number == 26337", "timestamp_epoch": "1583962657.544729000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-428a354cf08f0afe2889c67e", "type": "domain", "value": "images10.newegg.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 331, "frame_number": 21294, "display_filter": "frame.number == 21294", "timestamp_epoch": "1583962650.958089000" }, { "udp_stream": 331, "frame_number": 21321, "display_filter": "frame.number == 21321", "timestamp_epoch": "1583962650.988589000" }, { "udp_stream": 331, "frame_number": 21376, "display_filter": "frame.number == 21376", "timestamp_epoch": "1583962651.053207000" }, { "tcp_stream": 483, "frame_number": 21489, "display_filter": "frame.number == 21489", "timestamp_epoch": "1583962651.136224000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3a5236bc7b03332a970ff733", "type": "domain", "value": "img.secureserver.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 168, "frame_number": 7612, "display_filter": "frame.number == 7612", "timestamp_epoch": "1583961859.201037000" }, { "udp_stream": 168, "frame_number": 7613, "display_filter": "frame.number == 7613", "timestamp_epoch": "1583961859.233927000" }, { "tcp_stream": 247, "frame_number": 7633, "display_filter": "frame.number == 7633", "timestamp_epoch": "1583961859.275730000" }, { "tcp_stream": 248, "frame_number": 7657, "display_filter": "frame.number == 7657", "timestamp_epoch": "1583961859.434570000" } ], "roles": [ "dns-query", "http-host", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2d56ef3bc0ec648cce947c26", "type": "domain", "value": "img1.wsimg.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:06.760880+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:06.591475+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:06.589381+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 140, "frame_number": 4387, "display_filter": "frame.number == 4387", "timestamp_epoch": "1583961854.732156000" }, { "udp_stream": 140, "frame_number": 4396, "display_filter": "frame.number == 4396", "timestamp_epoch": "1583961854.766530000" }, { "udp_stream": 317, "frame_number": 21140, "display_filter": "frame.number == 21140", "timestamp_epoch": "1583962650.376392000" }, { "udp_stream": 317, "frame_number": 21156, "display_filter": "frame.number == 21156", "timestamp_epoch": "1583962650.407657000" }, { "udp_stream": 317, "frame_number": 21160, "display_filter": "frame.number == 21160", "timestamp_epoch": "1583962650.459266000" }, { "tcp_stream": 207, "frame_number": 4475, "display_filter": "frame.number == 4475", "timestamp_epoch": "1583961854.850635000" }, { "tcp_stream": 207, "frame_number": 4638, "display_filter": "frame.number == 4638", "timestamp_epoch": "1583961855.179664000" }, { "tcp_stream": 207, "frame_number": 5450, "display_filter": "frame.number == 5450", "timestamp_epoch": "1583961856.581467000" }, { "tcp_stream": 204, "frame_number": 4410, "display_filter": "frame.number == 4410", "timestamp_epoch": "1583961854.790146000" }, { "tcp_stream": 219, "frame_number": 4731, "display_filter": "frame.number == 4731", "timestamp_epoch": "1583961855.227464000" } ], "roles": [ "dns-query", "http-host", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:06.586559+00:00" }, { "observable_id": "observable-637e04571d4102417d69d826", "type": "domain", "value": "img2.wsimg.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:06.958135+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:06.769360+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:06.765214+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 144, "frame_number": 4419, "display_filter": "frame.number == 4419", "timestamp_epoch": "1583961854.800699000" }, { "udp_stream": 144, "frame_number": 4446, "display_filter": "frame.number == 4446", "timestamp_epoch": "1583961854.845638000" }, { "udp_stream": 318, "frame_number": 21148, "display_filter": "frame.number == 21148", "timestamp_epoch": "1583962650.385872000" }, { "udp_stream": 318, "frame_number": 21157, "display_filter": "frame.number == 21157", "timestamp_epoch": "1583962650.416650000" }, { "udp_stream": 318, "frame_number": 21159, "display_filter": "frame.number == 21159", "timestamp_epoch": "1583962650.459214000" }, { "tcp_stream": 232, "frame_number": 5856, "display_filter": "frame.number == 5856", "timestamp_epoch": "1583961856.754926000" }, { "tcp_stream": 214, "frame_number": 4494, "display_filter": "frame.number == 4494", "timestamp_epoch": "1583961854.862048000" } ], "roles": [ "dns-query", "http-host", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:06.760952+00:00" }, { "observable_id": "observable-513895eac4dd944e6f14f739", "type": "domain", "value": "img4.wsimg.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:07.148210+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:06.964516+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:06.962640+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 142, "frame_number": 4395, "display_filter": "frame.number == 4395", "timestamp_epoch": "1583961854.764850000" }, { "udp_stream": 142, "frame_number": 4416, "display_filter": "frame.number == 4416", "timestamp_epoch": "1583961854.797966000" }, { "udp_stream": 319, "frame_number": 21149, "display_filter": "frame.number == 21149", "timestamp_epoch": "1583962650.387061000" }, { "udp_stream": 319, "frame_number": 21158, "display_filter": "frame.number == 21158", "timestamp_epoch": "1583962650.417627000" }, { "udp_stream": 319, "frame_number": 21161, "display_filter": "frame.number == 21161", "timestamp_epoch": "1583962650.459342000" }, { "tcp_stream": 231, "frame_number": 5551, "display_filter": "frame.number == 5551", "timestamp_epoch": "1583961856.605293000" }, { "tcp_stream": 209, "frame_number": 4473, "display_filter": "frame.number == 4473", "timestamp_epoch": "1583961854.850374000" } ], "roles": [ "dns-query", "http-host", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:06.958200+00:00" }, { "observable_id": "observable-86ad4a8bf68a516b326cb7f9", "type": "domain", "value": "imk.neweggimages.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 334, "frame_number": 21306, "display_filter": "frame.number == 21306", "timestamp_epoch": "1583962650.967564000" }, { "udp_stream": 334, "frame_number": 21363, "display_filter": "frame.number == 21363", "timestamp_epoch": "1583962650.999518000" }, { "udp_stream": 334, "frame_number": 21479, "display_filter": "frame.number == 21479", "timestamp_epoch": "1583962651.129702000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d748acea2fb2b861d4a63bb1", "type": "domain", "value": "insight-760077375.us-east-1.elb.amazonaws.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 386, "frame_number": 26010, "display_filter": "frame.number == 26010", "timestamp_epoch": "1583962656.960973000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e8cbececcbc858f451f54f28", "type": "domain", "value": "insight.adsrvr.org", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 386, "frame_number": 25998, "display_filter": "frame.number == 25998", "timestamp_epoch": "1583962656.931409000" }, { "udp_stream": 386, "frame_number": 26010, "display_filter": "frame.number == 26010", "timestamp_epoch": "1583962656.960973000" }, { "tcp_stream": 535, "frame_number": 26041, "display_filter": "frame.number == 26041", "timestamp_epoch": "1583962657.062255000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-066115c1d1d7c67f02d74f92", "type": "domain", "value": "itm-efz.office.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 66, "frame_number": 1898, "display_filter": "frame.number == 1898", "timestamp_epoch": "1583961789.286717000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-756ca6657cc65b69cca4fa9e", "type": "domain", "value": "k-ring.msedge.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 63, "frame_number": 1850, "display_filter": "frame.number == 1850", "timestamp_epoch": "1583961789.179554000" }, { "udp_stream": 63, "frame_number": 1860, "display_filter": "frame.number == 1860", "timestamp_epoch": "1583961789.191783000" }, { "udp_stream": 125, "frame_number": 4044, "display_filter": "frame.number == 4044", "timestamp_epoch": "1583961837.153044000" }, { "udp_stream": 125, "frame_number": 4047, "display_filter": "frame.number == 4047", "timestamp_epoch": "1583961837.170614000" }, { "tcp_stream": 91, "frame_number": 1865, "display_filter": "frame.number == 1865", "timestamp_epoch": "1583961789.206292000" }, { "tcp_stream": 190, "frame_number": 4061, "display_filter": "frame.number == 4061", "timestamp_epoch": "1583961837.193573000" }, { "tcp_stream": 334, "frame_number": 12835, "display_filter": "frame.number == 12835", "timestamp_epoch": "1583962015.720421000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-74fc8c4db993f08ad4ec7591", "type": "domain", "value": "kcvsmarszhnhqdd.mondogreek.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 96, "frame_number": 2684, "display_filter": "frame.number == 2684", "timestamp_epoch": "1583961813.264054000" }, { "udp_stream": 96, "frame_number": 2685, "display_filter": "frame.number == 2685", "timestamp_epoch": "1583961813.264308000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3441bf67bbbf6a405d3a8261", "type": "domain", "value": "kv801.prod.do.dsp.mp.microsoft.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 21, "frame_number": 592, "display_filter": "frame.number == 592", "timestamp_epoch": "1583961758.579463000" }, { "udp_stream": 21, "frame_number": 604, "display_filter": "frame.number == 604", "timestamp_epoch": "1583961758.615654000" }, { "udp_stream": 108, "frame_number": 3115, "display_filter": "frame.number == 3115", "timestamp_epoch": "1583961816.001111000" }, { "udp_stream": 108, "frame_number": 3116, "display_filter": "frame.number == 3116", "timestamp_epoch": "1583961816.043339000" }, { "tcp_stream": 31, "frame_number": 636, "display_filter": "frame.number == 636", "timestamp_epoch": "1583961758.676091000" }, { "tcp_stream": 147, "frame_number": 3145, "display_filter": "frame.number == 3145", "timestamp_epoch": "1583961817.068136000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-439d7a6fa04d5944ca678cd1", "type": "domain", "value": "l-0005.dc-msedge.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 78, "frame_number": 2340, "display_filter": "frame.number == 2340", "timestamp_epoch": "1583961806.507845000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f70c35b771911bd9805c3cc0", "type": "domain", "value": "l-ring.msedge.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 74, "frame_number": 2287, "display_filter": "frame.number == 2287", "timestamp_epoch": "1583961806.215464000" }, { "udp_stream": 74, "frame_number": 2295, "display_filter": "frame.number == 2295", "timestamp_epoch": "1583961806.240830000" }, { "tcp_stream": 112, "frame_number": 2309, "display_filter": "frame.number == 2309", "timestamp_epoch": "1583961806.316069000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1f6a8dc39a4b04c3a70ad4a6", "type": "domain", "value": "laptop-7xmv2sn.mondogreek.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 56, "frame_number": 1788, "display_filter": "frame.number == 1788", "timestamp_epoch": "1583961783.982644000" }, { "udp_stream": 56, "frame_number": 1789, "display_filter": "frame.number == 1789", "timestamp_epoch": "1583961783.982972000" }, { "udp_stream": 287, "frame_number": 16352, "display_filter": "frame.number == 16352", "timestamp_epoch": "1583962544.993385000" }, { "udp_stream": 287, "frame_number": 16353, "display_filter": "frame.number == 16353", "timestamp_epoch": "1583962544.993657000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2a974af09e0f6110be713817", "type": "domain", "value": "laptop-i9zpi04.mondogreek.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 16, "frame_number": 545, "display_filter": "frame.number == 545", "timestamp_epoch": "1583961758.337798000" }, { "udp_stream": 16, "frame_number": 546, "display_filter": "frame.number == 546", "timestamp_epoch": "1583961758.338153000" }, { "udp_stream": 249, "frame_number": 15659, "display_filter": "frame.number == 15659", "timestamp_epoch": "1583962386.740038000" }, { "udp_stream": 249, "frame_number": 15660, "display_filter": "frame.number == 15660", "timestamp_epoch": "1583962386.740438000" }, { "udp_stream": 306, "frame_number": 21063, "display_filter": "frame.number == 21063", "timestamp_epoch": "1583962637.217205000" }, { "udp_stream": 306, "frame_number": 21064, "display_filter": "frame.number == 21064", "timestamp_epoch": "1583962637.217396000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-94f3dcbc41a142d880e28815", "type": "domain", "value": "laptop-sqsa42o.mondogreek.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 103, "frame_number": 3013, "display_filter": "frame.number == 3013", "timestamp_epoch": "1583961815.419746000" }, { "udp_stream": 103, "frame_number": 3014, "display_filter": "frame.number == 3014", "timestamp_epoch": "1583961815.419961000" }, { "udp_stream": 258, "frame_number": 16083, "display_filter": "frame.number == 16083", "timestamp_epoch": "1583962433.370420000" }, { "udp_stream": 258, "frame_number": 16084, "display_filter": "frame.number == 16084", "timestamp_epoch": "1583962433.370632000" }, { "udp_stream": 307, "frame_number": 21070, "display_filter": "frame.number == 21070", "timestamp_epoch": "1583962637.221006000" }, { "udp_stream": 307, "frame_number": 21071, "display_filter": "frame.number == 21071", "timestamp_epoch": "1583962637.221413000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1d2d1631961603a5a97009c9", "type": "domain", "value": "licensing.mp.microsoft.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 194, "frame_number": 10537, "display_filter": "frame.number == 10537", "timestamp_epoch": "1583961956.185076000" }, { "udp_stream": 194, "frame_number": 10540, "display_filter": "frame.number == 10540", "timestamp_epoch": "1583961956.376456000" }, { "udp_stream": 241, "frame_number": 15485, "display_filter": "frame.number == 15485", "timestamp_epoch": "1583962381.913145000" }, { "udp_stream": 241, "frame_number": 15486, "display_filter": "frame.number == 15486", "timestamp_epoch": "1583962381.942405000" }, { "udp_stream": 241, "frame_number": 15489, "display_filter": "frame.number == 15489", "timestamp_epoch": "1583962381.966088000" }, { "udp_stream": 291, "frame_number": 16384, "display_filter": "frame.number == 16384", "timestamp_epoch": "1583962545.300032000" }, { "udp_stream": 291, "frame_number": 16385, "display_filter": "frame.number == 16385", "timestamp_epoch": "1583962545.300426000" }, { "udp_stream": 409, "frame_number": 27434, "display_filter": "frame.number == 27434", "timestamp_epoch": "1583962857.458795000" }, { "udp_stream": 409, "frame_number": 27435, "display_filter": "frame.number == 27435", "timestamp_epoch": "1583962857.474997000" }, { "udp_stream": 409, "frame_number": 27436, "display_filter": "frame.number == 27436", "timestamp_epoch": "1583962857.635043000" }, { "tcp_stream": 274, "frame_number": 10544, "display_filter": "frame.number == 10544", "timestamp_epoch": "1583961956.451347000" }, { "tcp_stream": 275, "frame_number": 10579, "display_filter": "frame.number == 10579", "timestamp_epoch": "1583961956.967598000" }, { "tcp_stream": 276, "frame_number": 10619, "display_filter": "frame.number == 10619", "timestamp_epoch": "1583961957.509495000" }, { "tcp_stream": 277, "frame_number": 10654, "display_filter": "frame.number == 10654", "timestamp_epoch": "1583961957.908155000" }, { "tcp_stream": 278, "frame_number": 10693, "display_filter": "frame.number == 10693", "timestamp_epoch": "1583961958.473427000" }, { "tcp_stream": 279, "frame_number": 10731, "display_filter": "frame.number == 10731", "timestamp_epoch": "1583961958.952336000" }, { "tcp_stream": 280, "frame_number": 10770, "display_filter": "frame.number == 10770", "timestamp_epoch": "1583961959.444313000" }, { "tcp_stream": 281, "frame_number": 10806, "display_filter": "frame.number == 10806", "timestamp_epoch": "1583961959.828090000" }, { "tcp_stream": 282, "frame_number": 10847, "display_filter": "frame.number == 10847", "timestamp_epoch": "1583961960.315824000" }, { "tcp_stream": 283, "frame_number": 10885, "display_filter": "frame.number == 10885", "timestamp_epoch": "1583961960.723260000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1c5253cd0939bf45e3179509", "type": "domain", "value": "load77.exelator.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 387, "frame_number": 26056, "display_filter": "frame.number == 26056", "timestamp_epoch": "1583962657.099368000" }, { "udp_stream": 387, "frame_number": 26088, "display_filter": "frame.number == 26088", "timestamp_epoch": "1583962657.129850000" }, { "udp_stream": 387, "frame_number": 26089, "display_filter": "frame.number == 26089", "timestamp_epoch": "1583962657.131237000" }, { "tcp_stream": 538, "frame_number": 26116, "display_filter": "frame.number == 26116", "timestamp_epoch": "1583962657.165018000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-fdb92dc105b9ad577f7627f7", "type": "domain", "value": "loadus.exelator.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 382, "frame_number": 25903, "display_filter": "frame.number == 25903", "timestamp_epoch": "1583962656.768455000" }, { "udp_stream": 382, "frame_number": 25915, "display_filter": "frame.number == 25915", "timestamp_epoch": "1583962656.799530000" }, { "udp_stream": 382, "frame_number": 25928, "display_filter": "frame.number == 25928", "timestamp_epoch": "1583962656.834296000" }, { "tcp_stream": 532, "frame_number": 25965, "display_filter": "frame.number == 25965", "timestamp_epoch": "1583962656.856532000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-30d42b2dc532dc4ae74cc6dd", "type": "domain", "value": "login.live.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 178, "frame_number": 8549, "display_filter": "frame.number == 8549", "timestamp_epoch": "1583961873.948506000" }, { "udp_stream": 178, "frame_number": 8550, "display_filter": "frame.number == 8550", "timestamp_epoch": "1583961873.974309000" }, { "udp_stream": 192, "frame_number": 10481, "display_filter": "frame.number == 10481", "timestamp_epoch": "1583961955.590380000" }, { "udp_stream": 192, "frame_number": 10482, "display_filter": "frame.number == 10482", "timestamp_epoch": "1583961955.604959000" }, { "udp_stream": 240, "frame_number": 15439, "display_filter": "frame.number == 15439", "timestamp_epoch": "1583962381.344210000" }, { "udp_stream": 240, "frame_number": 15440, "display_filter": "frame.number == 15440", "timestamp_epoch": "1583962381.364416000" }, { "udp_stream": 240, "frame_number": 15441, "display_filter": "frame.number == 15441", "timestamp_epoch": "1583962381.378143000" }, { "udp_stream": 404, "frame_number": 26722, "display_filter": "frame.number == 26722", "timestamp_epoch": "1583962683.947152000" }, { "udp_stream": 404, "frame_number": 26723, "display_filter": "frame.number == 26723", "timestamp_epoch": "1583962683.965713000" }, { "tcp_stream": 258, "frame_number": 8559, "display_filter": "frame.number == 8559", "timestamp_epoch": "1583961874.042185000" }, { "tcp_stream": 272, "frame_number": 10486, "display_filter": "frame.number == 10486", "timestamp_epoch": "1583961955.673504000" }, { "tcp_stream": 319, "frame_number": 12309, "display_filter": "frame.number == 12309", "timestamp_epoch": "1583961994.005859000" }, { "tcp_stream": 397, "frame_number": 15445, "display_filter": "frame.number == 15445", "timestamp_epoch": "1583962381.450797000" }, { "tcp_stream": 557, "frame_number": 26727, "display_filter": "frame.number == 26727", "timestamp_epoch": "1583962684.021932000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1403cf37063322fc91404bc4", "type": "domain", "value": "login.microsoftonline.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 174, "frame_number": 8135, "display_filter": "frame.number == 8135", "timestamp_epoch": "1583961870.452904000" }, { "udp_stream": 174, "frame_number": 8136, "display_filter": "frame.number == 8136", "timestamp_epoch": "1583961870.477543000" }, { "tcp_stream": 255, "frame_number": 8142, "display_filter": "frame.number == 8142", "timestamp_epoch": "1583961870.514628000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3bdcc9dd920cb5b656b8f9e5", "type": "domain", "value": "m.addthis.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 138, "frame_number": 4927, "display_filter": "frame.number == 4927", "timestamp_epoch": "1583961856.054302000" }, { "udp_stream": 138, "frame_number": 5213, "display_filter": "frame.number == 5213", "timestamp_epoch": "1583961856.360527000" }, { "udp_stream": 309, "frame_number": 21115, "display_filter": "frame.number == 21115", "timestamp_epoch": "1583962650.283918000" }, { "udp_stream": 309, "frame_number": 21124, "display_filter": "frame.number == 21124", "timestamp_epoch": "1583962650.314681000" }, { "udp_stream": 309, "frame_number": 21127, "display_filter": "frame.number == 21127", "timestamp_epoch": "1583962650.340042000" }, { "tcp_stream": 466, "frame_number": 21146, "display_filter": "frame.number == 21146", "timestamp_epoch": "1583962650.385589000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a1fd8da0b3a820effab4f100", "type": "domain", "value": "mapping.nxtck.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 396, "frame_number": 26212, "display_filter": "frame.number == 26212", "timestamp_epoch": "1583962657.289583000" }, { "udp_stream": 396, "frame_number": 26215, "display_filter": "frame.number == 26215", "timestamp_epoch": "1583962657.320871000" }, { "udp_stream": 396, "frame_number": 26217, "display_filter": "frame.number == 26217", "timestamp_epoch": "1583962657.348534000" }, { "tcp_stream": 545, "frame_number": 26258, "display_filter": "frame.number == 26258", "timestamp_epoch": "1583962657.368952000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d733975cb9aec00ebbf3a952", "type": "domain", "value": "match-975362022.us-east-1.elb.amazonaws.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 385, "frame_number": 26007, "display_filter": "frame.number == 26007", "timestamp_epoch": "1583962656.958475000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-fbf4b5fc9f947d16d46d33aa", "type": "domain", "value": "match.360yield.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 395, "frame_number": 26092, "display_filter": "frame.number == 26092", "timestamp_epoch": "1583962657.132574000" }, { "udp_stream": 395, "frame_number": 26111, "display_filter": "frame.number == 26111", "timestamp_epoch": "1583962657.163780000" }, { "udp_stream": 395, "frame_number": 26128, "display_filter": "frame.number == 26128", "timestamp_epoch": "1583962657.176778000" }, { "tcp_stream": 542, "frame_number": 26189, "display_filter": "frame.number == 26189", "timestamp_epoch": "1583962657.268730000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-bbf823ff0ef3331f09a33f2a", "type": "domain", "value": "match.adsrvr.org", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 385, "frame_number": 25995, "display_filter": "frame.number == 25995", "timestamp_epoch": "1583962656.929467000" }, { "udp_stream": 385, "frame_number": 26007, "display_filter": "frame.number == 26007", "timestamp_epoch": "1583962656.958475000" }, { "tcp_stream": 534, "frame_number": 26043, "display_filter": "frame.number == 26043", "timestamp_epoch": "1583962657.062865000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1ba4ad4210590e9fa538109e", "type": "domain", "value": "match.prod.bidr.io", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 401, "frame_number": 26527, "display_filter": "frame.number == 26527", "timestamp_epoch": "1583962661.413763000" }, { "udp_stream": 401, "frame_number": 26534, "display_filter": "frame.number == 26534", "timestamp_epoch": "1583962661.444881000" }, { "udp_stream": 401, "frame_number": 26535, "display_filter": "frame.number == 26535", "timestamp_epoch": "1583962661.464277000" }, { "tcp_stream": 551, "frame_number": 26549, "display_filter": "frame.number == 26549", "timestamp_epoch": "1583962661.521962000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-fc33c33ba5b476a39d68358d", "type": "domain", "value": "mondogreek-dc.mondogreek.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 13, "frame_number": 319, "display_filter": "frame.number == 319", "timestamp_epoch": "1583961756.219780000" }, { "udp_stream": 13, "frame_number": 320, "display_filter": "frame.number == 320", "timestamp_epoch": "1583961756.220052000" }, { "udp_stream": 34, "frame_number": 1068, "display_filter": "frame.number == 1068", "timestamp_epoch": "1583961779.658177000" }, { "udp_stream": 34, "frame_number": 1069, "display_filter": "frame.number == 1069", "timestamp_epoch": "1583961779.658607000" }, { "udp_stream": 54, "frame_number": 1378, "display_filter": "frame.number == 1378", "timestamp_epoch": "1583961781.878568000" }, { "udp_stream": 54, "frame_number": 1379, "display_filter": "frame.number == 1379", "timestamp_epoch": "1583961781.878882000" }, { "udp_stream": 82, "frame_number": 2486, "display_filter": "frame.number == 2486", "timestamp_epoch": "1583961810.918613000" }, { "udp_stream": 82, "frame_number": 2487, "display_filter": "frame.number == 2487", "timestamp_epoch": "1583961810.919308000" }, { "udp_stream": 101, "frame_number": 2808, "display_filter": "frame.number == 2808", "timestamp_epoch": "1583961813.765796000" }, { "udp_stream": 101, "frame_number": 2809, "display_filter": "frame.number == 2809", "timestamp_epoch": "1583961813.766099000" }, { "udp_stream": 251, "frame_number": 15667, "display_filter": "frame.number == 15667", "timestamp_epoch": "1583962386.797821000" }, { "udp_stream": 251, "frame_number": 15668, "display_filter": "frame.number == 15668", "timestamp_epoch": "1583962386.798154000" }, { "udp_stream": 261, "frame_number": 16092, "display_filter": "frame.number == 16092", "timestamp_epoch": "1583962433.463950000" }, { "udp_stream": 261, "frame_number": 16093, "display_filter": "frame.number == 16093", "timestamp_epoch": "1583962433.464217000" }, { "udp_stream": 289, "frame_number": 16357, "display_filter": "frame.number == 16357", "timestamp_epoch": "1583962545.037411000" }, { "udp_stream": 289, "frame_number": 16358, "display_filter": "frame.number == 16358", "timestamp_epoch": "1583962545.037705000" }, { "udp_stream": 305, "frame_number": 21056, "display_filter": "frame.number == 21056", "timestamp_epoch": "1583962637.214633000" }, { "udp_stream": 305, "frame_number": 21057, "display_filter": "frame.number == 21057", "timestamp_epoch": "1583962637.214931000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-4c1bb410881eeb8df3d499a3", "type": "domain", "value": "mondogreek.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:08.583150+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:08.578770+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 17, "frame_number": 547, "display_filter": "frame.number == 547", "timestamp_epoch": "1583961758.340596000" }, { "udp_stream": 17, "frame_number": 548, "display_filter": "frame.number == 548", "timestamp_epoch": "1583961758.341657000" }, { "udp_stream": 55, "frame_number": 1620, "display_filter": "frame.number == 1620", "timestamp_epoch": "1583961783.463628000" }, { "udp_stream": 55, "frame_number": 1621, "display_filter": "frame.number == 1621", "timestamp_epoch": "1583961783.464014000" }, { "udp_stream": 57, "frame_number": 1790, "display_filter": "frame.number == 1790", "timestamp_epoch": "1583961783.985573000" }, { "udp_stream": 57, "frame_number": 1791, "display_filter": "frame.number == 1791", "timestamp_epoch": "1583961783.986755000" }, { "udp_stream": 72, "frame_number": 2129, "display_filter": "frame.number == 2129", "timestamp_epoch": "1583961800.970926000" }, { "udp_stream": 72, "frame_number": 2131, "display_filter": "frame.number == 2131", "timestamp_epoch": "1583961800.971143000" }, { "udp_stream": 104, "frame_number": 3015, "display_filter": "frame.number == 3015", "timestamp_epoch": "1583961815.424012000" }, { "udp_stream": 104, "frame_number": 3016, "display_filter": "frame.number == 3016", "timestamp_epoch": "1583961815.424999000" }, { "udp_stream": 121, "frame_number": 3825, "display_filter": "frame.number == 3825", "timestamp_epoch": "1583961831.476016000" }, { "udp_stream": 121, "frame_number": 3827, "display_filter": "frame.number == 3827", "timestamp_epoch": "1583961831.476298000" }, { "udp_stream": 250, "frame_number": 15661, "display_filter": "frame.number == 15661", "timestamp_epoch": "1583962386.750583000" }, { "udp_stream": 250, "frame_number": 15662, "display_filter": "frame.number == 15662", "timestamp_epoch": "1583962386.751686000" }, { "udp_stream": 260, "frame_number": 16090, "display_filter": "frame.number == 16090", "timestamp_epoch": "1583962433.391674000" }, { "udp_stream": 260, "frame_number": 16091, "display_filter": "frame.number == 16091", "timestamp_epoch": "1583962433.392824000" }, { "udp_stream": 288, "frame_number": 16354, "display_filter": "frame.number == 16354", "timestamp_epoch": "1583962544.995048000" }, { "udp_stream": 288, "frame_number": 16355, "display_filter": "frame.number == 16355", "timestamp_epoch": "1583962544.995990000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:08.573842+00:00" }, { "observable_id": "observable-669b624feea051d1c5bdb496", "type": "domain", "value": "mrodevicemgr.officeapps.live.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 218, "frame_number": 14419, "display_filter": "frame.number == 14419", "timestamp_epoch": "1583962114.533183000" }, { "udp_stream": 218, "frame_number": 14420, "display_filter": "frame.number == 14420", "timestamp_epoch": "1583962114.562144000" }, { "udp_stream": 218, "frame_number": 14421, "display_filter": "frame.number == 14421", "timestamp_epoch": "1583962114.660248000" }, { "tcp_stream": 371, "frame_number": 14425, "display_filter": "frame.number == 14425", "timestamp_epoch": "1583962114.710649000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-bbb6fe6311bb3deeb8792faa", "type": "domain", "value": "msftspeechmodelsprod.azureedge.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 242, "frame_number": 15545, "display_filter": "frame.number == 15545", "timestamp_epoch": "1583962384.970159000" }, { "udp_stream": 242, "frame_number": 15546, "display_filter": "frame.number == 15546", "timestamp_epoch": "1583962384.989254000" }, { "udp_stream": 242, "frame_number": 15547, "display_filter": "frame.number == 15547", "timestamp_epoch": "1583962385.041155000" }, { "udp_stream": 296, "frame_number": 16564, "display_filter": "frame.number == 16564", "timestamp_epoch": "1583962549.947731000" }, { "udp_stream": 296, "frame_number": 16565, "display_filter": "frame.number == 16565", "timestamp_epoch": "1583962549.968158000" }, { "udp_stream": 296, "frame_number": 16566, "display_filter": "frame.number == 16566", "timestamp_epoch": "1583962549.969823000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0387d0395b96a9163ea27c46", "type": "domain", "value": "muewhinerfhe.mondogreek.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 162, "frame_number": 7316, "display_filter": "frame.number == 7316", "timestamp_epoch": "1583961858.377611000" }, { "udp_stream": 162, "frame_number": 7317, "display_filter": "frame.number == 7317", "timestamp_epoch": "1583961858.377882000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c92d01e31450bef11e65f195", "type": "domain", "value": "nebula.wsimg.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:07.452454+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:07.449589+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 141, "frame_number": 4394, "display_filter": "frame.number == 4394", "timestamp_epoch": "1583961854.763504000" }, { "udp_stream": 141, "frame_number": 4426, "display_filter": "frame.number == 4426", "timestamp_epoch": "1583961854.810288000" }, { "udp_stream": 320, "frame_number": 21162, "display_filter": "frame.number == 21162", "timestamp_epoch": "1583962650.461201000" }, { "udp_stream": 320, "frame_number": 21182, "display_filter": "frame.number == 21182", "timestamp_epoch": "1583962650.491671000" }, { "udp_stream": 320, "frame_number": 21185, "display_filter": "frame.number == 21185", "timestamp_epoch": "1583962650.504416000" }, { "tcp_stream": 211, "frame_number": 4477, "display_filter": "frame.number == 4477", "timestamp_epoch": "1583961854.851083000" }, { "tcp_stream": 210, "frame_number": 4481, "display_filter": "frame.number == 4481", "timestamp_epoch": "1583961854.851687000" }, { "tcp_stream": 211, "frame_number": 4640, "display_filter": "frame.number == 4640", "timestamp_epoch": "1583961855.181740000" }, { "tcp_stream": 210, "frame_number": 4642, "display_filter": "frame.number == 4642", "timestamp_epoch": "1583961855.182260000" }, { "tcp_stream": 210, "frame_number": 4815, "display_filter": "frame.number == 4815", "timestamp_epoch": "1583961855.664609000" }, { "tcp_stream": 210, "frame_number": 5452, "display_filter": "frame.number == 5452", "timestamp_epoch": "1583961856.581965000" }, { "tcp_stream": 210, "frame_number": 6075, "display_filter": "frame.number == 6075", "timestamp_epoch": "1583961857.236308000" }, { "tcp_stream": 211, "frame_number": 6077, "display_filter": "frame.number == 6077", "timestamp_epoch": "1583961857.236854000" }, { "tcp_stream": 238, "frame_number": 6156, "display_filter": "frame.number == 6156", "timestamp_epoch": "1583961857.286384000" }, { "tcp_stream": 239, "frame_number": 6158, "display_filter": "frame.number == 6158", "timestamp_epoch": "1583961857.286584000" }, { "tcp_stream": 210, "frame_number": 7726, "display_filter": "frame.number == 7726", "timestamp_epoch": "1583961864.845032000" }, { "tcp_stream": 210, "frame_number": 8195, "display_filter": "frame.number == 8195", "timestamp_epoch": "1583961872.460195000" }, { "tcp_stream": 210, "frame_number": 9006, "display_filter": "frame.number == 9006", "timestamp_epoch": "1583961880.076800000" }, { "tcp_stream": 210, "frame_number": 9419, "display_filter": "frame.number == 9419", "timestamp_epoch": "1583961887.693830000" }, { "tcp_stream": 210, "frame_number": 9821, "display_filter": "frame.number == 9821", "timestamp_epoch": "1583961895.296505000" } ], "roles": [ "dns-query", "http-host" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:07.446059+00:00" }, { "observable_id": "observable-152c0bb01d7db215ea2f1ad1", "type": "domain", "value": "newegg.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 308, "frame_number": 21114, "display_filter": "frame.number == 21114", "timestamp_epoch": "1583962650.283852000" }, { "udp_stream": 308, "frame_number": 21123, "display_filter": "frame.number == 21123", "timestamp_epoch": "1583962650.314584000" }, { "udp_stream": 308, "frame_number": 21133, "display_filter": "frame.number == 21133", "timestamp_epoch": "1583962650.349973000" }, { "tcp_stream": 467, "frame_number": 21154, "display_filter": "frame.number == 21154", "timestamp_epoch": "1583962650.405381000" } ], "roles": [ "dns-query", "http-host" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-5c9303fb887e42bf457b8a76", "type": "domain", "value": "newegg.com.ssl.sc.omtrdc.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 336, "frame_number": 21384, "display_filter": "frame.number == 21384", "timestamp_epoch": "1583962651.092080000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-5163c70db1f6eed80000f94a", "type": "domain", "value": "newegginc.demdex.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 348, "frame_number": 23792, "display_filter": "frame.number == 23792", "timestamp_epoch": "1583962652.394288000" }, { "udp_stream": 348, "frame_number": 23807, "display_filter": "frame.number == 23807", "timestamp_epoch": "1583962652.422875000" }, { "tcp_stream": 495, "frame_number": 23814, "display_filter": "frame.number == 23814", "timestamp_epoch": "1583962652.506365000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0dc9804496777de7651b6aa4", "type": "domain", "value": "nexusrules.officeapps.live.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 110, "frame_number": 3121, "display_filter": "frame.number == 3121", "timestamp_epoch": "1583961816.717826000" }, { "udp_stream": 110, "frame_number": 3122, "display_filter": "frame.number == 3122", "timestamp_epoch": "1583961816.742544000" }, { "udp_stream": 177, "frame_number": 8542, "display_filter": "frame.number == 8542", "timestamp_epoch": "1583961873.835905000" }, { "udp_stream": 177, "frame_number": 8543, "display_filter": "frame.number == 8543", "timestamp_epoch": "1583961873.836267000" }, { "udp_stream": 190, "frame_number": 10338, "display_filter": "frame.number == 10338", "timestamp_epoch": "1583961936.170865000" }, { "udp_stream": 190, "frame_number": 10339, "display_filter": "frame.number == 10339", "timestamp_epoch": "1583961936.171143000" }, { "udp_stream": 417, "frame_number": 29844, "display_filter": "frame.number == 29844", "timestamp_epoch": "1583963487.664315000" }, { "udp_stream": 417, "frame_number": 29845, "display_filter": "frame.number == 29845", "timestamp_epoch": "1583963487.694128000" }, { "udp_stream": 417, "frame_number": 29846, "display_filter": "frame.number == 29846", "timestamp_epoch": "1583963487.731856000" }, { "tcp_stream": 148, "frame_number": 3126, "display_filter": "frame.number == 3126", "timestamp_epoch": "1583961816.796778000" }, { "tcp_stream": 257, "frame_number": 8547, "display_filter": "frame.number == 8547", "timestamp_epoch": "1583961873.895527000" }, { "tcp_stream": 269, "frame_number": 10343, "display_filter": "frame.number == 10343", "timestamp_epoch": "1583961936.268519000" }, { "tcp_stream": 647, "frame_number": 29850, "display_filter": "frame.number == 29850", "timestamp_epoch": "1583963487.870712000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-598334da9c6a5dc0b261441d", "type": "domain", "value": "nhfbugwsjf.mondogreek.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 12, "frame_number": 275, "display_filter": "frame.number == 275", "timestamp_epoch": "1583961755.962222000" }, { "udp_stream": 12, "frame_number": 276, "display_filter": "frame.number == 276", "timestamp_epoch": "1583961755.962554000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-cd035e5d2692ceb8292af2ac", "type": "domain", "value": "notable-quotes.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 207, "frame_number": 13301, "display_filter": "frame.number == 13301", "timestamp_epoch": "1583962027.181355000" }, { "udp_stream": 207, "frame_number": 13302, "display_filter": "frame.number == 13302", "timestamp_epoch": "1583962027.252924000" }, { "tcp_stream": 344, "frame_number": 13309, "display_filter": "frame.number == 13309", "timestamp_epoch": "1583962027.316706000" }, { "tcp_stream": 345, "frame_number": 13326, "display_filter": "frame.number == 13326", "timestamp_epoch": "1583962027.431505000" }, { "tcp_stream": 344, "frame_number": 13363, "display_filter": "frame.number == 13363", "timestamp_epoch": "1583962027.488515000" }, { "tcp_stream": 346, "frame_number": 13369, "display_filter": "frame.number == 13369", "timestamp_epoch": "1583962027.489267000" }, { "tcp_stream": 347, "frame_number": 13371, "display_filter": "frame.number == 13371", "timestamp_epoch": "1583962027.489469000" }, { "tcp_stream": 348, "frame_number": 13383, "display_filter": "frame.number == 13383", "timestamp_epoch": "1583962027.493360000" }, { "tcp_stream": 349, "frame_number": 13384, "display_filter": "frame.number == 13384", "timestamp_epoch": "1583962027.493415000" }, { "tcp_stream": 344, "frame_number": 13453, "display_filter": "frame.number == 13453", "timestamp_epoch": "1583962027.547622000" }, { "tcp_stream": 345, "frame_number": 14008, "display_filter": "frame.number == 14008", "timestamp_epoch": "1583962031.859675000" } ], "roles": [ "dns-query", "http-host" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-876ad876a2a05ecd0c7a6c8d", "type": "domain", "value": "nvzkinvuuinkgs.mondogreek.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 270, "frame_number": 16220, "display_filter": "frame.number == 16220", "timestamp_epoch": "1583962439.874056000" }, { "udp_stream": 270, "frame_number": 16222, "display_filter": "frame.number == 16222", "timestamp_epoch": "1583962439.874349000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1b76603c1a8f61ac9432c1fb", "type": "domain", "value": "nypi.dc-storm.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 384, "frame_number": 25914, "display_filter": "frame.number == 25914", "timestamp_epoch": "1583962656.791774000" }, { "udp_stream": 384, "frame_number": 25919, "display_filter": "frame.number == 25919", "timestamp_epoch": "1583962656.815109000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c8e04c64ccebf25929dbea62", "type": "domain", "value": "ocsp.digicert.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 193, "frame_number": 10494, "display_filter": "frame.number == 10494", "timestamp_epoch": "1583961955.768821000" }, { "udp_stream": 193, "frame_number": 10496, "display_filter": "frame.number == 10496", "timestamp_epoch": "1583961955.805772000" }, { "tcp_stream": 273, "frame_number": 10500, "display_filter": "frame.number == 10500", "timestamp_epoch": "1583961955.838319000" } ], "roles": [ "dns-query", "http-host" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1e9f085bf4ea6b82d9170d74", "type": "domain", "value": "pagead.l.doubleclick.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 365, "frame_number": 25148, "display_filter": "frame.number == 25148", "timestamp_epoch": "1583962655.347719000" }, { "udp_stream": 392, "frame_number": 26090, "display_filter": "frame.number == 26090", "timestamp_epoch": "1583962657.131301000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d96525b4492194d007eb9f83", "type": "domain", "value": "pagead46.l.doubleclick.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 352, "frame_number": 24064, "display_filter": "frame.number == 24064", "timestamp_epoch": "1583962652.905894000" }, { "udp_stream": 354, "frame_number": 24232, "display_filter": "frame.number == 24232", "timestamp_epoch": "1583962653.141217000" }, { "udp_stream": 372, "frame_number": 25283, "display_filter": "frame.number == 25283", "timestamp_epoch": "1583962655.597916000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-70f3911a93cbbe9592b0c533", "type": "domain", "value": "partnerad.l.doubleclick.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 355, "frame_number": 24226, "display_filter": "frame.number == 24226", "timestamp_epoch": "1583962653.139608000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-43a2028d2b3dab9060ebf667", "type": "domain", "value": "pf.newegg.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 340, "frame_number": 21389, "display_filter": "frame.number == 21389", "timestamp_epoch": "1583962651.096911000" }, { "udp_stream": 340, "frame_number": 21462, "display_filter": "frame.number == 21462", "timestamp_epoch": "1583962651.129190000" }, { "udp_stream": 340, "frame_number": 21486, "display_filter": "frame.number == 21486", "timestamp_epoch": "1583962651.132407000" }, { "tcp_stream": 488, "frame_number": 21637, "display_filter": "frame.number == 21637", "timestamp_epoch": "1583962651.199705000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a3740dd418d129e8a25d8bf3", "type": "domain", "value": "pixel.advertising.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 389, "frame_number": 26058, "display_filter": "frame.number == 26058", "timestamp_epoch": "1583962657.103947000" }, { "udp_stream": 389, "frame_number": 26095, "display_filter": "frame.number == 26095", "timestamp_epoch": "1583962657.134863000" }, { "udp_stream": 389, "frame_number": 26098, "display_filter": "frame.number == 26098", "timestamp_epoch": "1583962657.137080000" }, { "tcp_stream": 541, "frame_number": 26191, "display_filter": "frame.number == 26191", "timestamp_epoch": "1583962657.269010000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-5e91c004b68199531edd00ef", "type": "domain", "value": "pixel.rubiconproject.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 390, "frame_number": 26059, "display_filter": "frame.number == 26059", "timestamp_epoch": "1583962657.104542000" }, { "udp_stream": 390, "frame_number": 26082, "display_filter": "frame.number == 26082", "timestamp_epoch": "1583962657.125860000" }, { "tcp_stream": 536, "frame_number": 26150, "display_filter": "frame.number == 26150", "timestamp_epoch": "1583962657.208684000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-57691020a7d51e6dfd5cd492", "type": "domain", "value": "pixel.rubiconproject.net.akadns.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 390, "frame_number": 26082, "display_filter": "frame.number == 26082", "timestamp_epoch": "1583962657.125860000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2f506e919718a20ac3f91717", "type": "domain", "value": "platform.twitter.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 156, "frame_number": 6001, "display_filter": "frame.number == 6001", "timestamp_epoch": "1583961857.000173000" }, { "udp_stream": 156, "frame_number": 6069, "display_filter": "frame.number == 6069", "timestamp_epoch": "1583961857.209794000" }, { "udp_stream": 321, "frame_number": 21163, "display_filter": "frame.number == 21163", "timestamp_epoch": "1583962650.461396000" }, { "udp_stream": 321, "frame_number": 21184, "display_filter": "frame.number == 21184", "timestamp_epoch": "1583962650.492792000" }, { "udp_stream": 321, "frame_number": 21194, "display_filter": "frame.number == 21194", "timestamp_epoch": "1583962650.527524000" }, { "tcp_stream": 237, "frame_number": 6154, "display_filter": "frame.number == 6154", "timestamp_epoch": "1583961857.286196000" }, { "tcp_stream": 241, "frame_number": 6672, "display_filter": "frame.number == 6672", "timestamp_epoch": "1583961857.434186000" }, { "tcp_stream": 241, "frame_number": 6820, "display_filter": "frame.number == 6820", "timestamp_epoch": "1583961857.462573000" } ], "roles": [ "dns-query", "http-host", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a4a42b8dbe065eb4a3ea6364", "type": "domain", "value": "play.google.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 364, "frame_number": 25127, "display_filter": "frame.number == 25127", "timestamp_epoch": "1583962655.240794000" }, { "udp_stream": 364, "frame_number": 25129, "display_filter": "frame.number == 25129", "timestamp_epoch": "1583962655.272099000" }, { "udp_stream": 364, "frame_number": 25130, "display_filter": "frame.number == 25130", "timestamp_epoch": "1583962655.290011000" }, { "tcp_stream": 511, "frame_number": 25139, "display_filter": "frame.number == 25139", "timestamp_epoch": "1583962655.310032000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f05a0ae62b2532ac94d7e518", "type": "domain", "value": "plus.l.google.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 356, "frame_number": 24523, "display_filter": "frame.number == 24523", "timestamp_epoch": "1583962654.493084000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-01356047e0a784cb871ed12f", "type": "domain", "value": "prod.mrodevicemgr.live.com.akadns.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 218, "frame_number": 14421, "display_filter": "frame.number == 14421", "timestamp_epoch": "1583962114.660248000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-39a46292a15be15a5f1932df", "type": "domain", "value": "prod.nexusrules.live.com.akadns.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 110, "frame_number": 3122, "display_filter": "frame.number == 3122", "timestamp_epoch": "1583961816.742544000" }, { "udp_stream": 177, "frame_number": 8543, "display_filter": "frame.number == 8543", "timestamp_epoch": "1583961873.836267000" }, { "udp_stream": 190, "frame_number": 10339, "display_filter": "frame.number == 10339", "timestamp_epoch": "1583961936.171143000" }, { "udp_stream": 417, "frame_number": 29846, "display_filter": "frame.number == 29846", "timestamp_epoch": "1583963487.731856000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-aa3db9e0244f6bdddffd3b52", "type": "domain", "value": "promotions.newegg.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 329, "frame_number": 21281, "display_filter": "frame.number == 21281", "timestamp_epoch": "1583962650.899420000" }, { "udp_stream": 329, "frame_number": 21290, "display_filter": "frame.number == 21290", "timestamp_epoch": "1583962650.943765000" }, { "tcp_stream": 471, "frame_number": 21302, "display_filter": "frame.number == 21302", "timestamp_epoch": "1583962650.966488000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-cdf7f9517f749a20ef42ddf6", "type": "domain", "value": "pti.store.microsoft.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 197, "frame_number": 12411, "display_filter": "frame.number == 12411", "timestamp_epoch": "1583961995.533222000" }, { "udp_stream": 197, "frame_number": 12412, "display_filter": "frame.number == 12412", "timestamp_epoch": "1583961995.556452000" }, { "udp_stream": 225, "frame_number": 14740, "display_filter": "frame.number == 14740", "timestamp_epoch": "1583962291.232047000" }, { "udp_stream": 225, "frame_number": 14743, "display_filter": "frame.number == 14743", "timestamp_epoch": "1583962291.263099000" }, { "udp_stream": 225, "frame_number": 14744, "display_filter": "frame.number == 14744", "timestamp_epoch": "1583962291.265084000" }, { "udp_stream": 227, "frame_number": 14918, "display_filter": "frame.number == 14918", "timestamp_epoch": "1583962319.914672000" }, { "udp_stream": 227, "frame_number": 14919, "display_filter": "frame.number == 14919", "timestamp_epoch": "1583962319.940114000" }, { "tcp_stream": 321, "frame_number": 12416, "display_filter": "frame.number == 12416", "timestamp_epoch": "1583961995.606172000" }, { "tcp_stream": 381, "frame_number": 14750, "display_filter": "frame.number == 14750", "timestamp_epoch": "1583962291.285102000" }, { "tcp_stream": 387, "frame_number": 14925, "display_filter": "frame.number == 14925", "timestamp_epoch": "1583962319.971860000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-408797bd97ba56a1977acae2", "type": "domain", "value": "px.steelhousemedia.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 399, "frame_number": 26432, "display_filter": "frame.number == 26432", "timestamp_epoch": "1583962658.957656000" }, { "udp_stream": 399, "frame_number": 26433, "display_filter": "frame.number == 26433", "timestamp_epoch": "1583962658.985207000" }, { "tcp_stream": 549, "frame_number": 26437, "display_filter": "frame.number == 26437", "timestamp_epoch": "1583962659.002722000" }, { "tcp_stream": 550, "frame_number": 26491, "display_filter": "frame.number == 26491", "timestamp_epoch": "1583962661.185111000" }, { "tcp_stream": 552, "frame_number": 26542, "display_filter": "frame.number == 26542", "timestamp_epoch": "1583962661.497727000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f600b97968a199475b927715", "type": "domain", "value": "pxtm.steelhousemedia.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 399, "frame_number": 26433, "display_filter": "frame.number == 26433", "timestamp_epoch": "1583962658.985207000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1e16c976be53a9f9f7c880a9", "type": "domain", "value": "roijvdflsx.mondogreek.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 271, "frame_number": 16221, "display_filter": "frame.number == 16221", "timestamp_epoch": "1583962439.874196000" }, { "udp_stream": 271, "frame_number": 16224, "display_filter": "frame.number == 16224", "timestamp_epoch": "1583962439.874418000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1d4b15cde435f57f8099df43", "type": "domain", "value": "rtb-csync.smartadserver.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 394, "frame_number": 26087, "display_filter": "frame.number == 26087", "timestamp_epoch": "1583962657.128132000" }, { "udp_stream": 394, "frame_number": 26110, "display_filter": "frame.number == 26110", "timestamp_epoch": "1583962657.158825000" }, { "udp_stream": 394, "frame_number": 26180, "display_filter": "frame.number == 26180", "timestamp_epoch": "1583962657.266607000" }, { "tcp_stream": 544, "frame_number": 26247, "display_filter": "frame.number == 26247", "timestamp_epoch": "1583962657.359466000" }, { "tcp_stream": 546, "frame_number": 26299, "display_filter": "frame.number == 26299", "timestamp_epoch": "1583962657.447591000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-4c4a6b2473fec43c3df4aa23", "type": "domain", "value": "rum18.perf.linkedin.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 78, "frame_number": 2335, "display_filter": "frame.number == 2335", "timestamp_epoch": "1583961806.486979000" }, { "udp_stream": 78, "frame_number": 2340, "display_filter": "frame.number == 2340", "timestamp_epoch": "1583961806.507845000" }, { "tcp_stream": 117, "frame_number": 2397, "display_filter": "frame.number == 2397", "timestamp_epoch": "1583961806.671116000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3f3891427c3c108ac264c220", "type": "domain", "value": "s-0001.s-msedge.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 137, "frame_number": 4342, "display_filter": "frame.number == 4342", "timestamp_epoch": "1583961854.516637000" }, { "udp_stream": 406, "frame_number": 26795, "display_filter": "frame.number == 26795", "timestamp_epoch": "1583962685.586418000" }, { "udp_stream": 407, "frame_number": 27314, "display_filter": "frame.number == 27314", "timestamp_epoch": "1583962732.810552000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e2e09c15ce773c4bd6f6baf2", "type": "domain", "value": "s-ring.msedge.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 75, "frame_number": 2326, "display_filter": "frame.number == 2326", "timestamp_epoch": "1583961806.398703000" }, { "udp_stream": 75, "frame_number": 2328, "display_filter": "frame.number == 2328", "timestamp_epoch": "1583961806.430849000" }, { "tcp_stream": 113, "frame_number": 2373, "display_filter": "frame.number == 2373", "timestamp_epoch": "1583961806.630592000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-53fcb2eb838e40eb38acdced", "type": "domain", "value": "s7.addthis.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 146, "frame_number": 4538, "display_filter": "frame.number == 4538", "timestamp_epoch": "1583961854.904839000" }, { "udp_stream": 146, "frame_number": 4544, "display_filter": "frame.number == 4544", "timestamp_epoch": "1583961854.927021000" }, { "udp_stream": 322, "frame_number": 21164, "display_filter": "frame.number == 21164", "timestamp_epoch": "1583962650.461620000" }, { "udp_stream": 322, "frame_number": 21183, "display_filter": "frame.number == 21183", "timestamp_epoch": "1583962650.492719000" }, { "udp_stream": 322, "frame_number": 21187, "display_filter": "frame.number == 21187", "timestamp_epoch": "1583962650.507613000" }, { "tcp_stream": 216, "frame_number": 4559, "display_filter": "frame.number == 4559", "timestamp_epoch": "1583961854.985134000" }, { "tcp_stream": 218, "frame_number": 4572, "display_filter": "frame.number == 4572", "timestamp_epoch": "1583961855.058332000" } ], "roles": [ "dns-query", "http-host", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d4bc9bce2e6ea266c13c6ad8", "type": "domain", "value": "sb.monetate.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 346, "frame_number": 23646, "display_filter": "frame.number == 23646", "timestamp_epoch": "1583962652.091185000" }, { "udp_stream": 346, "frame_number": 23650, "display_filter": "frame.number == 23650", "timestamp_epoch": "1583962652.122053000" }, { "udp_stream": 346, "frame_number": 23655, "display_filter": "frame.number == 23655", "timestamp_epoch": "1583962652.135603000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-72cdd77693b1dc882bc0d6cf", "type": "domain", "value": "scontent.xx.fbcdn.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 155, "frame_number": 5989, "display_filter": "frame.number == 5989", "timestamp_epoch": "1583961856.974342000" }, { "udp_stream": 310, "frame_number": 21130, "display_filter": "frame.number == 21130", "timestamp_epoch": "1583962650.341046000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-20dfb001ebf89a36e59000b1", "type": "domain", "value": "se.monetate.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 335, "frame_number": 21317, "display_filter": "frame.number == 21317", "timestamp_epoch": "1583962650.973530000" }, { "udp_stream": 335, "frame_number": 21367, "display_filter": "frame.number == 21367", "timestamp_epoch": "1583962651.004532000" }, { "udp_stream": 335, "frame_number": 21451, "display_filter": "frame.number == 21451", "timestamp_epoch": "1583962651.128381000" }, { "tcp_stream": 487, "frame_number": 21630, "display_filter": "frame.number == 21630", "timestamp_epoch": "1583962651.198570000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-be53fb328ea526dc073bfd2c", "type": "domain", "value": "sealserver.trustwave.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 338, "frame_number": 21378, "display_filter": "frame.number == 21378", "timestamp_epoch": "1583962651.055367000" }, { "udp_stream": 338, "frame_number": 21379, "display_filter": "frame.number == 21379", "timestamp_epoch": "1583962651.086538000" }, { "udp_stream": 338, "frame_number": 21482, "display_filter": "frame.number == 21482", "timestamp_epoch": "1583962651.129952000" }, { "tcp_stream": 486, "frame_number": 21606, "display_filter": "frame.number == 21606", "timestamp_epoch": "1583962651.197319000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-35dd3cfd7f14a191503a8140", "type": "domain", "value": "secure.adnxs.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 391, "frame_number": 26060, "display_filter": "frame.number == 26060", "timestamp_epoch": "1583962657.105078000" }, { "udp_stream": 391, "frame_number": 26083, "display_filter": "frame.number == 26083", "timestamp_epoch": "1583962657.125928000" }, { "tcp_stream": 537, "frame_number": 26185, "display_filter": "frame.number == 26185", "timestamp_epoch": "1583962657.267107000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-14d94dcd3be296b5b308f17a", "type": "domain", "value": "secure.newegg.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 333, "frame_number": 21297, "display_filter": "frame.number == 21297", "timestamp_epoch": "1583962650.960120000" }, { "udp_stream": 333, "frame_number": 21354, "display_filter": "frame.number == 21354", "timestamp_epoch": "1583962650.991794000" }, { "udp_stream": 333, "frame_number": 21364, "display_filter": "frame.number == 21364", "timestamp_epoch": "1583962651.000088000" }, { "tcp_stream": 482, "frame_number": 21491, "display_filter": "frame.number == 21491", "timestamp_epoch": "1583962651.136634000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d585839b09664977e1501389", "type": "domain", "value": "securepubads.g.doubleclick.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 355, "frame_number": 24222, "display_filter": "frame.number == 24222", "timestamp_epoch": "1583962653.095819000" }, { "udp_stream": 355, "frame_number": 24225, "display_filter": "frame.number == 24225", "timestamp_epoch": "1583962653.126996000" }, { "udp_stream": 355, "frame_number": 24226, "display_filter": "frame.number == 24226", "timestamp_epoch": "1583962653.139608000" }, { "tcp_stream": 502, "frame_number": 24248, "display_filter": "frame.number == 24248", "timestamp_epoch": "1583962653.172435000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-062259f9df6a178908737469", "type": "domain", "value": "self.events.data.microsoft.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 28, "frame_number": 1016, "display_filter": "frame.number == 1016", "timestamp_epoch": "1583961766.480352000" }, { "udp_stream": 28, "frame_number": 1019, "display_filter": "frame.number == 1019", "timestamp_epoch": "1583961766.602814000" }, { "udp_stream": 69, "frame_number": 2019, "display_filter": "frame.number == 2019", "timestamp_epoch": "1583961792.678223000" }, { "udp_stream": 69, "frame_number": 2020, "display_filter": "frame.number == 2020", "timestamp_epoch": "1583961792.706361000" }, { "udp_stream": 118, "frame_number": 3705, "display_filter": "frame.number == 3705", "timestamp_epoch": "1583961823.973236000" }, { "udp_stream": 118, "frame_number": 3706, "display_filter": "frame.number == 3706", "timestamp_epoch": "1583961824.002810000" }, { "udp_stream": 180, "frame_number": 9003, "display_filter": "frame.number == 9003", "timestamp_epoch": "1583961879.976722000" }, { "udp_stream": 180, "frame_number": 9004, "display_filter": "frame.number == 9004", "timestamp_epoch": "1583961880.041235000" }, { "tcp_stream": 50, "frame_number": 1023, "display_filter": "frame.number == 1023", "timestamp_epoch": "1583961766.883291000" }, { "tcp_stream": 99, "frame_number": 2024, "display_filter": "frame.number == 2024", "timestamp_epoch": "1583961792.836242000" }, { "tcp_stream": 175, "frame_number": 3710, "display_filter": "frame.number == 3710", "timestamp_epoch": "1583961824.060099000" }, { "tcp_stream": 260, "frame_number": 9010, "display_filter": "frame.number == 9010", "timestamp_epoch": "1583961880.113934000" }, { "tcp_stream": 365, "frame_number": 14262, "display_filter": "frame.number == 14262", "timestamp_epoch": "1583962086.400945000" }, { "tcp_stream": 366, "frame_number": 14319, "display_filter": "frame.number == 14319", "timestamp_epoch": "1583962112.351640000" }, { "tcp_stream": 372, "frame_number": 14483, "display_filter": "frame.number == 14483", "timestamp_epoch": "1583962143.682391000" }, { "tcp_stream": 373, "frame_number": 14512, "display_filter": "frame.number == 14512", "timestamp_epoch": "1583962155.990990000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-fd9c2bb0a887bfad0807561a", "type": "domain", "value": "settings-win.data.microsoft.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 117, "frame_number": 3698, "display_filter": "frame.number == 3698", "timestamp_epoch": "1583961823.738973000" }, { "udp_stream": 117, "frame_number": 3699, "display_filter": "frame.number == 3699", "timestamp_epoch": "1583961823.771503000" }, { "udp_stream": 239, "frame_number": 15386, "display_filter": "frame.number == 15386", "timestamp_epoch": "1583962380.401914000" }, { "udp_stream": 239, "frame_number": 15393, "display_filter": "frame.number == 15393", "timestamp_epoch": "1583962380.441417000" }, { "udp_stream": 284, "frame_number": 16327, "display_filter": "frame.number == 16327", "timestamp_epoch": "1583962544.765052000" }, { "udp_stream": 284, "frame_number": 16328, "display_filter": "frame.number == 16328", "timestamp_epoch": "1583962544.794759000" }, { "udp_stream": 284, "frame_number": 16329, "display_filter": "frame.number == 16329", "timestamp_epoch": "1583962544.824732000" }, { "tcp_stream": 174, "frame_number": 3703, "display_filter": "frame.number == 3703", "timestamp_epoch": "1583961823.830970000" }, { "tcp_stream": 396, "frame_number": 15401, "display_filter": "frame.number == 15401", "timestamp_epoch": "1583962380.471041000" }, { "tcp_stream": 405, "frame_number": 15717, "display_filter": "frame.number == 15717", "timestamp_epoch": "1583962387.261460000" }, { "tcp_stream": 407, "frame_number": 15754, "display_filter": "frame.number == 15754", "timestamp_epoch": "1583962387.520876000" }, { "tcp_stream": 415, "frame_number": 16333, "display_filter": "frame.number == 16333", "timestamp_epoch": "1583962544.850204000" }, { "tcp_stream": 424, "frame_number": 16570, "display_filter": "frame.number == 16570", "timestamp_epoch": "1583962550.983275000" }, { "tcp_stream": 425, "frame_number": 16595, "display_filter": "frame.number == 16595", "timestamp_epoch": "1583962551.126244000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-02bfb21a1ef9388b5e799d76", "type": "domain", "value": "settingsfd-geo.trafficmanager.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 117, "frame_number": 3699, "display_filter": "frame.number == 3699", "timestamp_epoch": "1583961823.771503000" }, { "udp_stream": 239, "frame_number": 15393, "display_filter": "frame.number == 15393", "timestamp_epoch": "1583962380.441417000" }, { "udp_stream": 284, "frame_number": 16329, "display_filter": "frame.number == 16329", "timestamp_epoch": "1583962544.824732000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-4012c92c03e1ff6f7c4e624f", "type": "domain", "value": "slscr.update.microsoft.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 191, "frame_number": 10443, "display_filter": "frame.number == 10443", "timestamp_epoch": "1583961950.896457000" }, { "udp_stream": 191, "frame_number": 10445, "display_filter": "frame.number == 10445", "timestamp_epoch": "1583961951.891892000" }, { "udp_stream": 191, "frame_number": 10446, "display_filter": "frame.number == 10446", "timestamp_epoch": "1583961952.907454000" }, { "udp_stream": 191, "frame_number": 10456, "display_filter": "frame.number == 10456", "timestamp_epoch": "1583961954.783018000" }, { "udp_stream": 243, "frame_number": 15550, "display_filter": "frame.number == 15550", "timestamp_epoch": "1583962385.391674000" }, { "udp_stream": 243, "frame_number": 15551, "display_filter": "frame.number == 15551", "timestamp_epoch": "1583962385.535429000" }, { "udp_stream": 411, "frame_number": 27536, "display_filter": "frame.number == 27536", "timestamp_epoch": "1583962904.728695000" }, { "udp_stream": 411, "frame_number": 27537, "display_filter": "frame.number == 27537", "timestamp_epoch": "1583962904.757302000" }, { "udp_stream": 411, "frame_number": 27538, "display_filter": "frame.number == 27538", "timestamp_epoch": "1583962904.881940000" }, { "tcp_stream": 271, "frame_number": 10460, "display_filter": "frame.number == 10460", "timestamp_epoch": "1583961954.945579000" }, { "tcp_stream": 401, "frame_number": 15555, "display_filter": "frame.number == 15555", "timestamp_epoch": "1583962385.574608000" }, { "tcp_stream": 572, "frame_number": 27542, "display_filter": "frame.number == 27542", "timestamp_epoch": "1583962904.927272000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-4629fc13a505594ee8182fd9", "type": "domain", "value": "spo-ring.msedge.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 127, "frame_number": 4046, "display_filter": "frame.number == 4046", "timestamp_epoch": "1583961837.164150000" }, { "udp_stream": 127, "frame_number": 4058, "display_filter": "frame.number == 4058", "timestamp_epoch": "1583961837.190570000" }, { "udp_stream": 206, "frame_number": 12906, "display_filter": "frame.number == 12906", "timestamp_epoch": "1583962015.853494000" }, { "udp_stream": 206, "frame_number": 12907, "display_filter": "frame.number == 12907", "timestamp_epoch": "1583962015.867946000" }, { "tcp_stream": 191, "frame_number": 4078, "display_filter": "frame.number == 4078", "timestamp_epoch": "1583961837.245010000" }, { "tcp_stream": 335, "frame_number": 12913, "display_filter": "frame.number == 12913", "timestamp_epoch": "1583962015.892849000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f96ef48d1952acced3ae4c3c", "type": "domain", "value": "star-mini.c10r.facebook.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 154, "frame_number": 5984, "display_filter": "frame.number == 5984", "timestamp_epoch": "1583961856.929561000" }, { "udp_stream": 325, "frame_number": 21205, "display_filter": "frame.number == 21205", "timestamp_epoch": "1583962650.557596000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3d6c4a2169d82859d004c0c7", "type": "domain", "value": "states.newegg.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 336, "frame_number": 21322, "display_filter": "frame.number == 21322", "timestamp_epoch": "1583962650.989158000" }, { "udp_stream": 336, "frame_number": 21372, "display_filter": "frame.number == 21372", "timestamp_epoch": "1583962651.019716000" }, { "udp_stream": 336, "frame_number": 21384, "display_filter": "frame.number == 21384", "timestamp_epoch": "1583962651.092080000" }, { "tcp_stream": 484, "frame_number": 21568, "display_filter": "frame.number == 21568", "timestamp_epoch": "1583962651.195071000" }, { "tcp_stream": 498, "frame_number": 24004, "display_filter": "frame.number == 24004", "timestamp_epoch": "1583962652.725185000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-65441b2cb1269de717e2221f", "type": "domain", "value": "stats.g.doubleclick.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 361, "frame_number": 24769, "display_filter": "frame.number == 24769", "timestamp_epoch": "1583962654.673446000" }, { "udp_stream": 361, "frame_number": 24781, "display_filter": "frame.number == 24781", "timestamp_epoch": "1583962654.704131000" }, { "udp_stream": 361, "frame_number": 24784, "display_filter": "frame.number == 24784", "timestamp_epoch": "1583962654.705612000" }, { "tcp_stream": 510, "frame_number": 24879, "display_filter": "frame.number == 24879", "timestamp_epoch": "1583962654.735156000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a4a888286b45ad81f63afa84", "type": "domain", "value": "stats.l.doubleclick.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 361, "frame_number": 24784, "display_filter": "frame.number == 24784", "timestamp_epoch": "1583962654.705612000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-64a7be359bbfc67d8614c710", "type": "domain", "value": "storage.googleapis.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 374, "frame_number": 25497, "display_filter": "frame.number == 25497", "timestamp_epoch": "1583962655.838210000" }, { "udp_stream": 374, "frame_number": 25499, "display_filter": "frame.number == 25499", "timestamp_epoch": "1583962655.863798000" }, { "tcp_stream": 519, "frame_number": 25503, "display_filter": "frame.number == 25503", "timestamp_epoch": "1583962655.878836000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e31fb5e53e0ba0be343608b7", "type": "domain", "value": "storecatalogrevocation.storequality.microsoft.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 244, "frame_number": 15562, "display_filter": "frame.number == 15562", "timestamp_epoch": "1583962385.634946000" }, { "udp_stream": 244, "frame_number": 15570, "display_filter": "frame.number == 15570", "timestamp_epoch": "1583962385.661204000" }, { "udp_stream": 244, "frame_number": 15571, "display_filter": "frame.number == 15571", "timestamp_epoch": "1583962385.663937000" }, { "udp_stream": 295, "frame_number": 16522, "display_filter": "frame.number == 16522", "timestamp_epoch": "1583962548.988295000" }, { "udp_stream": 295, "frame_number": 16523, "display_filter": "frame.number == 16523", "timestamp_epoch": "1583962549.014811000" }, { "udp_stream": 295, "frame_number": 16524, "display_filter": "frame.number == 16524", "timestamp_epoch": "1583962549.023492000" }, { "udp_stream": 410, "frame_number": 27476, "display_filter": "frame.number == 27476", "timestamp_epoch": "1583962861.337942000" }, { "udp_stream": 410, "frame_number": 27477, "display_filter": "frame.number == 27477", "timestamp_epoch": "1583962861.365380000" }, { "udp_stream": 410, "frame_number": 27478, "display_filter": "frame.number == 27478", "timestamp_epoch": "1583962861.371315000" }, { "tcp_stream": 402, "frame_number": 15575, "display_filter": "frame.number == 15575", "timestamp_epoch": "1583962385.683749000" }, { "tcp_stream": 421, "frame_number": 16528, "display_filter": "frame.number == 16528", "timestamp_epoch": "1583962549.089942000" }, { "tcp_stream": 569, "frame_number": 27482, "display_filter": "frame.number == 27482", "timestamp_epoch": "1583962861.387323000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e3c7e4671c16e822e96abfc1", "type": "domain", "value": "sts.eccmp.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 370, "frame_number": 25223, "display_filter": "frame.number == 25223", "timestamp_epoch": "1583962655.435951000" }, { "udp_stream": 370, "frame_number": 25229, "display_filter": "frame.number == 25229", "timestamp_epoch": "1583962655.466589000" }, { "udp_stream": 370, "frame_number": 25244, "display_filter": "frame.number == 25244", "timestamp_epoch": "1583962655.496790000" }, { "tcp_stream": 514, "frame_number": 25314, "display_filter": "frame.number == 25314", "timestamp_epoch": "1583962655.627441000" }, { "tcp_stream": 529, "frame_number": 25834, "display_filter": "frame.number == 25834", "timestamp_epoch": "1583962656.368355000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-7fe7149d0f4dbf7723154cb3", "type": "domain", "value": "syndication.twitter.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 161, "frame_number": 7057, "display_filter": "frame.number == 7057", "timestamp_epoch": "1583961857.752218000" }, { "udp_stream": 161, "frame_number": 7142, "display_filter": "frame.number == 7142", "timestamp_epoch": "1583961857.789491000" }, { "tcp_stream": 243, "frame_number": 7201, "display_filter": "frame.number == 7201", "timestamp_epoch": "1583961857.859694000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d3191cee77eb4577b3eb21e6", "type": "domain", "value": "t-ring.msedge.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 79, "frame_number": 2338, "display_filter": "frame.number == 2338", "timestamp_epoch": "1583961806.505691000" }, { "udp_stream": 79, "frame_number": 2339, "display_filter": "frame.number == 2339", "timestamp_epoch": "1583961806.506259000" }, { "tcp_stream": 116, "frame_number": 2350, "display_filter": "frame.number == 2350", "timestamp_epoch": "1583961806.556626000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d7035f93d7c06d2520f9c614", "type": "domain", "value": "tag.rmp.rakuten.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 369, "frame_number": 25222, "display_filter": "frame.number == 25222", "timestamp_epoch": "1583962655.435701000" }, { "udp_stream": 369, "frame_number": 25228, "display_filter": "frame.number == 25228", "timestamp_epoch": "1583962655.466524000" }, { "udp_stream": 369, "frame_number": 25241, "display_filter": "frame.number == 25241", "timestamp_epoch": "1583962655.496450000" }, { "tcp_stream": 516, "frame_number": 25272, "display_filter": "frame.number == 25272", "timestamp_epoch": "1583962655.536358000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-653b03e3ba18826497365c1a", "type": "domain", "value": "tags-cluster.rd.linksynergy.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 376, "frame_number": 25538, "display_filter": "frame.number == 25538", "timestamp_epoch": "1583962655.936276000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1d498c6cda32c83396eb1f4d", "type": "domain", "value": "tags.rd.linksynergy.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 376, "frame_number": 25508, "display_filter": "frame.number == 25508", "timestamp_epoch": "1583962655.895642000" }, { "udp_stream": 376, "frame_number": 25530, "display_filter": "frame.number == 25530", "timestamp_epoch": "1583962655.921742000" }, { "udp_stream": 376, "frame_number": 25538, "display_filter": "frame.number == 25538", "timestamp_epoch": "1583962655.936276000" }, { "tcp_stream": 521, "frame_number": 25720, "display_filter": "frame.number == 25720", "timestamp_epoch": "1583962656.143263000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0d7fc7b741e0a5776667b57e", "type": "domain", "value": "tags.tiqcdn.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 332, "frame_number": 21296, "display_filter": "frame.number == 21296", "timestamp_epoch": "1583962650.959746000" }, { "udp_stream": 332, "frame_number": 21318, "display_filter": "frame.number == 21318", "timestamp_epoch": "1583962650.986719000" }, { "tcp_stream": 480, "frame_number": 21484, "display_filter": "frame.number == 21484", "timestamp_epoch": "1583962651.131970000" }, { "tcp_stream": 480, "frame_number": 21581, "display_filter": "frame.number == 21581", "timestamp_epoch": "1583962651.195962000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-8de0f9d7444ec3c9eaa1b63f", "type": "domain", "value": "tpc.googlesyndication.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 358, "frame_number": 24519, "display_filter": "frame.number == 24519", "timestamp_epoch": "1583962654.479483000" }, { "udp_stream": 358, "frame_number": 24531, "display_filter": "frame.number == 24531", "timestamp_epoch": "1583962654.503997000" }, { "tcp_stream": 509, "frame_number": 24552, "display_filter": "frame.number == 24552", "timestamp_epoch": "1583962654.542479000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0b0dc19a22110f4fa46e222e", "type": "domain", "value": "triggeredmail.appspot.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 367, "frame_number": 25218, "display_filter": "frame.number == 25218", "timestamp_epoch": "1583962655.435019000" }, { "udp_stream": 367, "frame_number": 25226, "display_filter": "frame.number == 25226", "timestamp_epoch": "1583962655.465486000" }, { "udp_stream": 367, "frame_number": 25243, "display_filter": "frame.number == 25243", "timestamp_epoch": "1583962655.496736000" }, { "tcp_stream": 515, "frame_number": 25274, "display_filter": "frame.number == 25274", "timestamp_epoch": "1583962655.536611000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ef8f5fd8f7f1f51288181c65", "type": "domain", "value": "tring.clo.footprintdns.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 76, "frame_number": 2327, "display_filter": "frame.number == 2327", "timestamp_epoch": "1583961806.401801000" }, { "udp_stream": 76, "frame_number": 2329, "display_filter": "frame.number == 2329", "timestamp_epoch": "1583961806.431111000" }, { "tcp_stream": 114, "frame_number": 2352, "display_filter": "frame.number == 2352", "timestamp_epoch": "1583961806.556962000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-4e21eeb94c49dfb824ea3611", "type": "domain", "value": "tuscaloosabarnyard.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 136, "frame_number": 4348, "display_filter": "frame.number == 4348", "timestamp_epoch": "1583961854.572439000" }, { "udp_stream": 326, "frame_number": 21211, "display_filter": "frame.number == 21211", "timestamp_epoch": "1583962650.607967000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-5053a6ad945b2b10a724cc74", "type": "domain", "value": "twitter.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 157, "frame_number": 6002, "display_filter": "frame.number == 6002", "timestamp_epoch": "1583961857.008064000" }, { "udp_stream": 157, "frame_number": 6018, "display_filter": "frame.number == 6018", "timestamp_epoch": "1583961857.057731000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a002cc24dec2affa37d78150", "type": "domain", "value": "ukrtzhmkwhgj.mondogreek.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 163, "frame_number": 7318, "display_filter": "frame.number == 7318", "timestamp_epoch": "1583961858.377972000" }, { "udp_stream": 163, "frame_number": 7320, "display_filter": "frame.number == 7320", "timestamp_epoch": "1583961858.378172000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-38d6b80c8108d3d8ba79c812", "type": "domain", "value": "umwatson.trafficmanager.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 405, "frame_number": 26766, "display_filter": "frame.number == 26766", "timestamp_epoch": "1583962684.331866000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-fac1c2b06e08a83d5bf0284d", "type": "domain", "value": "ups.analytics.yahoo.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 398, "frame_number": 26390, "display_filter": "frame.number == 26390", "timestamp_epoch": "1583962657.753969000" }, { "udp_stream": 398, "frame_number": 26391, "display_filter": "frame.number == 26391", "timestamp_epoch": "1583962657.784497000" }, { "udp_stream": 398, "frame_number": 26392, "display_filter": "frame.number == 26392", "timestamp_epoch": "1583962657.788154000" }, { "tcp_stream": 548, "frame_number": 26406, "display_filter": "frame.number == 26406", "timestamp_epoch": "1583962657.853227000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-6bfaab96e21ec0eabfeac952", "type": "domain", "value": "ut.ra.linksynergy.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 375, "frame_number": 25507, "display_filter": "frame.number == 25507", "timestamp_epoch": "1583962655.894777000" }, { "udp_stream": 375, "frame_number": 25531, "display_filter": "frame.number == 25531", "timestamp_epoch": "1583962655.921875000" }, { "udp_stream": 375, "frame_number": 25539, "display_filter": "frame.number == 25539", "timestamp_epoch": "1583962655.936347000" }, { "tcp_stream": 522, "frame_number": 25561, "display_filter": "frame.number == 25561", "timestamp_epoch": "1583962655.959746000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-baf4f7f263ee4cd5141024fa", "type": "domain", "value": "v1.addthisedge.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 151, "frame_number": 4926, "display_filter": "frame.number == 4926", "timestamp_epoch": "1583961856.053988000" }, { "udp_stream": 151, "frame_number": 5227, "display_filter": "frame.number == 5227", "timestamp_epoch": "1583961856.360811000" }, { "udp_stream": 324, "frame_number": 21190, "display_filter": "frame.number == 21190", "timestamp_epoch": "1583962650.507885000" }, { "udp_stream": 324, "frame_number": 21198, "display_filter": "frame.number == 21198", "timestamp_epoch": "1583962650.538697000" }, { "udp_stream": 324, "frame_number": 21204, "display_filter": "frame.number == 21204", "timestamp_epoch": "1583962650.557545000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-390a43172c93fca895b0c134", "type": "domain", "value": "vbwxoaflt.mondogreek.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 164, "frame_number": 7319, "display_filter": "frame.number == 7319", "timestamp_epoch": "1583961858.378167000" }, { "udp_stream": 164, "frame_number": 7322, "display_filter": "frame.number == 7322", "timestamp_epoch": "1583961858.378408000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ffd616a26c7fc85d83a1aa3d", "type": "domain", "value": "vzxmvhjnnsazsyw.mondogreek.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 50, "frame_number": 1272, "display_filter": "frame.number == 1272", "timestamp_epoch": "1583961781.432375000" }, { "udp_stream": 50, "frame_number": 1273, "display_filter": "frame.number == 1273", "timestamp_epoch": "1583961781.432752000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ac8a46d2072ba16f426284ef", "type": "domain", "value": "watson.telemetry.microsoft.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 405, "frame_number": 26765, "display_filter": "frame.number == 26765", "timestamp_epoch": "1583962684.318184000" }, { "udp_stream": 405, "frame_number": 26766, "display_filter": "frame.number == 26766", "timestamp_epoch": "1583962684.331866000" }, { "tcp_stream": 558, "frame_number": 26770, "display_filter": "frame.number == 26770", "timestamp_epoch": "1583962684.378942000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ce410ff47637cec445bf130f", "type": "domain", "value": "web.vortex.data.microsoft.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 205, "frame_number": 12903, "display_filter": "frame.number == 12903", "timestamp_epoch": "1583962015.841022000" }, { "udp_stream": 205, "frame_number": 12946, "display_filter": "frame.number == 12946", "timestamp_epoch": "1583962015.928169000" }, { "tcp_stream": 341, "frame_number": 12979, "display_filter": "frame.number == 12979", "timestamp_epoch": "1583962016.009136000" }, { "tcp_stream": 337, "frame_number": 12981, "display_filter": "frame.number == 12981", "timestamp_epoch": "1583962016.009516000" }, { "tcp_stream": 338, "frame_number": 12983, "display_filter": "frame.number == 12983", "timestamp_epoch": "1583962016.009694000" }, { "tcp_stream": 340, "frame_number": 12985, "display_filter": "frame.number == 12985", "timestamp_epoch": "1583962016.009868000" }, { "tcp_stream": 339, "frame_number": 12987, "display_filter": "frame.number == 12987", "timestamp_epoch": "1583962016.010114000" }, { "tcp_stream": 336, "frame_number": 12989, "display_filter": "frame.number == 12989", "timestamp_epoch": "1583962016.010255000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-467d2539f56dab43ccb36218", "type": "domain", "value": "wpad.mondogreek.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 29, "frame_number": 1045, "display_filter": "frame.number == 1045", "timestamp_epoch": "1583961769.278542000" }, { "udp_stream": 29, "frame_number": 1046, "display_filter": "frame.number == 1046", "timestamp_epoch": "1583961769.280053000" }, { "udp_stream": 37, "frame_number": 1081, "display_filter": "frame.number == 1081", "timestamp_epoch": "1583961780.297336000" }, { "udp_stream": 37, "frame_number": 1082, "display_filter": "frame.number == 1082", "timestamp_epoch": "1583961780.297613000" }, { "udp_stream": 70, "frame_number": 2058, "display_filter": "frame.number == 2058", "timestamp_epoch": "1583961795.313560000" }, { "udp_stream": 70, "frame_number": 2059, "display_filter": "frame.number == 2059", "timestamp_epoch": "1583961795.313901000" }, { "udp_stream": 85, "frame_number": 2499, "display_filter": "frame.number == 2499", "timestamp_epoch": "1583961811.509917000" }, { "udp_stream": 85, "frame_number": 2500, "display_filter": "frame.number == 2500", "timestamp_epoch": "1583961811.510192000" }, { "udp_stream": 119, "frame_number": 3763, "display_filter": "frame.number == 3763", "timestamp_epoch": "1583961826.576626000" }, { "udp_stream": 119, "frame_number": 3764, "display_filter": "frame.number == 3764", "timestamp_epoch": "1583961826.576920000" }, { "udp_stream": 120, "frame_number": 3767, "display_filter": "frame.number == 3767", "timestamp_epoch": "1583961829.279283000" }, { "udp_stream": 120, "frame_number": 3768, "display_filter": "frame.number == 3768", "timestamp_epoch": "1583961829.279628000" }, { "udp_stream": 133, "frame_number": 4315, "display_filter": "frame.number == 4315", "timestamp_epoch": "1583961853.498551000" }, { "udp_stream": 133, "frame_number": 4316, "display_filter": "frame.number == 4316", "timestamp_epoch": "1583961853.498879000" }, { "udp_stream": 147, "frame_number": 4809, "display_filter": "frame.number == 4809", "timestamp_epoch": "1583961855.330328000" }, { "udp_stream": 147, "frame_number": 4810, "display_filter": "frame.number == 4810", "timestamp_epoch": "1583961855.330672000" }, { "udp_stream": 169, "frame_number": 7698, "display_filter": "frame.number == 7698", "timestamp_epoch": "1583961862.500514000" }, { "udp_stream": 169, "frame_number": 7699, "display_filter": "frame.number == 7699", "timestamp_epoch": "1583961862.500827000" }, { "udp_stream": 171, "frame_number": 7703, "display_filter": "frame.number == 7703", "timestamp_epoch": "1583961862.503247000" }, { "udp_stream": 171, "frame_number": 7704, "display_filter": "frame.number == 7704", "timestamp_epoch": "1583961862.503491000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e1bab2915e68e6406b3144eb", "type": "domain", "value": "ww.steelhousemedia.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 400, "frame_number": 26454, "display_filter": "frame.number == 26454", "timestamp_epoch": "1583962659.156343000" }, { "udp_stream": 400, "frame_number": 26455, "display_filter": "frame.number == 26455", "timestamp_epoch": "1583962659.187302000" }, { "udp_stream": 400, "frame_number": 26458, "display_filter": "frame.number == 26458", "timestamp_epoch": "1583962660.218284000" }, { "udp_stream": 400, "frame_number": 26599, "display_filter": "frame.number == 26599", "timestamp_epoch": "1583962662.232347000" }, { "udp_stream": 400, "frame_number": 26616, "display_filter": "frame.number == 26616", "timestamp_epoch": "1583962663.610644000" }, { "tcp_stream": 554, "frame_number": 26620, "display_filter": "frame.number == 26620", "timestamp_epoch": "1583962663.632257000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-efaf809fde38ece4cbac7d86", "type": "domain", "value": "www-google-analytics.l.google.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 158, "frame_number": 6019, "display_filter": "frame.number == 6019", "timestamp_epoch": "1583961857.067951000" }, { "udp_stream": 359, "frame_number": 24672, "display_filter": "frame.number == 24672", "timestamp_epoch": "1583962654.604448000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b34036b6c06367a28b7e1659", "type": "domain", "value": "www-googletagmanager.l.google.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 368, "frame_number": 25254, "display_filter": "frame.number == 25254", "timestamp_epoch": "1583962655.506747000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d5b15b5dd997b374ea204004", "type": "domain", "value": "www.addthis.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 153, "frame_number": 5936, "display_filter": "frame.number == 5936", "timestamp_epoch": "1583961856.850533000" }, { "udp_stream": 153, "frame_number": 5937, "display_filter": "frame.number == 5937", "timestamp_epoch": "1583961856.889136000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-50872cad0c040b00ae9fbfdf", "type": "domain", "value": "www.bing.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 59, "frame_number": 1801, "display_filter": "frame.number == 1801", "timestamp_epoch": "1583961788.617428000" }, { "udp_stream": 59, "frame_number": 1802, "display_filter": "frame.number == 1802", "timestamp_epoch": "1583961788.662452000" }, { "udp_stream": 73, "frame_number": 2280, "display_filter": "frame.number == 2280", "timestamp_epoch": "1583961806.049201000" }, { "udp_stream": 73, "frame_number": 2281, "display_filter": "frame.number == 2281", "timestamp_epoch": "1583961806.049603000" }, { "udp_stream": 122, "frame_number": 3979, "display_filter": "frame.number == 3979", "timestamp_epoch": "1583961832.890108000" }, { "udp_stream": 122, "frame_number": 3980, "display_filter": "frame.number == 3980", "timestamp_epoch": "1583961832.907313000" }, { "udp_stream": 124, "frame_number": 4037, "display_filter": "frame.number == 4037", "timestamp_epoch": "1583961837.107429000" }, { "udp_stream": 124, "frame_number": 4038, "display_filter": "frame.number == 4038", "timestamp_epoch": "1583961837.107859000" }, { "udp_stream": 130, "frame_number": 4256, "display_filter": "frame.number == 4256", "timestamp_epoch": "1583961848.516411000" }, { "udp_stream": 130, "frame_number": 4257, "display_filter": "frame.number == 4257", "timestamp_epoch": "1583961848.562517000" }, { "udp_stream": 200, "frame_number": 12476, "display_filter": "frame.number == 12476", "timestamp_epoch": "1583962013.755011000" }, { "udp_stream": 200, "frame_number": 12478, "display_filter": "frame.number == 12478", "timestamp_epoch": "1583962013.872576000" }, { "udp_stream": 212, "frame_number": 14087, "display_filter": "frame.number == 14087", "timestamp_epoch": "1583962054.667278000" }, { "udp_stream": 212, "frame_number": 14092, "display_filter": "frame.number == 14092", "timestamp_epoch": "1583962054.684480000" }, { "udp_stream": 294, "frame_number": 16487, "display_filter": "frame.number == 16487", "timestamp_epoch": "1583962547.110221000" }, { "udp_stream": 294, "frame_number": 16488, "display_filter": "frame.number == 16488", "timestamp_epoch": "1583962547.138635000" }, { "udp_stream": 294, "frame_number": 16489, "display_filter": "frame.number == 16489", "timestamp_epoch": "1583962547.149148000" }, { "tcp_stream": 88, "frame_number": 1808, "display_filter": "frame.number == 1808", "timestamp_epoch": "1583961788.875575000" }, { "tcp_stream": 111, "frame_number": 2285, "display_filter": "frame.number == 2285", "timestamp_epoch": "1583961806.201646000" }, { "tcp_stream": 187, "frame_number": 3984, "display_filter": "frame.number == 3984", "timestamp_epoch": "1583961832.930417000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b50cbaab6e81e18eea5a3edc", "type": "domain", "value": "www.combsscreenprinting.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 148, "frame_number": 4876, "display_filter": "frame.number == 4876", "timestamp_epoch": "1583961855.929704000" }, { "udp_stream": 148, "frame_number": 4916, "display_filter": "frame.number == 4916", "timestamp_epoch": "1583961856.009855000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-7b4d7b0c039fda8ae0d04ddd", "type": "domain", "value": "www.facebook.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 154, "frame_number": 5938, "display_filter": "frame.number == 5938", "timestamp_epoch": "1583961856.893298000" }, { "udp_stream": 154, "frame_number": 5984, "display_filter": "frame.number == 5984", "timestamp_epoch": "1583961856.929561000" }, { "udp_stream": 325, "frame_number": 21191, "display_filter": "frame.number == 21191", "timestamp_epoch": "1583962650.509056000" }, { "udp_stream": 325, "frame_number": 21199, "display_filter": "frame.number == 21199", "timestamp_epoch": "1583962650.539670000" }, { "udp_stream": 325, "frame_number": 21205, "display_filter": "frame.number == 21205", "timestamp_epoch": "1583962650.557596000" }, { "tcp_stream": 244, "frame_number": 7216, "display_filter": "frame.number == 7216", "timestamp_epoch": "1583961858.018771000" }, { "tcp_stream": 245, "frame_number": 7229, "display_filter": "frame.number == 7229", "timestamp_epoch": "1583961858.043596000" }, { "tcp_stream": 530, "frame_number": 25891, "display_filter": "frame.number == 25891", "timestamp_epoch": "1583962656.695963000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0a308ab2ef090dce83d0d24e", "type": "domain", "value": "www.godaddy.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 149, "frame_number": 4877, "display_filter": "frame.number == 4877", "timestamp_epoch": "1583961855.929844000" }, { "udp_stream": 149, "frame_number": 4886, "display_filter": "frame.number == 4886", "timestamp_epoch": "1583961855.968427000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ebe0d28c238f30aa8d61f8e4", "type": "domain", "value": "www.google-analytics.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 158, "frame_number": 6003, "display_filter": "frame.number == 6003", "timestamp_epoch": "1583961857.015931000" }, { "udp_stream": 158, "frame_number": 6019, "display_filter": "frame.number == 6019", "timestamp_epoch": "1583961857.067951000" }, { "udp_stream": 359, "frame_number": 24663, "display_filter": "frame.number == 24663", "timestamp_epoch": "1583962654.581676000" }, { "udp_stream": 359, "frame_number": 24672, "display_filter": "frame.number == 24672", "timestamp_epoch": "1583962654.604448000" }, { "tcp_stream": 235, "frame_number": 6025, "display_filter": "frame.number == 6025", "timestamp_epoch": "1583961857.085776000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0980945d83b8ccd680c78656", "type": "domain", "value": "www.google.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 353, "frame_number": 24218, "display_filter": "frame.number == 24218", "timestamp_epoch": "1583962653.093030000" }, { "udp_stream": 353, "frame_number": 24223, "display_filter": "frame.number == 24223", "timestamp_epoch": "1583962653.124048000" }, { "udp_stream": 353, "frame_number": 24231, "display_filter": "frame.number == 24231", "timestamp_epoch": "1583962653.141149000" }, { "tcp_stream": 503, "frame_number": 24246, "display_filter": "frame.number == 24246", "timestamp_epoch": "1583962653.172191000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-9ec6b47445a6b5af55b1ada4", "type": "domain", "value": "www.googleadservices.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 365, "frame_number": 25141, "display_filter": "frame.number == 25141", "timestamp_epoch": "1583962655.316585000" }, { "udp_stream": 365, "frame_number": 25148, "display_filter": "frame.number == 25148", "timestamp_epoch": "1583962655.347719000" }, { "tcp_stream": 512, "frame_number": 25183, "display_filter": "frame.number == 25183", "timestamp_epoch": "1583962655.369994000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-15d6f68e977e647646f4a81c", "type": "domain", "value": "www.googlecommerce.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 351, "frame_number": 24051, "display_filter": "frame.number == 24051", "timestamp_epoch": "1583962652.857426000" }, { "udp_stream": 351, "frame_number": 24062, "display_filter": "frame.number == 24062", "timestamp_epoch": "1583962652.888732000" }, { "udp_stream": 351, "frame_number": 24065, "display_filter": "frame.number == 24065", "timestamp_epoch": "1583962652.905991000" }, { "tcp_stream": 500, "frame_number": 24112, "display_filter": "frame.number == 24112", "timestamp_epoch": "1583962652.935543000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-4906dac44b74bdf6f27705b0", "type": "domain", "value": "www.googletagmanager.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 368, "frame_number": 25221, "display_filter": "frame.number == 25221", "timestamp_epoch": "1583962655.435607000" }, { "udp_stream": 368, "frame_number": 25227, "display_filter": "frame.number == 25227", "timestamp_epoch": "1583962655.466445000" }, { "udp_stream": 368, "frame_number": 25254, "display_filter": "frame.number == 25254", "timestamp_epoch": "1583962655.506747000" }, { "tcp_stream": 518, "frame_number": 25260, "display_filter": "frame.number == 25260", "timestamp_epoch": "1583962655.526230000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-cdf8bb11ffdda0ce0ac371e6", "type": "domain", "value": "www.googletagservices.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 352, "frame_number": 24058, "display_filter": "frame.number == 24058", "timestamp_epoch": "1583962652.858903000" }, { "udp_stream": 352, "frame_number": 24063, "display_filter": "frame.number == 24063", "timestamp_epoch": "1583962652.890727000" }, { "udp_stream": 352, "frame_number": 24064, "display_filter": "frame.number == 24064", "timestamp_epoch": "1583962652.905894000" }, { "tcp_stream": 499, "frame_number": 24114, "display_filter": "frame.number == 24114", "timestamp_epoch": "1583962652.936184000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-843a66126bea490f84cc9e69", "type": "domain", "value": "www.newegg.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 323, "frame_number": 21179, "display_filter": "frame.number == 21179", "timestamp_epoch": "1583962650.483652000" }, { "udp_stream": 323, "frame_number": 21192, "display_filter": "frame.number == 21192", "timestamp_epoch": "1583962650.514704000" }, { "udp_stream": 323, "frame_number": 21195, "display_filter": "frame.number == 21195", "timestamp_epoch": "1583962650.527591000" }, { "tcp_stream": 469, "frame_number": 21202, "display_filter": "frame.number == 21202", "timestamp_epoch": "1583962650.547673000" }, { "tcp_stream": 470, "frame_number": 21215, "display_filter": "frame.number == 21215", "timestamp_epoch": "1583962650.619185000" } ], "roles": [ "dns-query", "http-host", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0fa85407bdf872ba691e1fe0", "type": "domain", "value": "www.notable-quotes.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 209, "frame_number": 13333, "display_filter": "frame.number == 13333", "timestamp_epoch": "1583962027.448432000" }, { "udp_stream": 209, "frame_number": 13391, "display_filter": "frame.number == 13391", "timestamp_epoch": "1583962027.518423000" }, { "tcp_stream": 352, "frame_number": 13467, "display_filter": "frame.number == 13467", "timestamp_epoch": "1583962027.570033000" }, { "tcp_stream": 353, "frame_number": 13468, "display_filter": "frame.number == 13468", "timestamp_epoch": "1583962027.570077000" }, { "tcp_stream": 355, "frame_number": 13473, "display_filter": "frame.number == 13473", "timestamp_epoch": "1583962027.570585000" }, { "tcp_stream": 354, "frame_number": 13477, "display_filter": "frame.number == 13477", "timestamp_epoch": "1583962027.572340000" } ], "roles": [ "dns-query", "http-host" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-bd6db84d320ff7bc2704ebaa", "type": "domain", "value": "www.tuscaloosabarnyard.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 136, "frame_number": 4338, "display_filter": "frame.number == 4338", "timestamp_epoch": "1583961854.498926000" }, { "udp_stream": 136, "frame_number": 4348, "display_filter": "frame.number == 4348", "timestamp_epoch": "1583961854.572439000" }, { "udp_stream": 326, "frame_number": 21197, "display_filter": "frame.number == 21197", "timestamp_epoch": "1583962650.530170000" }, { "udp_stream": 326, "frame_number": 21207, "display_filter": "frame.number == 21207", "timestamp_epoch": "1583962650.560528000" }, { "udp_stream": 326, "frame_number": 21211, "display_filter": "frame.number == 21211", "timestamp_epoch": "1583962650.607967000" }, { "tcp_stream": 200, "frame_number": 4366, "display_filter": "frame.number == 4366", "timestamp_epoch": "1583961854.645117000" }, { "tcp_stream": 200, "frame_number": 4398, "display_filter": "frame.number == 4398", "timestamp_epoch": "1583961854.770626000" }, { "tcp_stream": 200, "frame_number": 7675, "display_filter": "frame.number == 7675", "timestamp_epoch": "1583961859.573307000" } ], "roles": [ "dns-query", "http-host" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-800538bf25c0941c1eb453f0", "type": "domain", "value": "www2.newegg.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 341, "frame_number": 21520, "display_filter": "frame.number == 21520", "timestamp_epoch": "1583962651.150243000" }, { "udp_stream": 341, "frame_number": 21564, "display_filter": "frame.number == 21564", "timestamp_epoch": "1583962651.182553000" }, { "udp_stream": 341, "frame_number": 21634, "display_filter": "frame.number == 21634", "timestamp_epoch": "1583962651.199027000" }, { "tcp_stream": 490, "frame_number": 21711, "display_filter": "frame.number == 21711", "timestamp_epoch": "1583962651.228233000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-117eb10a51866a3788ab1f48", "type": "domain", "value": "www3.l.google.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 351, "frame_number": 24065, "display_filter": "frame.number == 24065", "timestamp_epoch": "1583962652.905991000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-7f46c44c24a87d120d8303da", "type": "domain", "value": "z.moatads.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 150, "frame_number": 4925, "display_filter": "frame.number == 4925", "timestamp_epoch": "1583961856.052929000" }, { "udp_stream": 150, "frame_number": 5207, "display_filter": "frame.number == 5207", "timestamp_epoch": "1583961856.360480000" }, { "udp_stream": 327, "frame_number": 21206, "display_filter": "frame.number == 21206", "timestamp_epoch": "1583962650.558947000" }, { "udp_stream": 327, "frame_number": 21210, "display_filter": "frame.number == 21210", "timestamp_epoch": "1583962650.589603000" }, { "udp_stream": 327, "frame_number": 21212, "display_filter": "frame.number == 21212", "timestamp_epoch": "1583962650.608017000" }, { "tcp_stream": 230, "frame_number": 5257, "display_filter": "frame.number == 5257", "timestamp_epoch": "1583961856.395511000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2202b35c8996a9198d34f292", "type": "ipv4", "value": "10.3.11.1", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-25a92627e0dfdfedee87dd98", "type": "ipv4", "value": "10.3.11.119", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 104, "frame_number": 3015, "display_filter": "frame.number == 3015", "timestamp_epoch": "1583961815.424012000" }, { "udp_stream": 104, "frame_number": 3016, "display_filter": "frame.number == 3016", "timestamp_epoch": "1583961815.424999000" }, { "udp_stream": 260, "frame_number": 16090, "display_filter": "frame.number == 16090", "timestamp_epoch": "1583962433.391674000" }, { "udp_stream": 260, "frame_number": 16091, "display_filter": "frame.number == 16091", "timestamp_epoch": "1583962433.392824000" }, { "udp_stream": 307, "frame_number": 21071, "display_filter": "frame.number == 21071", "timestamp_epoch": "1583962637.221413000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-8c7fd78400f752fe84f19111", "type": "ipv4", "value": "10.3.11.131", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-45e7be6ae3bf86d13ae4e06f", "type": "ipv4", "value": "10.3.11.194", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 57, "frame_number": 1790, "display_filter": "frame.number == 1790", "timestamp_epoch": "1583961783.985573000" }, { "udp_stream": 57, "frame_number": 1791, "display_filter": "frame.number == 1791", "timestamp_epoch": "1583961783.986755000" }, { "udp_stream": 288, "frame_number": 16354, "display_filter": "frame.number == 16354", "timestamp_epoch": "1583962544.995048000" }, { "udp_stream": 288, "frame_number": 16355, "display_filter": "frame.number == 16355", "timestamp_epoch": "1583962544.995990000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2b97a200053629ca971f1687", "type": "ipv4", "value": "10.3.11.218", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 17, "frame_number": 547, "display_filter": "frame.number == 547", "timestamp_epoch": "1583961758.340596000" }, { "udp_stream": 17, "frame_number": 548, "display_filter": "frame.number == 548", "timestamp_epoch": "1583961758.341657000" }, { "udp_stream": 250, "frame_number": 15661, "display_filter": "frame.number == 15661", "timestamp_epoch": "1583962386.750583000" }, { "udp_stream": 250, "frame_number": 15662, "display_filter": "frame.number == 15662", "timestamp_epoch": "1583962386.751686000" }, { "udp_stream": 306, "frame_number": 21064, "display_filter": "frame.number == 21064", "timestamp_epoch": "1583962637.217396000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-cedba38eb57ecca1b452748b", "type": "ipv4", "value": "10.3.11.254", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-8b13c4331f13211f3aebb4bd", "type": "ipv4", "value": "10.3.11.255", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1c0d865670c404c14bcc2e04", "type": "ipv4", "value": "10.3.11.3", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 1, "frame_number": 4, "display_filter": "frame.number == 4", "timestamp_epoch": "1583961755.129096000" }, { "udp_stream": 6, "frame_number": 97, "display_filter": "frame.number == 97", "timestamp_epoch": "1583961755.517270000" }, { "udp_stream": 8, "frame_number": 216, "display_filter": "frame.number == 216", "timestamp_epoch": "1583961755.709448000" }, { "udp_stream": 10, "frame_number": 269, "display_filter": "frame.number == 269", "timestamp_epoch": "1583961755.887604000" }, { "udp_stream": 13, "frame_number": 320, "display_filter": "frame.number == 320", "timestamp_epoch": "1583961756.220052000" }, { "udp_stream": 16, "frame_number": 546, "display_filter": "frame.number == 546", "timestamp_epoch": "1583961758.338153000" }, { "udp_stream": 18, "frame_number": 550, "display_filter": "frame.number == 550", "timestamp_epoch": "1583961758.356527000" }, { "udp_stream": 33, "frame_number": 1067, "display_filter": "frame.number == 1067", "timestamp_epoch": "1583961779.625644000" }, { "udp_stream": 34, "frame_number": 1069, "display_filter": "frame.number == 1069", "timestamp_epoch": "1583961779.658607000" }, { "udp_stream": 41, "frame_number": 1093, "display_filter": "frame.number == 1093", "timestamp_epoch": "1583961780.815765000" }, { "udp_stream": 45, "frame_number": 1101, "display_filter": "frame.number == 1101", "timestamp_epoch": "1583961781.054298000" }, { "udp_stream": 47, "frame_number": 1252, "display_filter": "frame.number == 1252", "timestamp_epoch": "1583961781.271226000" }, { "udp_stream": 49, "frame_number": 1271, "display_filter": "frame.number == 1271", "timestamp_epoch": "1583961781.422599000" }, { "udp_stream": 52, "frame_number": 1333, "display_filter": "frame.number == 1333", "timestamp_epoch": "1583961781.592936000" }, { "udp_stream": 54, "frame_number": 1379, "display_filter": "frame.number == 1379", "timestamp_epoch": "1583961781.878882000" }, { "udp_stream": 55, "frame_number": 1621, "display_filter": "frame.number == 1621", "timestamp_epoch": "1583961783.464014000" }, { "udp_stream": 56, "frame_number": 1789, "display_filter": "frame.number == 1789", "timestamp_epoch": "1583961783.982972000" }, { "udp_stream": 72, "frame_number": 2131, "display_filter": "frame.number == 2131", "timestamp_epoch": "1583961800.971143000" }, { "udp_stream": 81, "frame_number": 2485, "display_filter": "frame.number == 2485", "timestamp_epoch": "1583961810.892861000" }, { "udp_stream": 82, "frame_number": 2487, "display_filter": "frame.number == 2487", "timestamp_epoch": "1583961810.919308000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c6a52b2cb59bc84f03f15d95", "type": "ipv4", "value": "104.105.248.178", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 320, "frame_number": 21185, "display_filter": "frame.number == 21185", "timestamp_epoch": "1583962650.504416000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-36e9f1ae7e993c5b2c376995", "type": "ipv4", "value": "104.117.242.71", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 335, "frame_number": 21451, "display_filter": "frame.number == 21451", "timestamp_epoch": "1583962651.128381000" }, { "udp_stream": 346, "frame_number": 23655, "display_filter": "frame.number == 23655", "timestamp_epoch": "1583962652.135603000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e67da5ddc7b420515bdd215f", "type": "ipv4", "value": "104.244.42.1", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 157, "frame_number": 6018, "display_filter": "frame.number == 6018", "timestamp_epoch": "1583961857.057731000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-51dd877850ef2335c2ba9b99", "type": "ipv4", "value": "104.244.42.129", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 157, "frame_number": 6018, "display_filter": "frame.number == 6018", "timestamp_epoch": "1583961857.057731000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3abfaf7e6c56d4397213f728", "type": "ipv4", "value": "104.244.42.136", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 161, "frame_number": 7142, "display_filter": "frame.number == 7142", "timestamp_epoch": "1583961857.789491000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3059659c693dae3cfefab1f0", "type": "ipv4", "value": "104.244.42.200", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 161, "frame_number": 7142, "display_filter": "frame.number == 7142", "timestamp_epoch": "1583961857.789491000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-30c984aa70aa0afb021463e6", "type": "ipv4", "value": "104.244.42.72", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 161, "frame_number": 7142, "display_filter": "frame.number == 7142", "timestamp_epoch": "1583961857.789491000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-8490263f7d35ab90f92fe084", "type": "ipv4", "value": "104.244.42.8", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 161, "frame_number": 7142, "display_filter": "frame.number == 7142", "timestamp_epoch": "1583961857.789491000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-6416a8040e396afc73fdf5fd", "type": "ipv4", "value": "104.254.148.133", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 391, "frame_number": 26083, "display_filter": "frame.number == 26083", "timestamp_epoch": "1583962657.125928000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-fd59a109bebd5b234e70001e", "type": "ipv4", "value": "104.254.148.165", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 391, "frame_number": 26083, "display_filter": "frame.number == 26083", "timestamp_epoch": "1583962657.125928000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d8a6229aebef63b05b453892", "type": "ipv4", "value": "104.254.148.166", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 391, "frame_number": 26083, "display_filter": "frame.number == 26083", "timestamp_epoch": "1583962657.125928000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-51bf82e132088bdea7b04313", "type": "ipv4", "value": "104.254.148.196", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 391, "frame_number": 26083, "display_filter": "frame.number == 26083", "timestamp_epoch": "1583962657.125928000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-789a3ba9d8709338d08c3609", "type": "ipv4", "value": "104.254.149.100", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 391, "frame_number": 26083, "display_filter": "frame.number == 26083", "timestamp_epoch": "1583962657.125928000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-321c9a4f014e8807fd65b6bc", "type": "ipv4", "value": "104.254.149.101", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 391, "frame_number": 26083, "display_filter": "frame.number == 26083", "timestamp_epoch": "1583962657.125928000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-68be57a33d1522039d6ea728", "type": "ipv4", "value": "104.254.149.68", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 391, "frame_number": 26083, "display_filter": "frame.number == 26083", "timestamp_epoch": "1583962657.125928000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-852a15c86ac38173fb6183a1", "type": "ipv4", "value": "104.254.149.69", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 391, "frame_number": 26083, "display_filter": "frame.number == 26083", "timestamp_epoch": "1583962657.125928000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-411957f7527145803efdc67c", "type": "ipv4", "value": "104.26.8.32", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 143, "frame_number": 4438, "display_filter": "frame.number == 4438", "timestamp_epoch": "1583961854.840055000" }, { "udp_stream": 314, "frame_number": 21145, "display_filter": "frame.number == 21145", "timestamp_epoch": "1583962650.385341000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-7ec5efbd5609d5343b79c92d", "type": "ipv4", "value": "104.26.9.32", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 143, "frame_number": 4438, "display_filter": "frame.number == 4438", "timestamp_epoch": "1583961854.840055000" }, { "udp_stream": 314, "frame_number": 21145, "display_filter": "frame.number == 21145", "timestamp_epoch": "1583962650.385341000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-24af5f6a130979ccd202aa15", "type": "ipv4", "value": "104.36.113.17", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 397, "frame_number": 26254, "display_filter": "frame.number == 26254", "timestamp_epoch": "1583962657.367426000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-9e5b0215393d67153dfbea31", "type": "ipv4", "value": "111.221.29.40", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 237, "frame_number": 15315, "display_filter": "frame.number == 15315", "timestamp_epoch": "1583962360.863226000" }, { "udp_stream": 252, "frame_number": 15726, "display_filter": "frame.number == 15726", "timestamp_epoch": "1583962387.327849000" }, { "udp_stream": 257, "frame_number": 16028, "display_filter": "frame.number == 16028", "timestamp_epoch": "1583962418.344091000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ec08a15d131ea1fe9a94eab4", "type": "ipv4", "value": "13.107.136.254", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 127, "frame_number": 4058, "display_filter": "frame.number == 4058", "timestamp_epoch": "1583961837.190570000" }, { "udp_stream": 206, "frame_number": 12907, "display_filter": "frame.number == 12907", "timestamp_epoch": "1583962015.867946000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-31cdd3ccef2af17576e6d6cf", "type": "ipv4", "value": "13.107.18.254", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 63, "frame_number": 1860, "display_filter": "frame.number == 1860", "timestamp_epoch": "1583961789.191783000" }, { "udp_stream": 125, "frame_number": 4047, "display_filter": "frame.number == 4047", "timestamp_epoch": "1583961837.170614000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b4c71312c189a38661999891", "type": "ipv4", "value": "13.107.21.200", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 59, "frame_number": 1802, "display_filter": "frame.number == 1802", "timestamp_epoch": "1583961788.662452000" }, { "udp_stream": 73, "frame_number": 2281, "display_filter": "frame.number == 2281", "timestamp_epoch": "1583961806.049603000" }, { "udp_stream": 122, "frame_number": 3980, "display_filter": "frame.number == 3980", "timestamp_epoch": "1583961832.907313000" }, { "udp_stream": 124, "frame_number": 4038, "display_filter": "frame.number == 4038", "timestamp_epoch": "1583961837.107859000" }, { "udp_stream": 130, "frame_number": 4257, "display_filter": "frame.number == 4257", "timestamp_epoch": "1583961848.562517000" }, { "udp_stream": 200, "frame_number": 12478, "display_filter": "frame.number == 12478", "timestamp_epoch": "1583962013.872576000" }, { "udp_stream": 212, "frame_number": 14092, "display_filter": "frame.number == 14092", "timestamp_epoch": "1583962054.684480000" }, { "udp_stream": 294, "frame_number": 16489, "display_filter": "frame.number == 16489", "timestamp_epoch": "1583962547.149148000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-05bc871ccb71bda96018ef8b", "type": "ipv4", "value": "13.107.246.10", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 64, "frame_number": 1867, "display_filter": "frame.number == 1867", "timestamp_epoch": "1583961789.224967000" }, { "udp_stream": 197, "frame_number": 12412, "display_filter": "frame.number == 12412", "timestamp_epoch": "1583961995.556452000" }, { "udp_stream": 225, "frame_number": 14744, "display_filter": "frame.number == 14744", "timestamp_epoch": "1583962291.265084000" }, { "udp_stream": 227, "frame_number": 14919, "display_filter": "frame.number == 14919", "timestamp_epoch": "1583962319.940114000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e64f15836857d9c0b5a0a3f1", "type": "ipv4", "value": "13.107.246.254", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 76, "frame_number": 2329, "display_filter": "frame.number == 2329", "timestamp_epoch": "1583961806.431111000" }, { "udp_stream": 79, "frame_number": 2339, "display_filter": "frame.number == 2339", "timestamp_epoch": "1583961806.506259000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a456ee5d88ec997da66cd4ca", "type": "ipv4", "value": "13.107.3.128", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 137, "frame_number": 4342, "display_filter": "frame.number == 4342", "timestamp_epoch": "1583961854.516637000" }, { "udp_stream": 406, "frame_number": 26795, "display_filter": "frame.number == 26795", "timestamp_epoch": "1583962685.586418000" }, { "udp_stream": 407, "frame_number": 27314, "display_filter": "frame.number == 27314", "timestamp_epoch": "1583962732.810552000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-fff0a3b3eda31053cc4098dd", "type": "ipv4", "value": "13.107.3.254", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 75, "frame_number": 2328, "display_filter": "frame.number == 2328", "timestamp_epoch": "1583961806.430849000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c312f62fafbb7e01bc482e8c", "type": "ipv4", "value": "13.107.42.254", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 74, "frame_number": 2295, "display_filter": "frame.number == 2295", "timestamp_epoch": "1583961806.240830000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-659efd51ebdf92fc9a9184ca", "type": "ipv4", "value": "13.107.43.14", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 78, "frame_number": 2340, "display_filter": "frame.number == 2340", "timestamp_epoch": "1583961806.507845000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-10e7923a06108052cf5c1168", "type": "ipv4", "value": "13.107.5.80", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 199, "frame_number": 12477, "display_filter": "frame.number == 12477", "timestamp_epoch": "1583962013.872494000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ddf24a77201a6d91ff08c01c", "type": "ipv4", "value": "13.107.6.158", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 186, "frame_number": 10212, "display_filter": "frame.number == 10212", "timestamp_epoch": "1583961911.739107000" }, { "udp_stream": 349, "frame_number": 23849, "display_filter": "frame.number == 23849", "timestamp_epoch": "1583962652.620832000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-7bdcaa3b4479d338df9e9de6", "type": "ipv4", "value": "13.107.6.254", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 77, "frame_number": 2336, "display_filter": "frame.number == 2336", "timestamp_epoch": "1583961806.493595000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-aa6a09d76eb1825962f6bdb4", "type": "ipv4", "value": "13.249.26.114", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 152, "frame_number": 5064, "display_filter": "frame.number == 5064", "timestamp_epoch": "1583961856.184965000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2aa19fcf1636a414de489b1a", "type": "ipv4", "value": "13.249.26.125", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 152, "frame_number": 5064, "display_filter": "frame.number == 5064", "timestamp_epoch": "1583961856.184965000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-42d1137d0bbbd812d2bb7e0e", "type": "ipv4", "value": "13.249.26.87", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 152, "frame_number": 5064, "display_filter": "frame.number == 5064", "timestamp_epoch": "1583961856.184965000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-75a562a0df4a1f4e6e45c591", "type": "ipv4", "value": "13.249.26.99", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 152, "frame_number": 5064, "display_filter": "frame.number == 5064", "timestamp_epoch": "1583961856.184965000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-9713bd037b3e777fa06eaa41", "type": "ipv4", "value": "13.68.93.109", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 191, "frame_number": 10456, "display_filter": "frame.number == 10456", "timestamp_epoch": "1583961954.783018000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-274fe42150261fb2bd34ecb6", "type": "ipv4", "value": "13.78.168.230", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 243, "frame_number": 15551, "display_filter": "frame.number == 15551", "timestamp_epoch": "1583962385.535429000" }, { "udp_stream": 411, "frame_number": 27538, "display_filter": "frame.number == 27538", "timestamp_epoch": "1583962904.881940000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d366901c404d8b0bd0229999", "type": "ipv4", "value": "13.78.177.144", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 26, "frame_number": 863, "display_filter": "frame.number == 863", "timestamp_epoch": "1583961760.453103000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c3dd7b6348ad7e3e6c72c99a", "type": "ipv4", "value": "13.78.186.254", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 115, "frame_number": 3512, "display_filter": "frame.number == 3512", "timestamp_epoch": "1583961818.499999000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-376d367b631b2f32abbf0f9b", "type": "ipv4", "value": "13.78.187.58", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 114, "frame_number": 3304, "display_filter": "frame.number == 3304", "timestamp_epoch": "1583961817.728584000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d58477261d6d0fc1bc722fcb", "type": "ipv4", "value": "130.211.21.54", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 330, "frame_number": 26006, "display_filter": "frame.number == 26006", "timestamp_epoch": "1583962656.958202000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-6d3b87783a9afefa9cd3d744", "type": "ipv4", "value": "130.211.28.134", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 396, "frame_number": 26217, "display_filter": "frame.number == 26217", "timestamp_epoch": "1583962657.348534000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-90d7a5a6cf040f7b1c6007d8", "type": "ipv4", "value": "131.107.255.255", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 36, "frame_number": 1080, "display_filter": "frame.number == 1080", "timestamp_epoch": "1583961779.950820000" }, { "udp_stream": 84, "frame_number": 2498, "display_filter": "frame.number == 2498", "timestamp_epoch": "1583961811.185698000" }, { "udp_stream": 220, "frame_number": 14615, "display_filter": "frame.number == 14615", "timestamp_epoch": "1583962215.989692000" }, { "udp_stream": 223, "frame_number": 14725, "display_filter": "frame.number == 14725", "timestamp_epoch": "1583962275.929534000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ad15654e216295edc1285484", "type": "ipv4", "value": "139.178.81.9", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 382, "frame_number": 25928, "display_filter": "frame.number == 25928", "timestamp_epoch": "1583962656.834296000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-8d7fb50f55724027f07675a4", "type": "ipv4", "value": "151.101.50.208", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 159, "frame_number": 6020, "display_filter": "frame.number == 6020", "timestamp_epoch": "1583961857.068008000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-9cd1b3f3869eac56b33b670d", "type": "ipv4", "value": "152.199.4.210", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 332, "frame_number": 21318, "display_filter": "frame.number == 21318", "timestamp_epoch": "1583962650.986719000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c7a59f11ef09f9113e0ec20a", "type": "ipv4", "value": "152.199.4.33", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 204, "frame_number": 12660, "display_filter": "frame.number == 12660", "timestamp_epoch": "1583962015.538643000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2d07f626fad39f61b49ff75d", "type": "ipv4", "value": "169.46.74.216", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 399, "frame_number": 26433, "display_filter": "frame.number == 26433", "timestamp_epoch": "1583962658.985207000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-5b340e9a3d8aa5c39329a78c", "type": "ipv4", "value": "169.60.140.161", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 400, "frame_number": 26616, "display_filter": "frame.number == 26616", "timestamp_epoch": "1583962663.610644000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f051f4dfd60028bb163b950c", "type": "ipv4", "value": "169.60.153.61", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 366, "frame_number": 25242, "display_filter": "frame.number == 25242", "timestamp_epoch": "1583962655.496520000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b87cb72216b371c26b5c0da1", "type": "ipv4", "value": "172.217.1.142", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 364, "frame_number": 25130, "display_filter": "frame.number == 25130", "timestamp_epoch": "1583962655.290011000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-831c4d1e0b6a83739a82d759", "type": "ipv4", "value": "172.217.12.74", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 210, "frame_number": 13828, "display_filter": "frame.number == 13828", "timestamp_epoch": "1583962031.453069000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-fa0f562b4d04b09df36ac0a1", "type": "ipv4", "value": "172.217.12.84", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 367, "frame_number": 25243, "display_filter": "frame.number == 25243", "timestamp_epoch": "1583962655.496736000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-922357e7d3bd940d05bc0e92", "type": "ipv4", "value": "172.217.14.161", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 358, "frame_number": 24531, "display_filter": "frame.number == 24531", "timestamp_epoch": "1583962654.503997000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3dc72f35bd15c85802d449d6", "type": "ipv4", "value": "172.217.14.162", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 352, "frame_number": 24064, "display_filter": "frame.number == 24064", "timestamp_epoch": "1583962652.905894000" }, { "udp_stream": 354, "frame_number": 24232, "display_filter": "frame.number == 24232", "timestamp_epoch": "1583962653.141217000" }, { "udp_stream": 372, "frame_number": 25283, "display_filter": "frame.number == 25283", "timestamp_epoch": "1583962655.597916000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c70aa6a092966081ebb475d1", "type": "ipv4", "value": "172.217.2.226", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 365, "frame_number": 25148, "display_filter": "frame.number == 25148", "timestamp_epoch": "1583962655.347719000" }, { "udp_stream": 392, "frame_number": 26090, "display_filter": "frame.number == 26090", "timestamp_epoch": "1583962657.131301000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-29ccda1ba053fe1cafe485b6", "type": "ipv4", "value": "172.217.6.142", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 356, "frame_number": 24523, "display_filter": "frame.number == 24523", "timestamp_epoch": "1583962654.493084000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0be7da622b6dd9e75e9ea518", "type": "ipv4", "value": "172.217.6.144", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 208, "frame_number": 13334, "display_filter": "frame.number == 13334", "timestamp_epoch": "1583962027.473726000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-82ecd561f7fba943cfe05476", "type": "ipv4", "value": "172.217.6.174", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 351, "frame_number": 24065, "display_filter": "frame.number == 24065", "timestamp_epoch": "1583962652.905991000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ca80ac7475fb0e14ea6d31cd", "type": "ipv4", "value": "172.217.9.4", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 353, "frame_number": 24231, "display_filter": "frame.number == 24231", "timestamp_epoch": "1583962653.141149000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a5f3c1c25d5efd7b0275d41d", "type": "ipv4", "value": "172.245.249.117", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-4554ae5028b623efed8e5112", "type": "ipv4", "value": "173.194.223.154", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 361, "frame_number": 24784, "display_filter": "frame.number == 24784", "timestamp_epoch": "1583962654.705612000" }, { "udp_stream": 371, "frame_number": 25284, "display_filter": "frame.number == 25284", "timestamp_epoch": "1583962655.597976000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c8fca9d0eddefb6ff7bcce5f", "type": "ipv4", "value": "173.194.223.155", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 361, "frame_number": 24784, "display_filter": "frame.number == 24784", "timestamp_epoch": "1583962654.705612000" }, { "udp_stream": 371, "frame_number": 25284, "display_filter": "frame.number == 25284", "timestamp_epoch": "1583962655.597976000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-da0f75ae33bcc1227da6dd6d", "type": "ipv4", "value": "173.194.223.156", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 361, "frame_number": 24784, "display_filter": "frame.number == 24784", "timestamp_epoch": "1583962654.705612000" }, { "udp_stream": 371, "frame_number": 25284, "display_filter": "frame.number == 25284", "timestamp_epoch": "1583962655.597976000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f3cbf61c2082e45f918ccd00", "type": "ipv4", "value": "173.194.223.157", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 361, "frame_number": 24784, "display_filter": "frame.number == 24784", "timestamp_epoch": "1583962654.705612000" }, { "udp_stream": 371, "frame_number": 25284, "display_filter": "frame.number == 25284", "timestamp_epoch": "1583962655.597976000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a2e9313785f4fbb251591d7b", "type": "ipv4", "value": "18.204.46.201", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 386, "frame_number": 26010, "display_filter": "frame.number == 26010", "timestamp_epoch": "1583962656.960973000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-58ae84053c3fc941451613f4", "type": "ipv4", "value": "18.208.78.141", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 386, "frame_number": 26010, "display_filter": "frame.number == 26010", "timestamp_epoch": "1583962656.960973000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-4a83e6a62f06198f8c5dbd91", "type": "ipv4", "value": "18.211.91.10", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 389, "frame_number": 26098, "display_filter": "frame.number == 26098", "timestamp_epoch": "1583962657.137080000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-5d9c8495b8bb1108e3b3062f", "type": "ipv4", "value": "18.213.117.209", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 386, "frame_number": 26010, "display_filter": "frame.number == 26010", "timestamp_epoch": "1583962656.960973000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-297cab48e03c404da9ce77e7", "type": "ipv4", "value": "18.214.132.216", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 228, "frame_number": 14974, "display_filter": "frame.number == 14974", "timestamp_epoch": "1583962320.197469000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-476948b12c8e07674f72cd97", "type": "ipv4", "value": "18.232.32.205", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 385, "frame_number": 26007, "display_filter": "frame.number == 26007", "timestamp_epoch": "1583962656.958475000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f50a516368eb9fbdccbf39ba", "type": "ipv4", "value": "18.233.90.151", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 228, "frame_number": 14974, "display_filter": "frame.number == 14974", "timestamp_epoch": "1583962320.197469000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-cf758b2a38e275fd34c82089", "type": "ipv4", "value": "18.235.112.207", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 228, "frame_number": 14974, "display_filter": "frame.number == 14974", "timestamp_epoch": "1583962320.197469000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ebfad4e3a16bbd3bc46aea76", "type": "ipv4", "value": "185.14.31.98", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c8a090c852f0d9adbf4eab1c", "type": "ipv4", "value": "185.141.27.238", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2b5f81c2541070def26ad339", "type": "ipv4", "value": "185.180.198.50", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-399350cd25cfc81f0854faf9", "type": "ipv4", "value": "190.214.13.2", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-dad0ed97c020ca8b7214bf7b", "type": "ipv4", "value": "192.243.232.58", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 350, "frame_number": 23890, "display_filter": "frame.number == 23890", "timestamp_epoch": "1583962652.656673000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-09ee1310276d4651cd54c178", "type": "ipv4", "value": "195.123.242.48", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-42dad44edf1f21b60ba08345", "type": "ipv4", "value": "198.23.252.130", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d5ffc2d7e1823d05d44101b5", "type": "ipv4", "value": "198.23.252.135", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-fe361e0ba2a45b6b0b82a3dd", "type": "ipv4", "value": "199.187.193.166", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 394, "frame_number": 26180, "display_filter": "frame.number == 26180", "timestamp_epoch": "1583962657.266607000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-02b263d892a37f177516df64", "type": "ipv4", "value": "199.247.13.144", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 412, "frame_number": 27775, "display_filter": "frame.number == 27775", "timestamp_epoch": "1583963020.430853000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-63adcd67d00991ece5ea0213", "type": "ipv4", "value": "20.44.86.43", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 405, "frame_number": 26766, "display_filter": "frame.number == 26766", "timestamp_epoch": "1583962684.331866000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-db313399ad53bc3a475fd5a1", "type": "ipv4", "value": "203.176.135.102", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:08.764583+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:08.760654+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 448, "frame_number": 19116, "display_filter": "frame.number == 19116", "timestamp_epoch": "1583962613.434697000" }, { "tcp_stream": 449, "frame_number": 19547, "display_filter": "frame.number == 19547", "timestamp_epoch": "1583962615.812536000" }, { "tcp_stream": 459, "frame_number": 20660, "display_filter": "frame.number == 20660", "timestamp_epoch": "1583962620.007347000" }, { "tcp_stream": 465, "frame_number": 21096, "display_filter": "frame.number == 21096", "timestamp_epoch": "1583962639.795666000" }, { "tcp_stream": 555, "frame_number": 26673, "display_filter": "frame.number == 26673", "timestamp_epoch": "1583962672.861852000" } ], "roles": [ "http-host", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:08.755815+00:00" }, { "observable_id": "observable-27f8fb39289e5e8b76956388", "type": "ipv4", "value": "204.79.197.200", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 59, "frame_number": 1802, "display_filter": "frame.number == 1802", "timestamp_epoch": "1583961788.662452000" }, { "udp_stream": 73, "frame_number": 2281, "display_filter": "frame.number == 2281", "timestamp_epoch": "1583961806.049603000" }, { "udp_stream": 122, "frame_number": 3980, "display_filter": "frame.number == 3980", "timestamp_epoch": "1583961832.907313000" }, { "udp_stream": 124, "frame_number": 4038, "display_filter": "frame.number == 4038", "timestamp_epoch": "1583961837.107859000" }, { "udp_stream": 130, "frame_number": 4257, "display_filter": "frame.number == 4257", "timestamp_epoch": "1583961848.562517000" }, { "udp_stream": 200, "frame_number": 12478, "display_filter": "frame.number == 12478", "timestamp_epoch": "1583962013.872576000" }, { "udp_stream": 212, "frame_number": 14092, "display_filter": "frame.number == 14092", "timestamp_epoch": "1583962054.684480000" }, { "udp_stream": 294, "frame_number": 16489, "display_filter": "frame.number == 16489", "timestamp_epoch": "1583962547.149148000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f473027743f35dffb42a329b", "type": "ipv4", "value": "204.79.197.222", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 65, "frame_number": 1888, "display_filter": "frame.number == 1888", "timestamp_epoch": "1583961789.266116000" }, { "udp_stream": 198, "frame_number": 12452, "display_filter": "frame.number == 12452", "timestamp_epoch": "1583962012.938150000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ef67f826d9abcfb82cc8ae33", "type": "ipv4", "value": "204.79.197.254", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 62, "frame_number": 1838, "display_filter": "frame.number == 1838", "timestamp_epoch": "1583961789.154954000" }, { "udp_stream": 203, "frame_number": 12625, "display_filter": "frame.number == 12625", "timestamp_epoch": "1583962015.260881000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-fba1b1437d3caa5fa48917b9", "type": "ipv4", "value": "205.185.216.10", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 408, "frame_number": 27387, "display_filter": "frame.number == 27387", "timestamp_epoch": "1583962744.515705000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-9b5f9bcf8293d228e1ab3e65", "type": "ipv4", "value": "205.185.216.42", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 408, "frame_number": 27387, "display_filter": "frame.number == 27387", "timestamp_epoch": "1583962744.515705000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e137a2ff68f8534bde63dc87", "type": "ipv4", "value": "209.97.130.197", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 413, "frame_number": 28321, "display_filter": "frame.number == 28321", "timestamp_epoch": "1583963031.223332000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d3f1e1ad26d17224be7af003", "type": "ipv4", "value": "216.58.193.142", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 158, "frame_number": 6019, "display_filter": "frame.number == 6019", "timestamp_epoch": "1583961857.067951000" }, { "udp_stream": 359, "frame_number": 24672, "display_filter": "frame.number == 24672", "timestamp_epoch": "1583962654.604448000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-5d8444509d39cca0b550cbe9", "type": "ipv4", "value": "216.58.194.104", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 368, "frame_number": 25254, "display_filter": "frame.number == 25254", "timestamp_epoch": "1583962655.506747000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a37fc2e3ec141d80c085b051", "type": "ipv4", "value": "216.58.194.112", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 374, "frame_number": 25499, "display_filter": "frame.number == 25499", "timestamp_epoch": "1583962655.863798000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-826c5434665ddd7c40c4ddde", "type": "ipv4", "value": "216.58.194.131", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 139, "frame_number": 4391, "display_filter": "frame.number == 4391", "timestamp_epoch": "1583961854.757824000" }, { "udp_stream": 316, "frame_number": 21142, "display_filter": "frame.number == 21142", "timestamp_epoch": "1583962650.383619000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-687793b86252a694dab3e57e", "type": "ipv4", "value": "216.58.194.42", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 138, "frame_number": 4390, "display_filter": "frame.number == 4390", "timestamp_epoch": "1583961854.757736000" }, { "udp_stream": 315, "frame_number": 21139, "display_filter": "frame.number == 21139", "timestamp_epoch": "1583962650.374617000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-73cfde24895a6d9741e9a4a9", "type": "ipv4", "value": "216.58.194.98", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 355, "frame_number": 24226, "display_filter": "frame.number == 24226", "timestamp_epoch": "1583962653.139608000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-fd392ca8a177c7f78c2e0105", "type": "ipv4", "value": "224.0.0.22", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a41b707ef9489fcd32e029d1", "type": "ipv4", "value": "224.0.0.251", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-9b93ccd8fc1fbfc88735e682", "type": "ipv4", "value": "224.0.0.252", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d7f2d64503b9ab8642c8f76a", "type": "ipv4", "value": "23.199.252.214", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 308, "frame_number": 21133, "display_filter": "frame.number == 21133", "timestamp_epoch": "1583962650.349973000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-bd58aa91bb2bc03f14e0e413", "type": "ipv4", "value": "23.199.253.242", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 327, "frame_number": 21212, "display_filter": "frame.number == 21212", "timestamp_epoch": "1583962650.608017000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a2c59f7f0de7a8f9f92f257f", "type": "ipv4", "value": "23.199.253.39", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 328, "frame_number": 21288, "display_filter": "frame.number == 21288", "timestamp_epoch": "1583962650.943602000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e160e6c02dd6188778118f94", "type": "ipv4", "value": "23.199.253.53", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 393, "frame_number": 26147, "display_filter": "frame.number == 26147", "timestamp_epoch": "1583962657.208179000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2980e7cb539777b049b3b28d", "type": "ipv4", "value": "23.204.16.227", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 338, "frame_number": 21482, "display_filter": "frame.number == 21482", "timestamp_epoch": "1583962651.129952000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-216321716ed926a1cfdeb6cf", "type": "ipv4", "value": "23.204.68.230", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 149, "frame_number": 4886, "display_filter": "frame.number == 4886", "timestamp_epoch": "1583961855.968427000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-82d8532e27e9e19e129f0bb5", "type": "ipv4", "value": "23.206.208.173", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 168, "frame_number": 7613, "display_filter": "frame.number == 7613", "timestamp_epoch": "1583961859.233927000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-57bc2242caeb746ad8335346", "type": "ipv4", "value": "23.206.213.111", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 244, "frame_number": 15571, "display_filter": "frame.number == 15571", "timestamp_epoch": "1583962385.663937000" }, { "udp_stream": 295, "frame_number": 16524, "display_filter": "frame.number == 16524", "timestamp_epoch": "1583962549.023492000" }, { "udp_stream": 410, "frame_number": 27478, "display_filter": "frame.number == 27478", "timestamp_epoch": "1583962861.371315000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-cb80e882345115fb814bf57a", "type": "ipv4", "value": "23.209.74.120", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:07.632683+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:07.628746+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 141, "frame_number": 4426, "display_filter": "frame.number == 4426", "timestamp_epoch": "1583961854.810288000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:07.624257+00:00" }, { "observable_id": "observable-08e6bd1fc40023076fe11df5", "type": "ipv4", "value": "23.211.18.27", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:07.888230+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:07.884029+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 140, "frame_number": 4396, "display_filter": "frame.number == 4396", "timestamp_epoch": "1583961854.766530000" }, { "udp_stream": 142, "frame_number": 4416, "display_filter": "frame.number == 4416", "timestamp_epoch": "1583961854.797966000" }, { "udp_stream": 144, "frame_number": 4446, "display_filter": "frame.number == 4446", "timestamp_epoch": "1583961854.845638000" }, { "udp_stream": 318, "frame_number": 21159, "display_filter": "frame.number == 21159", "timestamp_epoch": "1583962650.459214000" }, { "udp_stream": 317, "frame_number": 21160, "display_filter": "frame.number == 21160", "timestamp_epoch": "1583962650.459266000" }, { "udp_stream": 319, "frame_number": 21161, "display_filter": "frame.number == 21161", "timestamp_epoch": "1583962650.459342000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:07.879501+00:00" }, { "observable_id": "observable-6560a94d4976b88c50180504", "type": "ipv4", "value": "23.211.36.128", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 201, "frame_number": 12480, "display_filter": "frame.number == 12480", "timestamp_epoch": "1583962014.002923000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-72b146600cd0835f5cf885e2", "type": "ipv4", "value": "23.4.97.247", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 21, "frame_number": 604, "display_filter": "frame.number == 604", "timestamp_epoch": "1583961758.615654000" }, { "udp_stream": 22, "frame_number": 657, "display_filter": "frame.number == 657", "timestamp_epoch": "1583961759.040026000" }, { "udp_stream": 24, "frame_number": 683, "display_filter": "frame.number == 683", "timestamp_epoch": "1583961759.326791000" }, { "udp_stream": 108, "frame_number": 3116, "display_filter": "frame.number == 3116", "timestamp_epoch": "1583961816.043339000" }, { "udp_stream": 111, "frame_number": 3163, "display_filter": "frame.number == 3163", "timestamp_epoch": "1583961817.238134000" }, { "udp_stream": 112, "frame_number": 3187, "display_filter": "frame.number == 3187", "timestamp_epoch": "1583961817.390606000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-32771c3698ea070ca2f35b6b", "type": "ipv4", "value": "23.44.170.27", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 150, "frame_number": 5207, "display_filter": "frame.number == 5207", "timestamp_epoch": "1583961856.360480000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e362901d03b4c8815cce34ba", "type": "ipv4", "value": "23.46.28.16", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 61, "frame_number": 1820, "display_filter": "frame.number == 1820", "timestamp_epoch": "1583961789.088257000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-51bba2a7439ce055061b555a", "type": "ipv4", "value": "23.46.28.24", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 61, "frame_number": 1820, "display_filter": "frame.number == 1820", "timestamp_epoch": "1583961789.088257000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-5520df03d2f3af7d51f09a7f", "type": "ipv4", "value": "23.63.253.147", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 342, "frame_number": 21898, "display_filter": "frame.number == 21898", "timestamp_epoch": "1583962651.368700000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-52fa104453d0239b31560014", "type": "ipv4", "value": "23.63.253.208", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 342, "frame_number": 21898, "display_filter": "frame.number == 21898", "timestamp_epoch": "1583962651.368700000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-10350461dc8dfff09bbe6ab7", "type": "ipv4", "value": "239.255.255.250", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "frame_number": 516, "display_filter": "frame.number == 516", "timestamp_epoch": "1583961757.053472000" }, { "frame_number": 518, "display_filter": "frame.number == 518", "timestamp_epoch": "1583961757.141829000" }, { "frame_number": 521, "display_filter": "frame.number == 521", "timestamp_epoch": "1583961757.317110000" }, { "frame_number": 522, "display_filter": "frame.number == 522", "timestamp_epoch": "1583961757.339046000" }, { "frame_number": 523, "display_filter": "frame.number == 523", "timestamp_epoch": "1583961757.467307000" }, { "frame_number": 806, "display_filter": "frame.number == 806", "timestamp_epoch": "1583961760.039998000" }, { "frame_number": 827, "display_filter": "frame.number == 827", "timestamp_epoch": "1583961760.150356000" }, { "frame_number": 832, "display_filter": "frame.number == 832", "timestamp_epoch": "1583961760.353574000" }, { "frame_number": 851, "display_filter": "frame.number == 851", "timestamp_epoch": "1583961760.385437000" }, { "frame_number": 865, "display_filter": "frame.number == 865", "timestamp_epoch": "1583961760.462907000" }, { "frame_number": 936, "display_filter": "frame.number == 936", "timestamp_epoch": "1583961763.041172000" }, { "frame_number": 937, "display_filter": "frame.number == 937", "timestamp_epoch": "1583961763.150914000" }, { "frame_number": 938, "display_filter": "frame.number == 938", "timestamp_epoch": "1583961763.478458000" }, { "frame_number": 1018, "display_filter": "frame.number == 1018", "timestamp_epoch": "1583961766.496768000" }, { "frame_number": 1047, "display_filter": "frame.number == 1047", "timestamp_epoch": "1583961769.510883000" }, { "frame_number": 1048, "display_filter": "frame.number == 1048", "timestamp_epoch": "1583961772.526214000" }, { "frame_number": 4311, "display_filter": "frame.number == 4311", "timestamp_epoch": "1583961851.807484000" }, { "frame_number": 4314, "display_filter": "frame.number == 4314", "timestamp_epoch": "1583961852.809426000" }, { "frame_number": 4331, "display_filter": "frame.number == 4331", "timestamp_epoch": "1583961853.810540000" }, { "frame_number": 4427, "display_filter": "frame.number == 4427", "timestamp_epoch": "1583961854.810945000" } ], "roles": [ "http-host", "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3890ed97741d35f640d54fc9", "type": "ipv4", "value": "3.208.14.195", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 336, "frame_number": 21384, "display_filter": "frame.number == 21384", "timestamp_epoch": "1583962651.092080000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-52f7a99c324d9d1140ba7273", "type": "ipv4", "value": "3.211.188.196", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 389, "frame_number": 26098, "display_filter": "frame.number == 26098", "timestamp_epoch": "1583962657.137080000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-696e903634b226656eb5ad02", "type": "ipv4", "value": "3.212.136.177", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 385, "frame_number": 26007, "display_filter": "frame.number == 26007", "timestamp_epoch": "1583962656.958475000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-db715eb129e1f507cd974269", "type": "ipv4", "value": "3.213.24.71", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 389, "frame_number": 26098, "display_filter": "frame.number == 26098", "timestamp_epoch": "1583962657.137080000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f26568356b674b79cfd613d2", "type": "ipv4", "value": "3.215.9.190", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 389, "frame_number": 26098, "display_filter": "frame.number == 26098", "timestamp_epoch": "1583962657.137080000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-6e50015a679511870409877a", "type": "ipv4", "value": "3.217.52.69", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 389, "frame_number": 26098, "display_filter": "frame.number == 26098", "timestamp_epoch": "1583962657.137080000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-6a13837642f3c983d7af03d6", "type": "ipv4", "value": "3.218.90.66", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 398, "frame_number": 26392, "display_filter": "frame.number == 26392", "timestamp_epoch": "1583962657.788154000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-8df7c6a4f4f3cf997506b8f7", "type": "ipv4", "value": "3.219.244.74", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 336, "frame_number": 21384, "display_filter": "frame.number == 21384", "timestamp_epoch": "1583962651.092080000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-026938190305caa827f2ed60", "type": "ipv4", "value": "3.224.145.145", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 228, "frame_number": 14974, "display_filter": "frame.number == 14974", "timestamp_epoch": "1583962320.197469000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-6da8882db38ffa12d257532e", "type": "ipv4", "value": "3.225.102.19", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 385, "frame_number": 26007, "display_filter": "frame.number == 26007", "timestamp_epoch": "1583962656.958475000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-24bfc7f5cd9a1f06bdc1c47f", "type": "ipv4", "value": "3.92.109.57", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 386, "frame_number": 26010, "display_filter": "frame.number == 26010", "timestamp_epoch": "1583962656.960973000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-797b009776fca2932a7735a1", "type": "ipv4", "value": "31.13.65.36", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 325, "frame_number": 21205, "display_filter": "frame.number == 21205", "timestamp_epoch": "1583962650.557596000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f7d0ff3f49b6d489bd11f0f1", "type": "ipv4", "value": "31.13.65.7", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 155, "frame_number": 5989, "display_filter": "frame.number == 5989", "timestamp_epoch": "1583961856.974342000" }, { "udp_stream": 310, "frame_number": 21130, "display_filter": "frame.number == 21130", "timestamp_epoch": "1583962650.341046000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-276855856ffbad3229628263", "type": "ipv4", "value": "31.13.93.35", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 154, "frame_number": 5984, "display_filter": "frame.number == 5984", "timestamp_epoch": "1583961856.929561000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c12cbb48c141ca26f2e85832", "type": "ipv4", "value": "34.102.147.248", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 369, "frame_number": 25241, "display_filter": "frame.number == 25241", "timestamp_epoch": "1583962655.496450000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1fe87e109f924fcc0e8b25b5", "type": "ipv4", "value": "34.192.244.88", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 386, "frame_number": 26010, "display_filter": "frame.number == 26010", "timestamp_epoch": "1583962656.960973000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-815cfa137ef572df9feedf21", "type": "ipv4", "value": "34.192.250.175", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 228, "frame_number": 14974, "display_filter": "frame.number == 14974", "timestamp_epoch": "1583962320.197469000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-fefdbc9d21ff21ac122363ea", "type": "ipv4", "value": "34.193.215.190", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 389, "frame_number": 26098, "display_filter": "frame.number == 26098", "timestamp_epoch": "1583962657.137080000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-363a9252d915c7e4d51a2afc", "type": "ipv4", "value": "34.194.253.146", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 386, "frame_number": 26010, "display_filter": "frame.number == 26010", "timestamp_epoch": "1583962656.960973000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-963b7cfcd00bd0fa4485bb98", "type": "ipv4", "value": "34.196.181.158", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 228, "frame_number": 14974, "display_filter": "frame.number == 14974", "timestamp_epoch": "1583962320.197469000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-933c849ba5ccb856258e19b5", "type": "ipv4", "value": "34.197.12.81", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 228, "frame_number": 14974, "display_filter": "frame.number == 14974", "timestamp_epoch": "1583962320.197469000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-23339749bb5370af1defb56d", "type": "ipv4", "value": "34.206.247.240", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 395, "frame_number": 26128, "display_filter": "frame.number == 26128", "timestamp_epoch": "1583962657.176778000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-91a655a9597691c42572dc45", "type": "ipv4", "value": "34.208.124.133", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 345, "frame_number": 23659, "display_filter": "frame.number == 23659", "timestamp_epoch": "1583962652.155462000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b9b64bfd2a24e2a24f48c8c6", "type": "ipv4", "value": "34.208.131.21", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 343, "frame_number": 21915, "display_filter": "frame.number == 21915", "timestamp_epoch": "1583962651.475025000" }, { "udp_stream": 348, "frame_number": 23807, "display_filter": "frame.number == 23807", "timestamp_epoch": "1583962652.422875000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-eb14020ff65e8b7d60dd5324", "type": "ipv4", "value": "34.208.36.157", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 343, "frame_number": 21915, "display_filter": "frame.number == 21915", "timestamp_epoch": "1583962651.475025000" }, { "udp_stream": 348, "frame_number": 23807, "display_filter": "frame.number == 23807", "timestamp_epoch": "1583962652.422875000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1fa350c532249dba35ca3c53", "type": "ipv4", "value": "34.209.127.1", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 343, "frame_number": 21915, "display_filter": "frame.number == 21915", "timestamp_epoch": "1583962651.475025000" }, { "udp_stream": 348, "frame_number": 23807, "display_filter": "frame.number == 23807", "timestamp_epoch": "1583962652.422875000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2e1504458a1e07935337b113", "type": "ipv4", "value": "34.211.22.199", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 345, "frame_number": 23659, "display_filter": "frame.number == 23659", "timestamp_epoch": "1583962652.155462000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-9fa2aaf08e9df9a2a4dae738", "type": "ipv4", "value": "34.212.232.109", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 343, "frame_number": 21915, "display_filter": "frame.number == 21915", "timestamp_epoch": "1583962651.475025000" }, { "udp_stream": 348, "frame_number": 23807, "display_filter": "frame.number == 23807", "timestamp_epoch": "1583962652.422875000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1aaf979bbed278f691bd024c", "type": "ipv4", "value": "34.213.227.128", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 345, "frame_number": 23659, "display_filter": "frame.number == 23659", "timestamp_epoch": "1583962652.155462000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c2027fe767a0b064bf2fc1e3", "type": "ipv4", "value": "34.224.92.105", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 395, "frame_number": 26128, "display_filter": "frame.number == 26128", "timestamp_epoch": "1583962657.176778000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-17fceabe2ab49d8a1302f0ca", "type": "ipv4", "value": "34.225.211.231", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 395, "frame_number": 26128, "display_filter": "frame.number == 26128", "timestamp_epoch": "1583962657.176778000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d4e9ab7b293c29fcb79d1f9e", "type": "ipv4", "value": "34.231.157.146", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 395, "frame_number": 26128, "display_filter": "frame.number == 26128", "timestamp_epoch": "1583962657.176778000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-24f9dab2293a866b8b89dca5", "type": "ipv4", "value": "34.231.65.133", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 401, "frame_number": 26535, "display_filter": "frame.number == 26535", "timestamp_epoch": "1583962661.464277000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3eb5116a714dbcfba08fdd6f", "type": "ipv4", "value": "34.232.94.82", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 401, "frame_number": 26535, "display_filter": "frame.number == 26535", "timestamp_epoch": "1583962661.464277000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-edfd38d3f7de9119854b9a88", "type": "ipv4", "value": "34.234.197.182", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 401, "frame_number": 26535, "display_filter": "frame.number == 26535", "timestamp_epoch": "1583962661.464277000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b5d6d09d0be7a94aab3c4ea9", "type": "ipv4", "value": "34.234.23.242", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 336, "frame_number": 21384, "display_filter": "frame.number == 21384", "timestamp_epoch": "1583962651.092080000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-df66da7c0d834dadb2a9a61e", "type": "ipv4", "value": "34.236.165.152", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 385, "frame_number": 26007, "display_filter": "frame.number == 26007", "timestamp_epoch": "1583962656.958475000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-5716d73809a44e521dc73d8b", "type": "ipv4", "value": "34.98.67.3", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 376, "frame_number": 25538, "display_filter": "frame.number == 25538", "timestamp_epoch": "1583962655.936276000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-83ab37863754b87df9cf37b6", "type": "ipv4", "value": "35.161.118.223", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 343, "frame_number": 21915, "display_filter": "frame.number == 21915", "timestamp_epoch": "1583962651.475025000" }, { "udp_stream": 348, "frame_number": 23807, "display_filter": "frame.number == 23807", "timestamp_epoch": "1583962652.422875000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-54d391ca599767ad2d787054", "type": "ipv4", "value": "35.161.52.15", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 343, "frame_number": 21915, "display_filter": "frame.number == 21915", "timestamp_epoch": "1583962651.475025000" }, { "udp_stream": 348, "frame_number": 23807, "display_filter": "frame.number == 23807", "timestamp_epoch": "1583962652.422875000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-935b9486dc3d95f6f2b76b2b", "type": "ipv4", "value": "35.163.173.161", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 343, "frame_number": 21915, "display_filter": "frame.number == 21915", "timestamp_epoch": "1583962651.475025000" }, { "udp_stream": 348, "frame_number": 23807, "display_filter": "frame.number == 23807", "timestamp_epoch": "1583962652.422875000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-deee192e3820de882c3aaabf", "type": "ipv4", "value": "35.167.5.179", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 343, "frame_number": 21915, "display_filter": "frame.number == 21915", "timestamp_epoch": "1583962651.475025000" }, { "udp_stream": 348, "frame_number": 23807, "display_filter": "frame.number == 23807", "timestamp_epoch": "1583962652.422875000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-734003cf6b0ac079888d17fa", "type": "ipv4", "value": "35.169.43.149", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 401, "frame_number": 26535, "display_filter": "frame.number == 26535", "timestamp_epoch": "1583962661.464277000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1f6249767bb3bc866b5a5ffe", "type": "ipv4", "value": "35.190.72.21", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 383, "frame_number": 25912, "display_filter": "frame.number == 25912", "timestamp_epoch": "1583962656.790277000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-552ce5be829db0c5f5c3989e", "type": "ipv4", "value": "35.241.23.116", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 375, "frame_number": 25539, "display_filter": "frame.number == 25539", "timestamp_epoch": "1583962655.936347000" }, { "udp_stream": 378, "frame_number": 25540, "display_filter": "frame.number == 25540", "timestamp_epoch": "1583962655.936451000" }, { "udp_stream": 380, "frame_number": 25541, "display_filter": "frame.number == 25541", "timestamp_epoch": "1583962655.936519000" }, { "udp_stream": 379, "frame_number": 25542, "display_filter": "frame.number == 25542", "timestamp_epoch": "1583962655.936624000" }, { "udp_stream": 381, "frame_number": 25557, "display_filter": "frame.number == 25557", "timestamp_epoch": "1583962655.958527000" }, { "udp_stream": 377, "frame_number": 25648, "display_filter": "frame.number == 25648", "timestamp_epoch": "1583962656.140330000" }, { "udp_stream": 384, "frame_number": 25919, "display_filter": "frame.number == 25919", "timestamp_epoch": "1583962656.815109000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c566788760f12388af8501d4", "type": "ipv4", "value": "35.244.140.139", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 388, "frame_number": 26097, "display_filter": "frame.number == 26097", "timestamp_epoch": "1583962657.136998000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-224a863bbbe67d186970d2ff", "type": "ipv4", "value": "40.100.155.18", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 66, "frame_number": 1898, "display_filter": "frame.number == 1898", "timestamp_epoch": "1583961789.286717000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-fcdb51b2c630cd83f1063eb1", "type": "ipv4", "value": "40.100.155.2", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 66, "frame_number": 1898, "display_filter": "frame.number == 1898", "timestamp_epoch": "1583961789.286717000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ffc8e49ef9949a86e4550b8a", "type": "ipv4", "value": "40.119.2.214", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 117, "frame_number": 3699, "display_filter": "frame.number == 3699", "timestamp_epoch": "1583961823.771503000" }, { "udp_stream": 239, "frame_number": 15393, "display_filter": "frame.number == 15393", "timestamp_epoch": "1583962380.441417000" }, { "udp_stream": 284, "frame_number": 16329, "display_filter": "frame.number == 16329", "timestamp_epoch": "1583962544.824732000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-6d9ebc2e200af1ca86128afc", "type": "ipv4", "value": "40.126.0.65", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 174, "frame_number": 8136, "display_filter": "frame.number == 8136", "timestamp_epoch": "1583961870.477543000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2985a2c27ef44bd660510f2f", "type": "ipv4", "value": "40.126.0.66", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 174, "frame_number": 8136, "display_filter": "frame.number == 8136", "timestamp_epoch": "1583961870.477543000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-12bb2e4e550ef1552546dc29", "type": "ipv4", "value": "40.126.0.67", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 174, "frame_number": 8136, "display_filter": "frame.number == 8136", "timestamp_epoch": "1583961870.477543000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3ae4f5896bfb92f0e49a06cf", "type": "ipv4", "value": "40.126.0.68", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 174, "frame_number": 8136, "display_filter": "frame.number == 8136", "timestamp_epoch": "1583961870.477543000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-6bd7725f8e1544d9d17d020d", "type": "ipv4", "value": "40.126.0.69", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 174, "frame_number": 8136, "display_filter": "frame.number == 8136", "timestamp_epoch": "1583961870.477543000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2c54a7db047c514da40801c6", "type": "ipv4", "value": "40.126.0.71", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 174, "frame_number": 8136, "display_filter": "frame.number == 8136", "timestamp_epoch": "1583961870.477543000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-351f15c26bb6ae43146256ac", "type": "ipv4", "value": "40.126.0.72", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 174, "frame_number": 8136, "display_filter": "frame.number == 8136", "timestamp_epoch": "1583961870.477543000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-789bf898ccdfdc85b98c117e", "type": "ipv4", "value": "40.126.0.73", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 174, "frame_number": 8136, "display_filter": "frame.number == 8136", "timestamp_epoch": "1583961870.477543000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-8f15c0a868af8a2219185627", "type": "ipv4", "value": "40.69.218.62", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 15, "frame_number": 526, "display_filter": "frame.number == 526", "timestamp_epoch": "1583961757.840619000" }, { "udp_stream": 102, "frame_number": 3007, "display_filter": "frame.number == 3007", "timestamp_epoch": "1583961815.247099000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-bec5bec32ff689bd5af2156d", "type": "ipv4", "value": "40.90.22.183", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 240, "frame_number": 15441, "display_filter": "frame.number == 15441", "timestamp_epoch": "1583962381.378143000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f8b60f702f84f4460430c77e", "type": "ipv4", "value": "40.90.22.185", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 178, "frame_number": 8550, "display_filter": "frame.number == 8550", "timestamp_epoch": "1583961873.974309000" }, { "udp_stream": 404, "frame_number": 26723, "display_filter": "frame.number == 26723", "timestamp_epoch": "1583962683.965713000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0e691f48ea87c5370deb4ca6", "type": "ipv4", "value": "40.90.22.187", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 178, "frame_number": 8550, "display_filter": "frame.number == 8550", "timestamp_epoch": "1583961873.974309000" }, { "udp_stream": 240, "frame_number": 15441, "display_filter": "frame.number == 15441", "timestamp_epoch": "1583962381.378143000" }, { "udp_stream": 404, "frame_number": 26723, "display_filter": "frame.number == 26723", "timestamp_epoch": "1583962683.965713000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-5a8bbf6ea195c14de99c72cd", "type": "ipv4", "value": "40.90.22.188", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 192, "frame_number": 10482, "display_filter": "frame.number == 10482", "timestamp_epoch": "1583961955.604959000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-6b77d4ed0020f8229fbd1238", "type": "ipv4", "value": "40.90.22.189", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 178, "frame_number": 8550, "display_filter": "frame.number == 8550", "timestamp_epoch": "1583961873.974309000" }, { "udp_stream": 192, "frame_number": 10482, "display_filter": "frame.number == 10482", "timestamp_epoch": "1583961955.604959000" }, { "udp_stream": 240, "frame_number": 15441, "display_filter": "frame.number == 15441", "timestamp_epoch": "1583962381.378143000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b73fe1a7bbb1a93ee294edce", "type": "ipv4", "value": "40.90.22.190", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 404, "frame_number": 26723, "display_filter": "frame.number == 26723", "timestamp_epoch": "1583962683.965713000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-75ffe03a6b9baf21697950ef", "type": "ipv4", "value": "40.90.22.191", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 192, "frame_number": 10482, "display_filter": "frame.number == 10482", "timestamp_epoch": "1583961955.604959000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-7e45f9cecbb4e8f34b395a9f", "type": "ipv4", "value": "40.91.76.238", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 194, "frame_number": 10540, "display_filter": "frame.number == 10540", "timestamp_epoch": "1583961956.376456000" }, { "udp_stream": 241, "frame_number": 15489, "display_filter": "frame.number == 15489", "timestamp_epoch": "1583962381.966088000" }, { "udp_stream": 291, "frame_number": 16385, "display_filter": "frame.number == 16385", "timestamp_epoch": "1583962545.300426000" }, { "udp_stream": 409, "frame_number": 27436, "display_filter": "frame.number == 27436", "timestamp_epoch": "1583962857.635043000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-901caf483d34c80e094d343f", "type": "ipv4", "value": "45.148.120.153", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1fa516e46dc6dd3ae28c5f77", "type": "ipv4", "value": "50.87.248.17", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:08.139415+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:08.136738+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 179, "frame_number": 8612, "display_filter": "frame.number == 8612", "timestamp_epoch": "1583961876.430841000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:08.130907+00:00" }, { "observable_id": "observable-3448c5ac0844d4fe3525eb6b", "type": "ipv4", "value": "51.254.164.244", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-6d7d53dc686f91852a63cb26", "type": "ipv4", "value": "52.0.81.73", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 401, "frame_number": 26535, "display_filter": "frame.number == 26535", "timestamp_epoch": "1583962661.464277000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c0704f8bf8fac20faa7ada23", "type": "ipv4", "value": "52.109.12.19", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 110, "frame_number": 3122, "display_filter": "frame.number == 3122", "timestamp_epoch": "1583961816.742544000" }, { "udp_stream": 177, "frame_number": 8543, "display_filter": "frame.number == 8543", "timestamp_epoch": "1583961873.836267000" }, { "udp_stream": 190, "frame_number": 10339, "display_filter": "frame.number == 10339", "timestamp_epoch": "1583961936.171143000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-844d34c3d5fb2912eb4ddc53", "type": "ipv4", "value": "52.109.8.30", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 218, "frame_number": 14421, "display_filter": "frame.number == 14421", "timestamp_epoch": "1583962114.660248000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-32fe5196af63908fbfa2e48a", "type": "ipv4", "value": "52.109.88.36", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 417, "frame_number": 29846, "display_filter": "frame.number == 29846", "timestamp_epoch": "1583963487.731856000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-23d88c5b5d35a70fa04a56c9", "type": "ipv4", "value": "52.114.132.73", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 118, "frame_number": 3706, "display_filter": "frame.number == 3706", "timestamp_epoch": "1583961824.002810000" }, { "udp_stream": 180, "frame_number": 9004, "display_filter": "frame.number == 9004", "timestamp_epoch": "1583961880.041235000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2d140cf426a13f83d3ad4eab", "type": "ipv4", "value": "52.114.77.34", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 28, "frame_number": 1019, "display_filter": "frame.number == 1019", "timestamp_epoch": "1583961766.602814000" }, { "udp_stream": 69, "frame_number": 2020, "display_filter": "frame.number == 2020", "timestamp_epoch": "1583961792.706361000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d0d970db98d3115a5c31d6c5", "type": "ipv4", "value": "52.161.15.246", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 25, "frame_number": 753, "display_filter": "frame.number == 753", "timestamp_epoch": "1583961759.735456000" }, { "udp_stream": 113, "frame_number": 3231, "display_filter": "frame.number == 3231", "timestamp_epoch": "1583961817.510251000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-8bf43c3e36b9a51fb27fe6f3", "type": "ipv4", "value": "52.173.134.115", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 202, "frame_number": 12513, "display_filter": "frame.number == 12513", "timestamp_epoch": "1583962014.306944000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-382c1d8f1def7330b9eeb437", "type": "ipv4", "value": "52.179.129.229", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 123, "frame_number": 4009, "display_filter": "frame.number == 4009", "timestamp_epoch": "1583961833.292679000" }, { "udp_stream": 131, "frame_number": 4284, "display_filter": "frame.number == 4284", "timestamp_epoch": "1583961848.817143000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-296bc8ca665ee8edf438cd1e", "type": "ipv4", "value": "52.2.35.4", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 395, "frame_number": 26128, "display_filter": "frame.number == 26128", "timestamp_epoch": "1583962657.176778000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-082d61d238beef3217627724", "type": "ipv4", "value": "52.201.53.231", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 385, "frame_number": 26007, "display_filter": "frame.number == 26007", "timestamp_epoch": "1583962656.958475000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-dd00cf1865319c43a6481154", "type": "ipv4", "value": "52.202.136.43", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 401, "frame_number": 26535, "display_filter": "frame.number == 26535", "timestamp_epoch": "1583962661.464277000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-8f75be07e9afd189e5bf14f7", "type": "ipv4", "value": "52.202.7.233", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 401, "frame_number": 26535, "display_filter": "frame.number == 26535", "timestamp_epoch": "1583962661.464277000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a81bf85bd787e589c4eecac3", "type": "ipv4", "value": "52.204.219.227", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 401, "frame_number": 26535, "display_filter": "frame.number == 26535", "timestamp_epoch": "1583962661.464277000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a08247ea10f2de4dd61c3990", "type": "ipv4", "value": "52.204.222.100", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 395, "frame_number": 26128, "display_filter": "frame.number == 26128", "timestamp_epoch": "1583962657.176778000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f9c975b2826dad73b2e342c2", "type": "ipv4", "value": "52.206.178.1", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 228, "frame_number": 14974, "display_filter": "frame.number == 14974", "timestamp_epoch": "1583962320.197469000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-105cb8461e214e54e86eb4d0", "type": "ipv4", "value": "52.23.116.187", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 385, "frame_number": 26007, "display_filter": "frame.number == 26007", "timestamp_epoch": "1583962656.958475000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-149d49c1ff2e9bfeb32f2f16", "type": "ipv4", "value": "52.230.220.159", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 236, "frame_number": 15204, "display_filter": "frame.number == 15204", "timestamp_epoch": "1583962359.660989000" }, { "udp_stream": 245, "frame_number": 15601, "display_filter": "frame.number == 15601", "timestamp_epoch": "1583962385.972448000" }, { "udp_stream": 256, "frame_number": 15923, "display_filter": "frame.number == 15923", "timestamp_epoch": "1583962416.974560000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b73764d56fb3a2ebca36ce7e", "type": "ipv4", "value": "52.230.222.68", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 226, "frame_number": 14921, "display_filter": "frame.number == 14921", "timestamp_epoch": "1583962319.963750000" }, { "udp_stream": 235, "frame_number": 15136, "display_filter": "frame.number == 15136", "timestamp_epoch": "1583962351.740704000" }, { "udp_stream": 238, "frame_number": 15376, "display_filter": "frame.number == 15376", "timestamp_epoch": "1583962380.292101000" }, { "udp_stream": 254, "frame_number": 15744, "display_filter": "frame.number == 15744", "timestamp_epoch": "1583962387.466826000" }, { "udp_stream": 262, "frame_number": 16114, "display_filter": "frame.number == 16114", "timestamp_epoch": "1583962434.184347000" }, { "udp_stream": 290, "frame_number": 16404, "display_filter": "frame.number == 16404", "timestamp_epoch": "1583962545.440932000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-31652b02c3300c435efdbe38", "type": "ipv4", "value": "52.242.211.89", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 196, "frame_number": 12357, "display_filter": "frame.number == 12357", "timestamp_epoch": "1583961994.711946000" }, { "udp_stream": 211, "frame_number": 14081, "display_filter": "frame.number == 14081", "timestamp_epoch": "1583962054.581731000" }, { "udp_stream": 224, "frame_number": 14741, "display_filter": "frame.number == 14741", "timestamp_epoch": "1583962291.242182000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b0bb4dd223044664f01b3a45", "type": "ipv4", "value": "52.3.121.18", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 385, "frame_number": 26007, "display_filter": "frame.number == 26007", "timestamp_epoch": "1583962656.958475000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3f343eb9c68cb1316e5e9509", "type": "ipv4", "value": "52.45.33.138", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 398, "frame_number": 26392, "display_filter": "frame.number == 26392", "timestamp_epoch": "1583962657.788154000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2b831c66817e906a0f82696b", "type": "ipv4", "value": "52.70.73.113", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 389, "frame_number": 26098, "display_filter": "frame.number == 26098", "timestamp_epoch": "1583962657.137080000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2a237f3c00e4e967e33c589b", "type": "ipv4", "value": "52.73.178.122", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 395, "frame_number": 26128, "display_filter": "frame.number == 26128", "timestamp_epoch": "1583962657.176778000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-13ce1334882546a703581865", "type": "ipv4", "value": "52.9.108.55", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 145, "frame_number": 4543, "display_filter": "frame.number == 4543", "timestamp_epoch": "1583961854.926971000" }, { "udp_stream": 281, "frame_number": 16284, "display_filter": "frame.number == 16284", "timestamp_epoch": "1583962457.871573000" }, { "udp_stream": 311, "frame_number": 21128, "display_filter": "frame.number == 21128", "timestamp_epoch": "1583962650.340100000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-87757fb77355128439b9297f", "type": "ipv4", "value": "52.98.73.210", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 66, "frame_number": 1898, "display_filter": "frame.number == 1898", "timestamp_epoch": "1583961789.286717000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-15663109298445f0b0489145", "type": "ipv4", "value": "52.98.73.226", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 66, "frame_number": 1898, "display_filter": "frame.number == 1898", "timestamp_epoch": "1583961789.286717000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-80b5ebca70f2b14d43837e7d", "type": "ipv4", "value": "52.98.73.242", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 66, "frame_number": 1898, "display_filter": "frame.number == 1898", "timestamp_epoch": "1583961789.286717000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-5e38c9d3e1f05862a63a4235", "type": "ipv4", "value": "52.98.77.66", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 66, "frame_number": 1898, "display_filter": "frame.number == 1898", "timestamp_epoch": "1583961789.286717000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-7885680650d446cb8e40f569", "type": "ipv4", "value": "52.98.77.82", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 66, "frame_number": 1898, "display_filter": "frame.number == 1898", "timestamp_epoch": "1583961789.286717000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-46cdf533a8ccf34a41a1ee6a", "type": "ipv4", "value": "52.98.80.210", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 66, "frame_number": 1898, "display_filter": "frame.number == 1898", "timestamp_epoch": "1583961789.286717000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-8de04fe6c964dfafd4738ed5", "type": "ipv4", "value": "52.98.81.178", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 66, "frame_number": 1898, "display_filter": "frame.number == 1898", "timestamp_epoch": "1583961789.286717000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b6e773759ee8f83e2ca88c0f", "type": "ipv4", "value": "52.98.81.2", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 66, "frame_number": 1898, "display_filter": "frame.number == 1898", "timestamp_epoch": "1583961789.286717000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d401b9d080f87c39fe6294e6", "type": "ipv4", "value": "52.98.93.2", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 66, "frame_number": 1898, "display_filter": "frame.number == 1898", "timestamp_epoch": "1583961789.286717000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c905906a982fb82f9af661d4", "type": "ipv4", "value": "54.153.98.238", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 145, "frame_number": 4543, "display_filter": "frame.number == 4543", "timestamp_epoch": "1583961854.926971000" }, { "udp_stream": 281, "frame_number": 16284, "display_filter": "frame.number == 16284", "timestamp_epoch": "1583962457.871573000" }, { "udp_stream": 311, "frame_number": 21128, "display_filter": "frame.number == 21128", "timestamp_epoch": "1583962650.340100000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-011d56c6b0c2e29279ffc532", "type": "ipv4", "value": "54.173.98.209", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 395, "frame_number": 26128, "display_filter": "frame.number == 26128", "timestamp_epoch": "1583962657.176778000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ba092c79f590d914609ddf66", "type": "ipv4", "value": "54.175.87.114", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 398, "frame_number": 26392, "display_filter": "frame.number == 26392", "timestamp_epoch": "1583962657.788154000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-739a1b04a5e2d8e490e3a9c3", "type": "ipv4", "value": "54.197.51.7", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 389, "frame_number": 26098, "display_filter": "frame.number == 26098", "timestamp_epoch": "1583962657.137080000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-841104cd06b068235b239530", "type": "ipv4", "value": "54.213.212.101", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 402, "frame_number": 26577, "display_filter": "frame.number == 26577", "timestamp_epoch": "1583962661.873966000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f7a9c523ffe4ab9176320edd", "type": "ipv4", "value": "54.244.36.123", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 402, "frame_number": 26577, "display_filter": "frame.number == 26577", "timestamp_epoch": "1583962661.873966000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1925176da8b005304f178a61", "type": "ipv4", "value": "54.68.183.142", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 402, "frame_number": 26577, "display_filter": "frame.number == 26577", "timestamp_epoch": "1583962661.873966000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-cde9406325fb1e81bb2a7fb1", "type": "ipv4", "value": "54.83.179.223", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 386, "frame_number": 26010, "display_filter": "frame.number == 26010", "timestamp_epoch": "1583962656.960973000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-515ebb6775fc345726119657", "type": "ipv4", "value": "54.83.97.43", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 385, "frame_number": 26007, "display_filter": "frame.number == 26007", "timestamp_epoch": "1583962656.958475000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c0866de89a145dbcc5058eb3", "type": "ipv4", "value": "54.86.220.14", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 386, "frame_number": 26010, "display_filter": "frame.number == 26010", "timestamp_epoch": "1583962656.960973000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-78cc5ffa294e3dc95a58cdc9", "type": "ipv4", "value": "63.148.46.76", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 370, "frame_number": 25244, "display_filter": "frame.number == 25244", "timestamp_epoch": "1583962655.496790000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2b5322d3090e87ff1451242d", "type": "ipv4", "value": "64.4.54.254", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 205, "frame_number": 12946, "display_filter": "frame.number == 12946", "timestamp_epoch": "1583962015.928169000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f0ae0595f3e5d7ee92b7e4a8", "type": "ipv4", "value": "64.44.133.131", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:08.364820+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:08.360903+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 434, "frame_number": 18431, "display_filter": "frame.number == 18431", "timestamp_epoch": "1583962605.820456000" }, { "tcp_stream": 434, "frame_number": 19014, "display_filter": "frame.number == 19014", "timestamp_epoch": "1583962612.268574000" }, { "tcp_stream": 450, "frame_number": 19562, "display_filter": "frame.number == 19562", "timestamp_epoch": "1583962617.337739000" } ], "roles": [ "http-host", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:08.356323+00:00" }, { "observable_id": "observable-a832b5529f07b9238f3eca48", "type": "ipv4", "value": "65.254.227.240", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 207, "frame_number": 13302, "display_filter": "frame.number == 13302", "timestamp_epoch": "1583962027.252924000" }, { "udp_stream": 209, "frame_number": 13391, "display_filter": "frame.number == 13391", "timestamp_epoch": "1583962027.518423000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-266225aa53818a8996c40267", "type": "ipv4", "value": "67.27.98.254", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 189, "frame_number": 10325, "display_filter": "frame.number == 10325", "timestamp_epoch": "1583961934.209558000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-6b5fcf86249dd1e55c8f6d7b", "type": "ipv4", "value": "67.27.99.254", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 189, "frame_number": 10325, "display_filter": "frame.number == 10325", "timestamp_epoch": "1583961934.209558000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-6d3d535011aa12da5a499567", "type": "ipv4", "value": "72.167.191.69", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 136, "frame_number": 4348, "display_filter": "frame.number == 4348", "timestamp_epoch": "1583961854.572439000" }, { "udp_stream": 148, "frame_number": 4916, "display_filter": "frame.number == 4916", "timestamp_epoch": "1583961856.009855000" }, { "udp_stream": 326, "frame_number": 21211, "display_filter": "frame.number == 21211", "timestamp_epoch": "1583962650.607967000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f9e110a17e3abe42402d2476", "type": "ipv4", "value": "72.21.81.200", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 126, "frame_number": 4063, "display_filter": "frame.number == 4063", "timestamp_epoch": "1583961837.210365000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2d15c69530a7d6f765352cca", "type": "ipv4", "value": "72.21.91.29", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 193, "frame_number": 10496, "display_filter": "frame.number == 10496", "timestamp_epoch": "1583961955.805772000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0145cd1ecc3af00f7412298a", "type": "ipv4", "value": "72.21.91.66", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 156, "frame_number": 6069, "display_filter": "frame.number == 6069", "timestamp_epoch": "1583961857.209794000" }, { "udp_stream": 321, "frame_number": 21194, "display_filter": "frame.number == 21194", "timestamp_epoch": "1583962650.527524000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-83e0e6eb8c3fd268f10dee36", "type": "ipv4", "value": "72.246.84.150", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 146, "frame_number": 4544, "display_filter": "frame.number == 4544", "timestamp_epoch": "1583961854.927021000" }, { "udp_stream": 138, "frame_number": 5213, "display_filter": "frame.number == 5213", "timestamp_epoch": "1583961856.360527000" }, { "udp_stream": 151, "frame_number": 5227, "display_filter": "frame.number == 5227", "timestamp_epoch": "1583961856.360811000" }, { "udp_stream": 153, "frame_number": 5937, "display_filter": "frame.number == 5937", "timestamp_epoch": "1583961856.889136000" }, { "udp_stream": 309, "frame_number": 21127, "display_filter": "frame.number == 21127", "timestamp_epoch": "1583962650.340042000" }, { "udp_stream": 322, "frame_number": 21187, "display_filter": "frame.number == 21187", "timestamp_epoch": "1583962650.507613000" }, { "udp_stream": 324, "frame_number": 21204, "display_filter": "frame.number == 21204", "timestamp_epoch": "1583962650.557545000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-adbbfb70d7b4cca1d3ac730a", "type": "ipv4", "value": "72.246.84.229", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 323, "frame_number": 21195, "display_filter": "frame.number == 21195", "timestamp_epoch": "1583962650.527591000" }, { "udp_stream": 330, "frame_number": 21289, "display_filter": "frame.number == 21289", "timestamp_epoch": "1583962650.943689000" }, { "udp_stream": 329, "frame_number": 21290, "display_filter": "frame.number == 21290", "timestamp_epoch": "1583962650.943765000" }, { "udp_stream": 333, "frame_number": 21364, "display_filter": "frame.number == 21364", "timestamp_epoch": "1583962651.000088000" }, { "udp_stream": 331, "frame_number": 21376, "display_filter": "frame.number == 21376", "timestamp_epoch": "1583962651.053207000" }, { "udp_stream": 337, "frame_number": 21385, "display_filter": "frame.number == 21385", "timestamp_epoch": "1583962651.092134000" }, { "udp_stream": 334, "frame_number": 21479, "display_filter": "frame.number == 21479", "timestamp_epoch": "1583962651.129702000" }, { "udp_stream": 340, "frame_number": 21486, "display_filter": "frame.number == 21486", "timestamp_epoch": "1583962651.132407000" }, { "udp_stream": 339, "frame_number": 21566, "display_filter": "frame.number == 21566", "timestamp_epoch": "1583962651.194645000" }, { "udp_stream": 341, "frame_number": 21634, "display_filter": "frame.number == 21634", "timestamp_epoch": "1583962651.199027000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-05be0fd501cf93d815b15d11", "type": "ipv4", "value": "8.253.112.120", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 189, "frame_number": 10325, "display_filter": "frame.number == 10325", "timestamp_epoch": "1583961934.209558000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b20149df43cda8a66537d7c4", "type": "ipv4", "value": "8.253.164.240", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 189, "frame_number": 10325, "display_filter": "frame.number == 10325", "timestamp_epoch": "1583961934.209558000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c981880b162c784cdab9eb2e", "type": "ipv4", "value": "8.253.164.248", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 189, "frame_number": 10325, "display_filter": "frame.number == 10325", "timestamp_epoch": "1583961934.209558000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e99f7359be9d982b795daadb", "type": "ipv4", "value": "8.43.72.97", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 390, "frame_number": 26082, "display_filter": "frame.number == 26082", "timestamp_epoch": "1583962657.125860000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-fee7e5ceb1c600cc1b3dde8a", "type": "ipv4", "value": "8.43.72.98", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 390, "frame_number": 26082, "display_filter": "frame.number == 26082", "timestamp_epoch": "1583962657.125860000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-efbb0da9faee18dd3c7e6c7d", "type": "ipv4", "value": "89.187.164.37", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 387, "frame_number": 26089, "display_filter": "frame.number == 26089", "timestamp_epoch": "1583962657.131237000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a4fd938c033f7e4794d725fa", "type": "sha256", "value": "00b3e28e084717e5fb9ba1f8a9cf7e9a854ded1b7b4721ed31110513013461dc", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2e5f3d5d154e82bc467b7294", "type": "sha256", "value": "01428897745e7b37849d922e35e28ad8585aca2a254d55f3b5adaecb0b3cb526", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-85340b2b43a54acdc129ba7f", "type": "sha256", "value": "02db3c6b9aff73bf8a11c41107c836b6c800c919c5d3d1304f336aee03f79f4c", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "malwarebazaar", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:02.064358+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:01.801594+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:01.799475+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:01.796151+00:00" }, { "observable_id": "observable-43b391507bda6928f5370960", "type": "sha256", "value": "06cb95758d706e8359a137118c05fb38af14616f870a0448d327c3203ee69973", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e86f3c2e5cc50cda536ad411", "type": "sha256", "value": "088111ecdfb3a045b7d594f7c4632561d30b72e15bc771d79812c172ea77e0de", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-aaf1d73959c6a9d75dd5e40a", "type": "sha256", "value": "0e687e2d9d394d7247d63b61aa33895b436f347eb73d8d1d1f99c199d2a0486e", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ed183895d54b237b74c2bd81", "type": "sha256", "value": "0e7a2be431ec48b8483bf126741dba1fc74260a35d944a1b8f0f6c2e0adfc9dd", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-bb90e25f4a050fb1c116e7c0", "type": "sha256", "value": "1ca2faaa4a7ba86c934c337dcb47ebd521dd5721a9f62302ef36f074c1a4c8d8", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "malwarebazaar", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:02.844784+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:02.541359+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:02.537205+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:02.532978+00:00" }, { "observable_id": "observable-c657bfc8c9fd3ab5d54c4b2c", "type": "sha256", "value": "1e7a8021a029a0b1b97d9df2c059ad4fe80ff8d9db9564c593bdde97df48f5ff", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-471ac6cd6672a92b554a17a4", "type": "sha256", "value": "21bd143d38dbbae427615a7266a86a18dc95c417f3e510632d7a9180d98d3571", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e1498f67e46f3fd67f244430", "type": "sha256", "value": "232066e3f6f1351afdaee1acb70c409766641fd5669e0b55ce7c77fac0a857ef", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1e34c6c7ef3948c2d6bd773a", "type": "sha256", "value": "2458ec1dbcd980f7d484f0140f1d88e2088249eacf3411b2b2359afdf7774318", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-dcf7dac4aab970de1bbbe603", "type": "sha256", "value": "2aa0809ab9f586e743514b0ef60ece6f30dc7d5583d64c1d90cfb87c7019a2bf", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-12ac1c27281d4271edaf8a30", "type": "sha256", "value": "2ac97370caeb512780c9e407128aaa48e9ea92e34acfb427888e1a8027aa7723", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-52b72ce068b22af58a0a99f3", "type": "sha256", "value": "2e8b2448de2607edfbeba46bc40bdf5ff8a97afc21e36e0f2a8faaeb7802651d", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-5305bcfeca2373b9ccc5948a", "type": "sha256", "value": "3291b96690178e55e4114c78a6241d3a6bd18aa7361626ff803b54064d178122", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-6e39d71744289702f8a9bb46", "type": "sha256", "value": "34efd2a999616fb13ef5fadece4481e978c68f2f3416713a4364a21fe81d3243", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0774e27fbd5cbb024f0befc8", "type": "sha256", "value": "34fc3b82e17c69e3cefd908d8e85848f2cdfcb180ba5c05a84ccd2c65e943e09", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ac4a1c8b66d7f01fa319b8f7", "type": "sha256", "value": "361c9f80feaefdda9eb1bb7ee61de56d922188898f69af4cf8a76c64fb0183ad", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ff0746f31ead3cf9f7442aac", "type": "sha256", "value": "3ddb722a10d4664abeb93659beefa009255d6cda0975a47944665976ad9e64cd", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-287190b56af5427b67e1f61b", "type": "sha256", "value": "3fd2858003c32f1542e7f330cfd1ef2dcd578f20c39bfdd22d70c57a801502b0", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-28dba225bfe2b3e8b92b83c1", "type": "sha256", "value": "49c45399074a6af07b176d55bb85b3de42b2c2889bf9efa37310b4e71cf14f43", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-349e4489ecc529830167d83f", "type": "sha256", "value": "4a0ba027a8859545d3caf300e4c8293248c6e878758cacb14f34e1cdc3d2e24d", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3c3697534acd4c4cfeb8c9bd", "type": "sha256", "value": "4b2f13582e24aa18d80a7efd5ca0862cbb68b414a3d9d37a9138c3873bdbbba8", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-90e67161e4374a86a235355c", "type": "sha256", "value": "5638ee72bed581aec1cf09b1e7fdeb37a23b69d8f5927ca00b84f2286a695066", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "malwarebazaar", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:03.751076+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:03.363579+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:03.359103+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:03.353393+00:00" }, { "observable_id": "observable-bce57ae9850382626ad95ac8", "type": "sha256", "value": "567b1b26bdc881dbbae6afca179ba2597c243a6a045984bb61c8138a00389792", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-479939467ff23ecd759d926d", "type": "sha256", "value": "5adbad4e799ade940d96f6f293fc1ea535b504a6151555c879c5e183aeac1018", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1873c72c8e646510bd670d20", "type": "sha256", "value": "5b0d6fc1a80187419cfcc2340e6bf1a3e7704e8d65b44bee45a1caaab91138d2", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e28f78c24779bf9d5b531d8d", "type": "sha256", "value": "5c06f9a4898eae08a070b18d66d2162fd031833e993d1c0bf3bd9e7e83a6c526", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d1a8bfd3bdba5146ec89e038", "type": "sha256", "value": "626211f63483c4d5717e680816bc56119bcb9cdb3446c6d9241b119037ae724e", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-7eda0f2160c7166adbe45a69", "type": "sha256", "value": "68798ccf8e2a5f9682a4e011bec288ad9b3f900244f82c6ae5e8ca538725f92e", "classification": "suspicious", "ioc_candidate": true, "reasons": [ { "kind": "static-review", "artifact_id": "artifact-f2042332405293c1a06baa7f", "features": [ "pe-bytes-under-non-executable-url-extension" ], "frames": [ 19533 ], "interpretation": "A transfer-bound PE is served under a non-executable URL extension. Investigate the exact recovered hash; this is not proof of execution or a transitive hosting-IP verdict." } ], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "malwarebazaar", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:04.621124+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:04.258289+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:04.248592+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Candidate requires analyst validation", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:04.240883+00:00" }, { "observable_id": "observable-781d6056175d0c42acccf308", "type": "sha256", "value": "7c41a77c81ad105a586ea655d38846277c13e59341f0d572b8f0eb5ce8af2000", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-8b35ea3f1662f319106fafee", "type": "sha256", "value": "855a518348bdb64df2ac2fc743b2f2479d4b6fb69d9f87dcdc740ee5d5e03a40", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-6477de7db11afaf479448964", "type": "sha256", "value": "85c54a570e292f19e17fc817bdfdd11f501a95534b8e483629d91c605f38c896", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-7141c85050a3bc6c3b3e7902", "type": "sha256", "value": "876adf01df542fb8b0f263b3c41b1bf5b0c928f5b8a1205f5cb116b650843906", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-577a49446ace9ca8f1786def", "type": "sha256", "value": "89c5625aa0ecfeaa47ae9da990cda5ab80fe8088ab1cd55ee7394e870de5eafa", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2efb80932910ed9446f560a4", "type": "sha256", "value": "8aa9c596dd3eb7560bc7416ba181e858f1174fcbcb5432050f3f9a663ed1ffa2", "classification": "suspicious", "ioc_candidate": true, "reasons": [ { "kind": "static-review", "artifact_id": "artifact-533bfd4c90957b3cbb58a9e1", "features": [ "pe-bytes-under-non-executable-url-extension" ], "frames": [ 18931 ], "interpretation": "A transfer-bound PE is served under a non-executable URL extension. Investigate the exact recovered hash; this is not proof of execution or a transitive hosting-IP verdict." } ], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "malwarebazaar", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:05.315083+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:04.954661+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:04.952559+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Candidate requires analyst validation", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:04.950505+00:00" }, { "observable_id": "observable-f5395457e476483cc402d7ac", "type": "sha256", "value": "8c1c0d96e26bb0fe8578afd07244eae11bab36021b8484862ed81010b97a873d", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-9fdeaf36aa1f2b99783aeb16", "type": "sha256", "value": "8c426b04cd3debee6a21646f14d72a09db7ad335d1cf348484a654a7905760f5", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-37a5b4b8d7e81efe20c48b8c", "type": "sha256", "value": "95562c2db2cc4094800540ee79790996a5e1fab12a5a3a99432545af45eb2be8", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d2aaa3794e041135b0b64a51", "type": "sha256", "value": "974ec9b1a263ff7658a88da7dc41e55989ff284562111577e0b1fd36144c8bd7", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c9d07eb9c18fa2fab43b77b9", "type": "sha256", "value": "9b7024bd4a97fed7a3823a6d98653f66ec959b8e5b73aa533f7e78d0900f9e6d", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ffbb1714e92263a78f0ee808", "type": "sha256", "value": "9c50a96c859b9beea47b71740bd14e7f69a4df586d015f47434037f8def53b52", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-eec4713ca2415a80dd7870a8", "type": "sha256", "value": "a219ef1a0091feb8ab30c92f4a25833c4f431001bdec691af31878cdcaa1e43d", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-4dbe0c92895033cc153468e2", "type": "sha256", "value": "a869f2e254fb5a41a1745f2ad858148a990c11f543012e43f14780a0e3b57538", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f4a7bde78b2effd766512763", "type": "sha256", "value": "b42b0d8a915682fe8b49af799d072001ddc761191069bd18b2f2974c77a8cf65", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-8847efcc70dfbc32f3ca82ee", "type": "sha256", "value": "b6c573fcecf8b4204abd88d9076ae381da57f8969c241e9f08215d3016adc612", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-84230f61622febf22adab21b", "type": "sha256", "value": "be8eb05fd0a2321d069099b171050e5b03effc735dcb43da10d0751ca721a026", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-87629e6c9710b2d4910af7e6", "type": "sha256", "value": "c3bdfe5de3424f3d07872f6ecb6de79015e4301a4eb72803fbff251c41311f88", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-56bcee48fd3dffba445c2e66", "type": "sha256", "value": "c4015f58592d68396095b177ad8dd20f7c3910e2e08c0c81b24a9efd0f40c0c8", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e6c5f6e014b81e33ac58d824", "type": "sha256", "value": "c623c1144c540ad5f5ee378220c6237026df828fa5d63c95e072de454aa1113a", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-87780ebde50f911be1ef83f2", "type": "sha256", "value": "c683bc3d52a2a1a0b299fe17e0ccddf7fdc01d8b246fb1652ea258904a8bff7f", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0ec5abc100d17cbcbdac37c0", "type": "sha256", "value": "c76ea8b0db60dcccfdc0217059e37eb5b10d10940e649f9bc1d07d4ddcc797d1", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-9d518921fb2f718809849782", "type": "sha256", "value": "c942686010e285633d77a24341c43850ccd6162fcc7e8281ae8a70c2921a9af5", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f9d22b81db3b2691d42127d9", "type": "sha256", "value": "cf0d2bf5ac3284cc068e414be2a74d56bc5c1543413d3965aa96075114817a7a", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-cdd4d2dcda904b1c7c66ee35", "type": "sha256", "value": "d34dc64266e873c506a07bb00c46b2eef77d812e9c312bd12717fbb67b9740c2", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-eb0fce0251c8981ec6dfdeed", "type": "sha256", "value": "d5fd173d00d9733900834e0e1083de86b532e048b15c0420ba5c2db0623644b8", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-06b845b1a6520a8ebd08e1c1", "type": "sha256", "value": "d774beebaea68f3e3be399e441d6f5bf073ce036a8cce8a90b444c60d2985f04", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a61e6283d1417d174fe45e28", "type": "sha256", "value": "f0f761f95b7d8b5f5b64d8c078bb7e9274a0d248d73094d7d16581213c3fb7ef", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-083d838da0eec950a3a79fd7", "type": "sha256", "value": "f1a04b0b791b515d66978d2f6d2980bec1455795486bb71b19e7ad8a84aab865", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-982db7932a9e3be05374897b", "type": "sha256", "value": "f1d535264c136ef79dcbc92b30a25b313ed312dc611c92cd70d6470a1609ee88", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-22dd927b89b05e0ea7a5d400", "type": "sha256", "value": "fe4428ffba8707caf8541a0ca37cfc96234012a10d051e3362d9d05fbbd9e659", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d3c3ed12a0a52664cd402487", "type": "sha256", "value": "fef9b646dba5c7372fe92b6a9d227833c1d15d8cc3a73fd22be9d1869b21cd67", "classification": "suspicious", "ioc_candidate": true, "reasons": [ { "kind": "static-review", "artifact_id": "artifact-bdbd58f24a3993f922d9b197", "features": [ "pe-bytes-under-non-executable-url-extension" ], "frames": [ 20107 ], "interpretation": "A transfer-bound PE is served under a non-executable URL extension. Investigate the exact recovered hash; this is not proof of execution or a transitive hosting-IP verdict." } ], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "malwarebazaar", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:05.918008+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:05.672459+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:05.667874+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Candidate requires analyst validation", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:05.663198+00:00" }, { "observable_id": "observable-7c9504aadc9234c303483941", "type": "url", "value": "http://203.176.135.102:8082/yas20/LAPTOP-7XMV2SN_W10018363.CF3A0EAB425F1927835EF064A69CAED6/81/", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 448, "frame_number": 19116, "display_filter": "frame.number == 19116", "timestamp_epoch": "1583962613.434697000" }, { "tcp_stream": 449, "frame_number": 19547, "display_filter": "frame.number == 19547", "timestamp_epoch": "1583962615.812536000" }, { "tcp_stream": 465, "frame_number": 21096, "display_filter": "frame.number == 21096", "timestamp_epoch": "1583962639.795666000" }, { "tcp_stream": 555, "frame_number": 26673, "display_filter": "frame.number == 26673", "timestamp_epoch": "1583962672.861852000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-cfd1d057764f36cdb5c6a9d3", "type": "url", "value": "http://203.176.135.102:8082/yas20/LAPTOP-7XMV2SN_W10018363.CF3A0EAB425F1927835EF064A69CAED6/90", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 459, "frame_number": 20660, "display_filter": "frame.number == 20660", "timestamp_epoch": "1583962620.007347000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-cc20400a8f2ed86b5688bcf5", "type": "url", "value": "http://239.255.255.250:1900*", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "frame_number": 516, "display_filter": "frame.number == 516", "timestamp_epoch": "1583961757.053472000" }, { "frame_number": 518, "display_filter": "frame.number == 518", "timestamp_epoch": "1583961757.141829000" }, { "frame_number": 521, "display_filter": "frame.number == 521", "timestamp_epoch": "1583961757.317110000" }, { "frame_number": 522, "display_filter": "frame.number == 522", "timestamp_epoch": "1583961757.339046000" }, { "frame_number": 523, "display_filter": "frame.number == 523", "timestamp_epoch": "1583961757.467307000" }, { "frame_number": 806, "display_filter": "frame.number == 806", "timestamp_epoch": "1583961760.039998000" }, { "frame_number": 827, "display_filter": "frame.number == 827", "timestamp_epoch": "1583961760.150356000" }, { "frame_number": 832, "display_filter": "frame.number == 832", "timestamp_epoch": "1583961760.353574000" }, { "frame_number": 851, "display_filter": "frame.number == 851", "timestamp_epoch": "1583961760.385437000" }, { "frame_number": 865, "display_filter": "frame.number == 865", "timestamp_epoch": "1583961760.462907000" }, { "frame_number": 936, "display_filter": "frame.number == 936", "timestamp_epoch": "1583961763.041172000" }, { "frame_number": 937, "display_filter": "frame.number == 937", "timestamp_epoch": "1583961763.150914000" }, { "frame_number": 938, "display_filter": "frame.number == 938", "timestamp_epoch": "1583961763.478458000" }, { "frame_number": 1018, "display_filter": "frame.number == 1018", "timestamp_epoch": "1583961766.496768000" }, { "frame_number": 1047, "display_filter": "frame.number == 1047", "timestamp_epoch": "1583961769.510883000" }, { "frame_number": 1048, "display_filter": "frame.number == 1048", "timestamp_epoch": "1583961772.526214000" }, { "frame_number": 4311, "display_filter": "frame.number == 4311", "timestamp_epoch": "1583961851.807484000" }, { "frame_number": 4314, "display_filter": "frame.number == 4314", "timestamp_epoch": "1583961852.809426000" }, { "frame_number": 4331, "display_filter": "frame.number == 4331", "timestamp_epoch": "1583961853.810540000" }, { "frame_number": 4427, "display_filter": "frame.number == 4427", "timestamp_epoch": "1583961854.810945000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-eeb4337a8dbb1b3007ca3c8f", "type": "url", "value": "http://64.44.133.131/images/cursor.png", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 434, "frame_number": 19014, "display_filter": "frame.number == 19014", "timestamp_epoch": "1583962612.268574000" }, { "tcp_stream": 450, "frame_number": 19562, "display_filter": "frame.number == 19562", "timestamp_epoch": "1583962617.337739000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3138fdd2e3ee4fbe214f6c94", "type": "url", "value": "http://64.44.133.131/images/imgpaper.png", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 434, "frame_number": 18431, "display_filter": "frame.number == 18431", "timestamp_epoch": "1583962605.820456000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-9646aed15b817ab7a3b816bb", "type": "url", "value": "http://ajax.googleapis.com/ajax/libs/jquery/1.6.4/jquery.min.js", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 358, "frame_number": 13836, "display_filter": "frame.number == 13836", "timestamp_epoch": "1583962031.485239000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-24fc96d0fd5d080503a39f60", "type": "url", "value": "http://bolton-tech.com/YAS20.exe", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 259, "frame_number": 8616, "display_filter": "frame.number == 8616", "timestamp_epoch": "1583961876.516400000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f1404294eb97d21e15a16104", "type": "url", "value": "http://checkip.amazonaws.com/", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 389, "frame_number": 14981, "display_filter": "frame.number == 14981", "timestamp_epoch": "1583962320.240229000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-6e267d8df231953becc38b30", "type": "url", "value": "http://crl.securetrust.com/STCA.crl", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 491, "frame_number": 21909, "display_filter": "frame.number == 21909", "timestamp_epoch": "1583962651.430770000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-4755b93462d3f85bdd580050", "type": "url", "value": "http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?51a531bedcde571d", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 567, "frame_number": 27391, "display_filter": "frame.number == 27391", "timestamp_epoch": "1583962744.531400000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-4f3122566cf019fc99ad6889", "type": "url", "value": "http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?5674bbec2b11449f", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 268, "frame_number": 10329, "display_filter": "frame.number == 10329", "timestamp_epoch": "1583961934.226577000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-444088229dc88c13202ec653", "type": "url", "value": "http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/pinrulesstl.cab?38fdc717233a6bf2", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 567, "frame_number": 27394, "display_filter": "frame.number == 27394", "timestamp_epoch": "1583962744.555361000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-75a31165961d4e4f933d06c7", "type": "url", "value": "http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/pinrulesstl.cab?f0500d790de01784", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 268, "frame_number": 10332, "display_filter": "frame.number == 10332", "timestamp_epoch": "1583961934.251616000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-92f0e0707f82db9d80d697a4", "type": "url", "value": "http://files.markerly.com/main_toolbar_cdn.min.css", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 351, "frame_number": 13984, "display_filter": "frame.number == 13984", "timestamp_epoch": "1583962031.744315000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c58b71a5f02cbe8544e70052", "type": "url", "value": "http://files.markerly.com/markerly-cdn.js", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 351, "frame_number": 13377, "display_filter": "frame.number == 13377", "timestamp_epoch": "1583962027.490893000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b582ad9c58b849af7f1399e3", "type": "url", "value": "http://files.markerly.com/toolbar.cdn.min.js", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 351, "frame_number": 13902, "display_filter": "frame.number == 13902", "timestamp_epoch": "1583962031.571744000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b236e6d880311cb22e969e2f", "type": "url", "value": "http://fonts.googleapis.com/css?family=Fredericka+the+Great|Allura|Amatic+SC|Arizonia|Averia+Sans+Libre|Cabin+Sketch|Francois+One|Jacques+Francois+Shadow|Josefin+Slab|Kaushan+Script|Love+Ya+Like+A+Sister|Merriweather|Offside|Open+Sans|Open+Sans+Condensed|Oswald|Over+the+Rainbow|Pacifico|Romanesco|Sacramento|Seaweed+Script|Special+Elite", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 205, "frame_number": 4433, "display_filter": "frame.number == 4433", "timestamp_epoch": "1583961854.835217000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-dc4796b008a1e00021983df9", "type": "url", "value": "http://fonts.googleapis.com/css?family=News+Cycle|Bangers|Raleway:200", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 206, "frame_number": 4439, "display_filter": "frame.number == 4439", "timestamp_epoch": "1583961854.840436000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-df8ed075ec28999badfac8ed", "type": "url", "value": "http://fonts.gstatic.com/s/amaticsc/v13/TUZyzwprpvBS1izr_vOECuSf.woff2", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 220, "frame_number": 5066, "display_filter": "frame.number == 5066", "timestamp_epoch": "1583961856.201519000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ce32aeac02693d7a3e6fb1ef", "type": "url", "value": "http://fonts.gstatic.com/s/averiasanslibre/v8/ga6XaxZG_G5OvCf_rt7FH3B6BHLMEdVOEoI.woff2", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 222, "frame_number": 4958, "display_filter": "frame.number == 4958", "timestamp_epoch": "1583961856.075895000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c84af60ffcc734467bc9a2d4", "type": "url", "value": "http://fonts.gstatic.com/s/bangers/v12/FeVQS0BTqb0h60ACH55Q2A.woff2", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 215, "frame_number": 5062, "display_filter": "frame.number == 5062", "timestamp_epoch": "1583961856.177877000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-6627db43e3eab3028515c593", "type": "url", "value": "http://fonts.gstatic.com/s/kaushanscript/v8/vm8vdRfvXFLG3OLnsO15WYS5DG74wNI.woff2", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 224, "frame_number": 5071, "display_filter": "frame.number == 5071", "timestamp_epoch": "1583961856.209888000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3740838f308b39c4e686952a", "type": "url", "value": "http://fonts.gstatic.com/s/loveyalikeasister/v10/R70EjzUBlOqPeouhFDfR80-0FhOqJubN-BeL9Xxd.woff2", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 220, "frame_number": 4956, "display_filter": "frame.number == 4956", "timestamp_epoch": "1583961856.075659000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-67a9276f3197a33b3ec55177", "type": "url", "value": "http://fonts.gstatic.com/s/newscycle/v16/CSR64z1Qlv-GDxkbKVQ_fOAKTQ.woff2", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 222, "frame_number": 5065, "display_filter": "frame.number == 5065", "timestamp_epoch": "1583961856.201369000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-19b71387f53b1e5dce798a22", "type": "url", "value": "http://fonts.gstatic.com/s/opensans/v17/mem8YaGs126MiZpBA-UFVZ0b.woff2", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 215, "frame_number": 4917, "display_filter": "frame.number == 4917", "timestamp_epoch": "1583961856.047515000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a03511dec88d3b5190c8fef0", "type": "url", "value": "http://img.secureserver.net/t/1/tl/event?cts=1583961855884&ap=WSBv7&ds=1000&tce=1583961854653&tcs=1583961854581&tdc=1583961859120&tdclee=1583961855914&tdcles=1583961855886&tdi=1583961855886&tdl=1583961854740&tdle=1583961854581&tdls=1583961854506&tfs=1583961851561&tns=1583961851537&trqs=1583961854653&tre=1583961854727&trps=1583961854719&tles=1583961859120&tlee=1583961859184&dh=www.tuscaloosabarnyard.com&dp=%2F&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F80.0.3987.132%20Safari%2F537.36%20Edg%2F80.0.361.66&feedtype=perf&z=649269160", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 247, "frame_number": 7633, "display_filter": "frame.number == 7633", "timestamp_epoch": "1583961859.275730000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-47c5921591f178e6608a9c46", "type": "url", "value": "http://img1.wsimg.com/starfield/duel/v2.5.8/duel.js?appid=O3BkA5J1", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 207, "frame_number": 4475, "display_filter": "frame.number == 4475", "timestamp_epoch": "1583961854.850635000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-4d1a22ddfe484344189e9729", "type": "url", "value": "http://img1.wsimg.com/tcc/tcc_l.combined.1.0.5.min.js", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 207, "frame_number": 4638, "display_filter": "frame.number == 4638", "timestamp_epoch": "1583961855.179664000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-deb4e3a48c51726d385f2e81", "type": "url", "value": "http://img1.wsimg.com/wst/v7/WSB7_J_20200225_2323_DEP-18389_2679/v1/images/wsb-slideshow-arrows.png", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 207, "frame_number": 5450, "display_filter": "frame.number == 5450", "timestamp_epoch": "1583961856.581467000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-6d04b1f1715318d78cd8761d", "type": "url", "value": "http://img2.wsimg.com/starfield/duel/v2.5.8/sf.core/app.css", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 232, "frame_number": 5856, "display_filter": "frame.number == 5856", "timestamp_epoch": "1583961856.754926000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f926585840583f21be65f264", "type": "url", "value": "http://img4.wsimg.com/starfield/duel/v2.5.8/sf.core/sf.core.pkg.js", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 231, "frame_number": 5551, "display_filter": "frame.number == 5551", "timestamp_epoch": "1583961856.605293000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1996f3861e33dfa5b6d4c801", "type": "url", "value": "http://nebula.wsimg.com/18385e97e118628cd32e2d0c189f6eee?AccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 239, "frame_number": 6158, "display_filter": "frame.number == 6158", "timestamp_epoch": "1583961857.286584000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2c8dc4c23daec70ff415211b", "type": "url", "value": "http://nebula.wsimg.com/1a4f5564116de9920433f700c2a9c20c?AccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 211, "frame_number": 4640, "display_filter": "frame.number == 4640", "timestamp_epoch": "1583961855.181740000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d345038f85321b163707fb4e", "type": "url", "value": "http://nebula.wsimg.com/21eea24a60f7c8fb7ed4dcca63aca4f5?AccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 210, "frame_number": 9419, "display_filter": "frame.number == 9419", "timestamp_epoch": "1583961887.693830000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-cdeafcf04834828e9d3314db", "type": "url", "value": "http://nebula.wsimg.com/25a1c16c05755eb2ec17846b91efa5fe?AccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 211, "frame_number": 4477, "display_filter": "frame.number == 4477", "timestamp_epoch": "1583961854.851083000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-687d7fcacfba4f292b5cd787", "type": "url", "value": "http://nebula.wsimg.com/2b8f0431afda995f993087c8ec231ddf?AccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 210, "frame_number": 9821, "display_filter": "frame.number == 9821", "timestamp_epoch": "1583961895.296505000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a0f719b147307ec767e4d4a8", "type": "url", "value": "http://nebula.wsimg.com/3f2de843c79e006d37fb2ff42ab0d18c?AccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 210, "frame_number": 9006, "display_filter": "frame.number == 9006", "timestamp_epoch": "1583961880.076800000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-71ea331c379588a441c2c981", "type": "url", "value": "http://nebula.wsimg.com/5e2ea9aae9a1ca943046a6868cb3002b?AccessKeyId=531592D248B589D87A56&alloworigin=1", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 210, "frame_number": 4815, "display_filter": "frame.number == 4815", "timestamp_epoch": "1583961855.664609000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a49befeb682d8ae2e6ca5193", "type": "url", "value": "http://nebula.wsimg.com/6843f2b90530e6ec9ea7f397b0375735?AccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 211, "frame_number": 6077, "display_filter": "frame.number == 6077", "timestamp_epoch": "1583961857.236854000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0bf4b0af8560e0e3bf899360", "type": "url", "value": "http://nebula.wsimg.com/6e2b4120ae0b4dbcac9541ce80c5dd24?AccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 210, "frame_number": 6075, "display_filter": "frame.number == 6075", "timestamp_epoch": "1583961857.236308000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-66853a657a67893d57bf3a51", "type": "url", "value": "http://nebula.wsimg.com/893e2501ed5504c59ddf5b5352855b87?AccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 210, "frame_number": 8195, "display_filter": "frame.number == 8195", "timestamp_epoch": "1583961872.460195000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-64f0667143917a630ab0f82d", "type": "url", "value": "http://nebula.wsimg.com/90d173a36db4dc5268be43fbed9cde77?AccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 210, "frame_number": 4481, "display_filter": "frame.number == 4481", "timestamp_epoch": "1583961854.851687000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d9efc0c6c16d2fa2b14ba798", "type": "url", "value": "http://nebula.wsimg.com/98b20fd6aed4cfc29e428d4dd8e00930?AccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 238, "frame_number": 6156, "display_filter": "frame.number == 6156", "timestamp_epoch": "1583961857.286384000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d9386c3e37148fbf7e89dd9c", "type": "url", "value": "http://nebula.wsimg.com/c92f917c785f8c03f78b627d46aa8dc2?AccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 210, "frame_number": 7726, "display_filter": "frame.number == 7726", "timestamp_epoch": "1583961864.845032000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c1ea4c006a4246c855d0d540", "type": "url", "value": "http://nebula.wsimg.com/d0c5998dd42685ef31a2dbd195b7220e?AccessKeyId=53EA7A27C93C72E78336&disposition=0&alloworigin=1", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 210, "frame_number": 5452, "display_filter": "frame.number == 5452", "timestamp_epoch": "1583961856.581965000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-22940737a6f2b5a7a5b0b85d", "type": "url", "value": "http://nebula.wsimg.com/eea2577ebdcc219fe1962915e163ee72?AccessKeyId=531592D248B589D87A56&disposition=0&alloworigin=1", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 210, "frame_number": 4642, "display_filter": "frame.number == 4642", "timestamp_epoch": "1583961855.182260000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-50f6fd81a520981f8a7567ec", "type": "url", "value": "http://newegg.com/", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 467, "frame_number": 21154, "display_filter": "frame.number == 21154", "timestamp_epoch": "1583962650.405381000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-5d0130a845bbbf3e42b28a44", "type": "url", "value": "http://notable-quotes.com/", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 344, "frame_number": 13309, "display_filter": "frame.number == 13309", "timestamp_epoch": "1583962027.316706000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a496e71aa773a88bd14c9c26", "type": "url", "value": "http://notable-quotes.com/css/bootstrap.css", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 345, "frame_number": 13326, "display_filter": "frame.number == 13326", "timestamp_epoch": "1583962027.431505000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-97c0d1be303e11051a57276d", "type": "url", "value": "http://notable-quotes.com/css/style.css", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 344, "frame_number": 13363, "display_filter": "frame.number == 13363", "timestamp_epoch": "1583962027.488515000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-4ea918ba5d388a4f23a03992", "type": "url", "value": "http://notable-quotes.com/favicon.ico", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 345, "frame_number": 14008, "display_filter": "frame.number == 14008", "timestamp_epoch": "1583962031.859675000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-7aff9e8a6f9a798225f853a1", "type": "url", "value": "http://notable-quotes.com/images/facebook.png", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 346, "frame_number": 13369, "display_filter": "frame.number == 13369", "timestamp_epoch": "1583962027.489267000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-6259223e0967ab46a2b247a0", "type": "url", "value": "http://notable-quotes.com/images/googleplus.png", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 349, "frame_number": 13384, "display_filter": "frame.number == 13384", "timestamp_epoch": "1583962027.493415000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-8dfa75dc8cf922dc9082c5a9", "type": "url", "value": "http://notable-quotes.com/images/nqlogo2.png", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 347, "frame_number": 13371, "display_filter": "frame.number == 13371", "timestamp_epoch": "1583962027.489469000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f027f47347c52b879a5bd4db", "type": "url", "value": "http://notable-quotes.com/images/twitter.png", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 348, "frame_number": 13383, "display_filter": "frame.number == 13383", "timestamp_epoch": "1583962027.493360000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d7ab0a96e05ec5e9e940041c", "type": "url", "value": "http://notable-quotes.com/js/bootstrap.min.js", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 344, "frame_number": 13453, "display_filter": "frame.number == 13453", "timestamp_epoch": "1583962027.547622000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-38acb49d88cfb0e87a1ca41b", "type": "url", "value": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 273, "frame_number": 10500, "display_filter": "frame.number == 10500", "timestamp_epoch": "1583961955.838319000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-97f4a01818aa61df5d8207d8", "type": "url", "value": "http://platform.twitter.com/widgets.js", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 237, "frame_number": 6154, "display_filter": "frame.number == 6154", "timestamp_epoch": "1583961857.286196000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-804d843e4227adab325a4ae5", "type": "url", "value": "http://s7.addthis.com/js/300/addthis_widget.js", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 216, "frame_number": 4559, "display_filter": "frame.number == 4559", "timestamp_epoch": "1583961854.985134000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-9ae556073743a5685f946ed8", "type": "url", "value": "http://www.newegg.com/", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 469, "frame_number": 21202, "display_filter": "frame.number == 21202", "timestamp_epoch": "1583962650.547673000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c01f01f2f54163be9e94b016", "type": "url", "value": "http://www.notable-quotes.com/a/america_quote_8.jpg", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 352, "frame_number": 13467, "display_filter": "frame.number == 13467", "timestamp_epoch": "1583962027.570033000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a4f8858334104840455a9649", "type": "url", "value": "http://www.notable-quotes.com/a/apocalypse_quote_3.jpg", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 355, "frame_number": 13473, "display_filter": "frame.number == 13473", "timestamp_epoch": "1583962027.570585000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ebd4191fb87bf6d5d7dc7051", "type": "url", "value": "http://www.notable-quotes.com/w/wedding_quote.jpg", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 354, "frame_number": 13477, "display_filter": "frame.number == 13477", "timestamp_epoch": "1583962027.572340000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-12209ee671e6e10715c51d92", "type": "url", "value": "http://www.notable-quotes.com/w/wisdom_quote.jpg", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 353, "frame_number": 13468, "display_filter": "frame.number == 13468", "timestamp_epoch": "1583962027.570077000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-83adef5610506e78aa3e659a", "type": "url", "value": "http://www.tuscaloosabarnyard.com/", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 200, "frame_number": 4366, "display_filter": "frame.number == 4366", "timestamp_epoch": "1583961854.645117000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ed0606890d7c6aee88c030f8", "type": "url", "value": "http://www.tuscaloosabarnyard.com/favicon.ico", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 200, "frame_number": 7675, "display_filter": "frame.number == 7675", "timestamp_epoch": "1583961859.573307000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-7bd7d4ac851a59fe034c808c", "type": "url", "value": "http://www.tuscaloosabarnyard.com/site.css?v=", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 200, "frame_number": 4398, "display_filter": "frame.number == 4398", "timestamp_epoch": "1583961854.770626000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null } ], "counts": { "observed": 595, "suspicious": 3 }, "ioc_candidate_count": 3, "summary": "598 typed observations; 3 evidence-backed IOC candidates for review, including 0 with direct malicious provider reports. No automatic confirmation or attribution.", "limitations": [ "No detections, no record, missing credentials and provider errors do not mean benign.", "Current reputation may postdate the capture. Shared hosting, DNS resolution and graph overlap do not transfer maliciousness.", "A recovered file is not proof of execution; hashes identify exported bytes, including partial objects.", "Public-looking enterprise domains may still be sensitive: review selected targets before external disclosure." ], "enrichment_plan": { "policy": "evidence-priority-v2", "items": [ { "observable_id": "observable-7c3a374c518e1e8f1ce8988c", "type": "domain", "value": "helpforyourservice.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-fadb7cd5af8afbb4e006250c", "type": "domain", "value": "idsync.rlcdn.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1da897a56e11180802e489f3", "type": "domain", "value": "ie11welcome.microsoft.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-64d001a8850bdc20ade414e4", "type": "domain", "value": "image2.pubmatic.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-428a354cf08f0afe2889c67e", "type": "domain", "value": "images10.newegg.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3a5236bc7b03332a970ff733", "type": "domain", "value": "img.secureserver.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e8cbececcbc858f451f54f28", "type": "domain", "value": "insight.adsrvr.org", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-756ca6657cc65b69cca4fa9e", "type": "domain", "value": "k-ring.msedge.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3441bf67bbbf6a405d3a8261", "type": "domain", "value": "kv801.prod.do.dsp.mp.microsoft.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f70c35b771911bd9805c3cc0", "type": "domain", "value": "l-ring.msedge.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1d2d1631961603a5a97009c9", "type": "domain", "value": "licensing.mp.microsoft.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1c5253cd0939bf45e3179509", "type": "domain", "value": "load77.exelator.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-fdb92dc105b9ad577f7627f7", "type": "domain", "value": "loadus.exelator.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-30d42b2dc532dc4ae74cc6dd", "type": "domain", "value": "login.live.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1403cf37063322fc91404bc4", "type": "domain", "value": "login.microsoftonline.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3bdcc9dd920cb5b656b8f9e5", "type": "domain", "value": "m.addthis.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a1fd8da0b3a820effab4f100", "type": "domain", "value": "mapping.nxtck.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-fbf4b5fc9f947d16d46d33aa", "type": "domain", "value": "match.360yield.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-bbf823ff0ef3331f09a33f2a", "type": "domain", "value": "match.adsrvr.org", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1ba4ad4210590e9fa538109e", "type": "domain", "value": "match.prod.bidr.io", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-669b624feea051d1c5bdb496", "type": "domain", "value": "mrodevicemgr.officeapps.live.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-152c0bb01d7db215ea2f1ad1", "type": "domain", "value": "newegg.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5163c70db1f6eed80000f94a", "type": "domain", "value": "newegginc.demdex.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0dc9804496777de7651b6aa4", "type": "domain", "value": "nexusrules.officeapps.live.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-cd035e5d2692ceb8292af2ac", "type": "domain", "value": "notable-quotes.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c8e04c64ccebf25929dbea62", "type": "domain", "value": "ocsp.digicert.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-43a2028d2b3dab9060ebf667", "type": "domain", "value": "pf.newegg.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a3740dd418d129e8a25d8bf3", "type": "domain", "value": "pixel.advertising.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5e91c004b68199531edd00ef", "type": "domain", "value": "pixel.rubiconproject.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2f506e919718a20ac3f91717", "type": "domain", "value": "platform.twitter.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a4a42b8dbe065eb4a3ea6364", "type": "domain", "value": "play.google.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-aa3db9e0244f6bdddffd3b52", "type": "domain", "value": "promotions.newegg.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-cdf7f9517f749a20ef42ddf6", "type": "domain", "value": "pti.store.microsoft.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-408797bd97ba56a1977acae2", "type": "domain", "value": "px.steelhousemedia.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1d4b15cde435f57f8099df43", "type": "domain", "value": "rtb-csync.smartadserver.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-4c4a6b2473fec43c3df4aa23", "type": "domain", "value": "rum18.perf.linkedin.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e2e09c15ce773c4bd6f6baf2", "type": "domain", "value": "s-ring.msedge.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-53fcb2eb838e40eb38acdced", "type": "domain", "value": "s7.addthis.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-20dfb001ebf89a36e59000b1", "type": "domain", "value": "se.monetate.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-be53fb328ea526dc073bfd2c", "type": "domain", "value": "sealserver.trustwave.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-35dd3cfd7f14a191503a8140", "type": "domain", "value": "secure.adnxs.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-14d94dcd3be296b5b308f17a", "type": "domain", "value": "secure.newegg.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d585839b09664977e1501389", "type": "domain", "value": "securepubads.g.doubleclick.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-062259f9df6a178908737469", "type": "domain", "value": "self.events.data.microsoft.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-fd9c2bb0a887bfad0807561a", "type": "domain", "value": "settings-win.data.microsoft.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-4012c92c03e1ff6f7c4e624f", "type": "domain", "value": "slscr.update.microsoft.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-4629fc13a505594ee8182fd9", "type": "domain", "value": "spo-ring.msedge.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3d6c4a2169d82859d004c0c7", "type": "domain", "value": "states.newegg.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-65441b2cb1269de717e2221f", "type": "domain", "value": "stats.g.doubleclick.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-64a7be359bbfc67d8614c710", "type": "domain", "value": "storage.googleapis.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e31fb5e53e0ba0be343608b7", "type": "domain", "value": "storecatalogrevocation.storequality.microsoft.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e3c7e4671c16e822e96abfc1", "type": "domain", "value": "sts.eccmp.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-7fe7149d0f4dbf7723154cb3", "type": "domain", "value": "syndication.twitter.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d3191cee77eb4577b3eb21e6", "type": "domain", "value": "t-ring.msedge.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d7035f93d7c06d2520f9c614", "type": "domain", "value": "tag.rmp.rakuten.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1d498c6cda32c83396eb1f4d", "type": "domain", "value": "tags.rd.linksynergy.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0d7fc7b741e0a5776667b57e", "type": "domain", "value": "tags.tiqcdn.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8de0f9d7444ec3c9eaa1b63f", "type": "domain", "value": "tpc.googlesyndication.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0b0dc19a22110f4fa46e222e", "type": "domain", "value": "triggeredmail.appspot.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ef8f5fd8f7f1f51288181c65", "type": "domain", "value": "tring.clo.footprintdns.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-fac1c2b06e08a83d5bf0284d", "type": "domain", "value": "ups.analytics.yahoo.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-6bfaab96e21ec0eabfeac952", "type": "domain", "value": "ut.ra.linksynergy.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ac8a46d2072ba16f426284ef", "type": "domain", "value": "watson.telemetry.microsoft.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ce410ff47637cec445bf130f", "type": "domain", "value": "web.vortex.data.microsoft.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e1bab2915e68e6406b3144eb", "type": "domain", "value": "ww.steelhousemedia.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-50872cad0c040b00ae9fbfdf", "type": "domain", "value": "www.bing.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-7b4d7b0c039fda8ae0d04ddd", "type": "domain", "value": "www.facebook.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ebe0d28c238f30aa8d61f8e4", "type": "domain", "value": "www.google-analytics.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0980945d83b8ccd680c78656", "type": "domain", "value": "www.google.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-9ec6b47445a6b5af55b1ada4", "type": "domain", "value": "www.googleadservices.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-15d6f68e977e647646f4a81c", "type": "domain", "value": "www.googlecommerce.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-4906dac44b74bdf6f27705b0", "type": "domain", "value": "www.googletagmanager.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-cdf8bb11ffdda0ce0ac371e6", "type": "domain", "value": "www.googletagservices.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-843a66126bea490f84cc9e69", "type": "domain", "value": "www.newegg.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0fa85407bdf872ba691e1fe0", "type": "domain", "value": "www.notable-quotes.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-bd6db84d320ff7bc2704ebaa", "type": "domain", "value": "www.tuscaloosabarnyard.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-800538bf25c0941c1eb453f0", "type": "domain", "value": "www2.newegg.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-7f46c44c24a87d120d8303da", "type": "domain", "value": "z.moatads.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-27951bda77b95e7ec6e47c33", "type": "domain", "value": "bid.g.doubleclick.net", "priority": 45, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5dc3e8eb2540b970c0b4760e", "type": "domain", "value": "googleads.g.doubleclick.net", "priority": 45, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-86ad4a8bf68a516b326cb7f9", "type": "domain", "value": "imk.neweggimages.com", "priority": 45, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1f6a8dc39a4b04c3a70ad4a6", "type": "domain", "value": "laptop-7xmv2sn.mondogreek.com", "priority": 45, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2a974af09e0f6110be713817", "type": "domain", "value": "laptop-i9zpi04.mondogreek.com", "priority": 45, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-94f3dcbc41a142d880e28815", "type": "domain", "value": "laptop-sqsa42o.mondogreek.com", "priority": 45, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-fc33c33ba5b476a39d68358d", "type": "domain", "value": "mondogreek-dc.mondogreek.com", "priority": 45, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1b76603c1a8f61ac9432c1fb", "type": "domain", "value": "nypi.dc-storm.com", "priority": 45, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d4bc9bce2e6ea266c13c6ad8", "type": "domain", "value": "sb.monetate.net", "priority": 45, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-baf4f7f263ee4cd5141024fa", "type": "domain", "value": "v1.addthisedge.com", "priority": 45, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d5b15b5dd997b374ea204004", "type": "domain", "value": "www.addthis.com", "priority": 45, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b50cbaab6e81e18eea5a3edc", "type": "domain", "value": "www.combsscreenprinting.com", "priority": 45, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-36e9f1ae7e993c5b2c376995", "type": "ipv4", "value": "104.117.242.71", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8490263f7d35ab90f92fe084", "type": "ipv4", "value": "104.244.42.8", "priority": 45, "reasons": [ "tls_client_hello-peer", "unclassified_tcp-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d8a6229aebef63b05b453892", "type": "ipv4", "value": "104.254.148.166", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-7ec5efbd5609d5343b79c92d", "type": "ipv4", "value": "104.26.9.32", "priority": 45, "reasons": [ "tls_client_hello-peer", "unclassified_tcp-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-24af5f6a130979ccd202aa15", "type": "ipv4", "value": "104.36.113.17", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-9e5b0215393d67153dfbea31", "type": "ipv4", "value": "111.221.29.40", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ec08a15d131ea1fe9a94eab4", "type": "ipv4", "value": "13.107.136.254", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-31cdd3ccef2af17576e6d6cf", "type": "ipv4", "value": "13.107.18.254", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b4c71312c189a38661999891", "type": "ipv4", "value": "13.107.21.200", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-05bc871ccb71bda96018ef8b", "type": "ipv4", "value": "13.107.246.10", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e64f15836857d9c0b5a0a3f1", "type": "ipv4", "value": "13.107.246.254", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a456ee5d88ec997da66cd4ca", "type": "ipv4", "value": "13.107.3.128", "priority": 45, "reasons": [ "tls_client_hello-peer", "unclassified_tcp-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-fff0a3b3eda31053cc4098dd", "type": "ipv4", "value": "13.107.3.254", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c312f62fafbb7e01bc482e8c", "type": "ipv4", "value": "13.107.42.254", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-659efd51ebdf92fc9a9184ca", "type": "ipv4", "value": "13.107.43.14", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-10e7923a06108052cf5c1168", "type": "ipv4", "value": "13.107.5.80", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ddf24a77201a6d91ff08c01c", "type": "ipv4", "value": "13.107.6.158", "priority": 45, "reasons": [ "tls_client_hello-peer", "unclassified_tcp-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-7bdcaa3b4479d338df9e9de6", "type": "ipv4", "value": "13.107.6.254", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-75a562a0df4a1f4e6e45c591", "type": "ipv4", "value": "13.249.26.99", "priority": 45, "reasons": [ "tls_client_hello-peer", "unclassified_tcp-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-9713bd037b3e777fa06eaa41", "type": "ipv4", "value": "13.68.93.109", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-274fe42150261fb2bd34ecb6", "type": "ipv4", "value": "13.78.168.230", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d366901c404d8b0bd0229999", "type": "ipv4", "value": "13.78.177.144", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c3dd7b6348ad7e3e6c72c99a", "type": "ipv4", "value": "13.78.186.254", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-376d367b631b2f32abbf0f9b", "type": "ipv4", "value": "13.78.187.58", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d58477261d6d0fc1bc722fcb", "type": "ipv4", "value": "130.211.21.54", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-6d3b87783a9afefa9cd3d744", "type": "ipv4", "value": "130.211.28.134", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ad15654e216295edc1285484", "type": "ipv4", "value": "139.178.81.9", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8d7fb50f55724027f07675a4", "type": "ipv4", "value": "151.101.50.208", "priority": 45, "reasons": [ "tls_client_hello-peer", "unclassified_tcp-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-9cd1b3f3869eac56b33b670d", "type": "ipv4", "value": "152.199.4.210", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c7a59f11ef09f9113e0ec20a", "type": "ipv4", "value": "152.199.4.33", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2d07f626fad39f61b49ff75d", "type": "ipv4", "value": "169.46.74.216", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5b340e9a3d8aa5c39329a78c", "type": "ipv4", "value": "169.60.140.161", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f051f4dfd60028bb163b950c", "type": "ipv4", "value": "169.60.153.61", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b87cb72216b371c26b5c0da1", "type": "ipv4", "value": "172.217.1.142", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-831c4d1e0b6a83739a82d759", "type": "ipv4", "value": "172.217.12.74", "priority": 45, "reasons": [ "http_request-peer", "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-fa0f562b4d04b09df36ac0a1", "type": "ipv4", "value": "172.217.12.84", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-922357e7d3bd940d05bc0e92", "type": "ipv4", "value": "172.217.14.161", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3dc72f35bd15c85802d449d6", "type": "ipv4", "value": "172.217.14.162", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c70aa6a092966081ebb475d1", "type": "ipv4", "value": "172.217.2.226", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-29ccda1ba053fe1cafe485b6", "type": "ipv4", "value": "172.217.6.142", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0be7da622b6dd9e75e9ea518", "type": "ipv4", "value": "172.217.6.144", "priority": 45, "reasons": [ "http_request-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-82ecd561f7fba943cfe05476", "type": "ipv4", "value": "172.217.6.174", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ca80ac7475fb0e14ea6d31cd", "type": "ipv4", "value": "172.217.9.4", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-4554ae5028b623efed8e5112", "type": "ipv4", "value": "173.194.223.154", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5d9c8495b8bb1108e3b3062f", "type": "ipv4", "value": "18.213.117.209", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-cf758b2a38e275fd34c82089", "type": "ipv4", "value": "18.235.112.207", "priority": 45, "reasons": [ "http_request-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ebfad4e3a16bbd3bc46aea76", "type": "ipv4", "value": "185.14.31.98", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-399350cd25cfc81f0854faf9", "type": "ipv4", "value": "190.214.13.2", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-dad0ed97c020ca8b7214bf7b", "type": "ipv4", "value": "192.243.232.58", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d5ffc2d7e1823d05d44101b5", "type": "ipv4", "value": "198.23.252.135", "priority": 45, "reasons": [ "unclassified_tcp-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-fe361e0ba2a45b6b0b82a3dd", "type": "ipv4", "value": "199.187.193.166", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-02b263d892a37f177516df64", "type": "ipv4", "value": "199.247.13.144", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-63adcd67d00991ece5ea0213", "type": "ipv4", "value": "20.44.86.43", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-27f8fb39289e5e8b76956388", "type": "ipv4", "value": "204.79.197.200", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f473027743f35dffb42a329b", "type": "ipv4", "value": "204.79.197.222", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ef67f826d9abcfb82cc8ae33", "type": "ipv4", "value": "204.79.197.254", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-9b5f9bcf8293d228e1ab3e65", "type": "ipv4", "value": "205.185.216.42", "priority": 45, "reasons": [ "http_request-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e137a2ff68f8534bde63dc87", "type": "ipv4", "value": "209.97.130.197", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d3f1e1ad26d17224be7af003", "type": "ipv4", "value": "216.58.193.142", "priority": 45, "reasons": [ "tls_client_hello-peer", "unclassified_tcp-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5d8444509d39cca0b550cbe9", "type": "ipv4", "value": "216.58.194.104", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a37fc2e3ec141d80c085b051", "type": "ipv4", "value": "216.58.194.112", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-826c5434665ddd7c40c4ddde", "type": "ipv4", "value": "216.58.194.131", "priority": 45, "reasons": [ "http_request-peer", "tls_client_hello-peer", "unclassified_tcp-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-687793b86252a694dab3e57e", "type": "ipv4", "value": "216.58.194.42", "priority": 45, "reasons": [ "http_request-peer", "tls_client_hello-peer", "unclassified_tcp-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-73cfde24895a6d9741e9a4a9", "type": "ipv4", "value": "216.58.194.98", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d7f2d64503b9ab8642c8f76a", "type": "ipv4", "value": "23.199.252.214", "priority": 45, "reasons": [ "http_request-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a2c59f7f0de7a8f9f92f257f", "type": "ipv4", "value": "23.199.253.39", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e160e6c02dd6188778118f94", "type": "ipv4", "value": "23.199.253.53", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2980e7cb539777b049b3b28d", "type": "ipv4", "value": "23.204.16.227", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-82d8532e27e9e19e129f0bb5", "type": "ipv4", "value": "23.206.208.173", "priority": 45, "reasons": [ "http_request-peer", "tls_client_hello-peer", "unclassified_tcp-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-57bc2242caeb746ad8335346", "type": "ipv4", "value": "23.206.213.111", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-6560a94d4976b88c50180504", "type": "ipv4", "value": "23.211.36.128", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-72b146600cd0835f5cf885e2", "type": "ipv4", "value": "23.4.97.247", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-32771c3698ea070ca2f35b6b", "type": "ipv4", "value": "23.44.170.27", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e362901d03b4c8815cce34ba", "type": "ipv4", "value": "23.46.28.16", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-52fa104453d0239b31560014", "type": "ipv4", "value": "23.63.253.208", "priority": 45, "reasons": [ "http_request-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f26568356b674b79cfd613d2", "type": "ipv4", "value": "3.215.9.190", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8df7c6a4f4f3cf997506b8f7", "type": "ipv4", "value": "3.219.244.74", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-6da8882db38ffa12d257532e", "type": "ipv4", "value": "3.225.102.19", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-797b009776fca2932a7735a1", "type": "ipv4", "value": "31.13.65.36", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f7d0ff3f49b6d489bd11f0f1", "type": "ipv4", "value": "31.13.65.7", "priority": 45, "reasons": [ "tls_client_hello-peer", "unclassified_tcp-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-276855856ffbad3229628263", "type": "ipv4", "value": "31.13.93.35", "priority": 45, "reasons": [ "tls_client_hello-peer", "unclassified_tcp-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c12cbb48c141ca26f2e85832", "type": "ipv4", "value": "34.102.147.248", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b9b64bfd2a24e2a24f48c8c6", "type": "ipv4", "value": "34.208.131.21", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1fa350c532249dba35ca3c53", "type": "ipv4", "value": "34.209.127.1", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2e1504458a1e07935337b113", "type": "ipv4", "value": "34.211.22.199", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d4e9ab7b293c29fcb79d1f9e", "type": "ipv4", "value": "34.231.157.146", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-edfd38d3f7de9119854b9a88", "type": "ipv4", "value": "34.234.197.182", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5716d73809a44e521dc73d8b", "type": "ipv4", "value": "34.98.67.3", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1f6249767bb3bc866b5a5ffe", "type": "ipv4", "value": "35.190.72.21", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-552ce5be829db0c5f5c3989e", "type": "ipv4", "value": "35.241.23.116", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c566788760f12388af8501d4", "type": "ipv4", "value": "35.244.140.139", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ffc8e49ef9949a86e4550b8a", "type": "ipv4", "value": "40.119.2.214", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-12bb2e4e550ef1552546dc29", "type": "ipv4", "value": "40.126.0.67", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8f15c0a868af8a2219185627", "type": "ipv4", "value": "40.69.218.62", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f8b60f702f84f4460430c77e", "type": "ipv4", "value": "40.90.22.185", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0e691f48ea87c5370deb4ca6", "type": "ipv4", "value": "40.90.22.187", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-75ffe03a6b9baf21697950ef", "type": "ipv4", "value": "40.90.22.191", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-7e45f9cecbb4e8f34b395a9f", "type": "ipv4", "value": "40.91.76.238", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-901caf483d34c80e094d343f", "type": "ipv4", "value": "45.148.120.153", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3448c5ac0844d4fe3525eb6b", "type": "ipv4", "value": "51.254.164.244", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c0704f8bf8fac20faa7ada23", "type": "ipv4", "value": "52.109.12.19", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-844d34c3d5fb2912eb4ddc53", "type": "ipv4", "value": "52.109.8.30", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-32fe5196af63908fbfa2e48a", "type": "ipv4", "value": "52.109.88.36", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-23d88c5b5d35a70fa04a56c9", "type": "ipv4", "value": "52.114.132.73", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2d140cf426a13f83d3ad4eab", "type": "ipv4", "value": "52.114.77.34", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d0d970db98d3115a5c31d6c5", "type": "ipv4", "value": "52.161.15.246", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8bf43c3e36b9a51fb27fe6f3", "type": "ipv4", "value": "52.173.134.115", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-382c1d8f1def7330b9eeb437", "type": "ipv4", "value": "52.179.129.229", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-149d49c1ff2e9bfeb32f2f16", "type": "ipv4", "value": "52.230.220.159", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b73764d56fb3a2ebca36ce7e", "type": "ipv4", "value": "52.230.222.68", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-31652b02c3300c435efdbe38", "type": "ipv4", "value": "52.242.211.89", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3f343eb9c68cb1316e5e9509", "type": "ipv4", "value": "52.45.33.138", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-13ce1334882546a703581865", "type": "ipv4", "value": "52.9.108.55", "priority": 45, "reasons": [ "tls_client_hello-peer", "unclassified_tcp-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-15663109298445f0b0489145", "type": "ipv4", "value": "52.98.73.226", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c905906a982fb82f9af661d4", "type": "ipv4", "value": "54.153.98.238", "priority": 45, "reasons": [ "tls_client_hello-peer", "unclassified_tcp-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f7a9c523ffe4ab9176320edd", "type": "ipv4", "value": "54.244.36.123", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-78cc5ffa294e3dc95a58cdc9", "type": "ipv4", "value": "63.148.46.76", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2b5322d3090e87ff1451242d", "type": "ipv4", "value": "64.4.54.254", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a832b5529f07b9238f3eca48", "type": "ipv4", "value": "65.254.227.240", "priority": 45, "reasons": [ "http_request-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-6d3d535011aa12da5a499567", "type": "ipv4", "value": "72.167.191.69", "priority": 45, "reasons": [ "http_request-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f9e110a17e3abe42402d2476", "type": "ipv4", "value": "72.21.81.200", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2d15c69530a7d6f765352cca", "type": "ipv4", "value": "72.21.91.29", "priority": 45, "reasons": [ "http_request-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0145cd1ecc3af00f7412298a", "type": "ipv4", "value": "72.21.91.66", "priority": 45, "reasons": [ "http_request-peer", "tls_client_hello-peer", "unclassified_tcp-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-83e0e6eb8c3fd268f10dee36", "type": "ipv4", "value": "72.246.84.150", "priority": 45, "reasons": [ "http_request-peer", "tls_client_hello-peer", "unclassified_tcp-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-adbbfb70d7b4cca1d3ac730a", "type": "ipv4", "value": "72.246.84.229", "priority": 45, "reasons": [ "http_request-peer", "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c981880b162c784cdab9eb2e", "type": "ipv4", "value": "8.253.164.248", "priority": 45, "reasons": [ "http_request-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e99f7359be9d982b795daadb", "type": "ipv4", "value": "8.43.72.97", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-efbb0da9faee18dd3c7e6c7d", "type": "ipv4", "value": "89.187.164.37", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a4fd938c033f7e4794d725fa", "type": "sha256", "value": "00b3e28e084717e5fb9ba1f8a9cf7e9a854ded1b7b4721ed31110513013461dc", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2e5f3d5d154e82bc467b7294", "type": "sha256", "value": "01428897745e7b37849d922e35e28ad8585aca2a254d55f3b5adaecb0b3cb526", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-43b391507bda6928f5370960", "type": "sha256", "value": "06cb95758d706e8359a137118c05fb38af14616f870a0448d327c3203ee69973", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e86f3c2e5cc50cda536ad411", "type": "sha256", "value": "088111ecdfb3a045b7d594f7c4632561d30b72e15bc771d79812c172ea77e0de", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-aaf1d73959c6a9d75dd5e40a", "type": "sha256", "value": "0e687e2d9d394d7247d63b61aa33895b436f347eb73d8d1d1f99c199d2a0486e", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ed183895d54b237b74c2bd81", "type": "sha256", "value": "0e7a2be431ec48b8483bf126741dba1fc74260a35d944a1b8f0f6c2e0adfc9dd", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c657bfc8c9fd3ab5d54c4b2c", "type": "sha256", "value": "1e7a8021a029a0b1b97d9df2c059ad4fe80ff8d9db9564c593bdde97df48f5ff", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-471ac6cd6672a92b554a17a4", "type": "sha256", "value": "21bd143d38dbbae427615a7266a86a18dc95c417f3e510632d7a9180d98d3571", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e1498f67e46f3fd67f244430", "type": "sha256", "value": "232066e3f6f1351afdaee1acb70c409766641fd5669e0b55ce7c77fac0a857ef", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1e34c6c7ef3948c2d6bd773a", "type": "sha256", "value": "2458ec1dbcd980f7d484f0140f1d88e2088249eacf3411b2b2359afdf7774318", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-dcf7dac4aab970de1bbbe603", "type": "sha256", "value": "2aa0809ab9f586e743514b0ef60ece6f30dc7d5583d64c1d90cfb87c7019a2bf", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-12ac1c27281d4271edaf8a30", "type": "sha256", "value": "2ac97370caeb512780c9e407128aaa48e9ea92e34acfb427888e1a8027aa7723", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-52b72ce068b22af58a0a99f3", "type": "sha256", "value": "2e8b2448de2607edfbeba46bc40bdf5ff8a97afc21e36e0f2a8faaeb7802651d", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5305bcfeca2373b9ccc5948a", "type": "sha256", "value": "3291b96690178e55e4114c78a6241d3a6bd18aa7361626ff803b54064d178122", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-6e39d71744289702f8a9bb46", "type": "sha256", "value": "34efd2a999616fb13ef5fadece4481e978c68f2f3416713a4364a21fe81d3243", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0774e27fbd5cbb024f0befc8", "type": "sha256", "value": "34fc3b82e17c69e3cefd908d8e85848f2cdfcb180ba5c05a84ccd2c65e943e09", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ac4a1c8b66d7f01fa319b8f7", "type": "sha256", "value": "361c9f80feaefdda9eb1bb7ee61de56d922188898f69af4cf8a76c64fb0183ad", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ff0746f31ead3cf9f7442aac", "type": "sha256", "value": "3ddb722a10d4664abeb93659beefa009255d6cda0975a47944665976ad9e64cd", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-287190b56af5427b67e1f61b", "type": "sha256", "value": "3fd2858003c32f1542e7f330cfd1ef2dcd578f20c39bfdd22d70c57a801502b0", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-28dba225bfe2b3e8b92b83c1", "type": "sha256", "value": "49c45399074a6af07b176d55bb85b3de42b2c2889bf9efa37310b4e71cf14f43", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-349e4489ecc529830167d83f", "type": "sha256", "value": "4a0ba027a8859545d3caf300e4c8293248c6e878758cacb14f34e1cdc3d2e24d", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3c3697534acd4c4cfeb8c9bd", "type": "sha256", "value": "4b2f13582e24aa18d80a7efd5ca0862cbb68b414a3d9d37a9138c3873bdbbba8", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-bce57ae9850382626ad95ac8", "type": "sha256", "value": "567b1b26bdc881dbbae6afca179ba2597c243a6a045984bb61c8138a00389792", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-479939467ff23ecd759d926d", "type": "sha256", "value": "5adbad4e799ade940d96f6f293fc1ea535b504a6151555c879c5e183aeac1018", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1873c72c8e646510bd670d20", "type": "sha256", "value": "5b0d6fc1a80187419cfcc2340e6bf1a3e7704e8d65b44bee45a1caaab91138d2", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e28f78c24779bf9d5b531d8d", "type": "sha256", "value": "5c06f9a4898eae08a070b18d66d2162fd031833e993d1c0bf3bd9e7e83a6c526", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d1a8bfd3bdba5146ec89e038", "type": "sha256", "value": "626211f63483c4d5717e680816bc56119bcb9cdb3446c6d9241b119037ae724e", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-781d6056175d0c42acccf308", "type": "sha256", "value": "7c41a77c81ad105a586ea655d38846277c13e59341f0d572b8f0eb5ce8af2000", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8b35ea3f1662f319106fafee", "type": "sha256", "value": "855a518348bdb64df2ac2fc743b2f2479d4b6fb69d9f87dcdc740ee5d5e03a40", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-6477de7db11afaf479448964", "type": "sha256", "value": "85c54a570e292f19e17fc817bdfdd11f501a95534b8e483629d91c605f38c896", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-7141c85050a3bc6c3b3e7902", "type": "sha256", "value": "876adf01df542fb8b0f263b3c41b1bf5b0c928f5b8a1205f5cb116b650843906", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-577a49446ace9ca8f1786def", "type": "sha256", "value": "89c5625aa0ecfeaa47ae9da990cda5ab80fe8088ab1cd55ee7394e870de5eafa", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f5395457e476483cc402d7ac", "type": "sha256", "value": "8c1c0d96e26bb0fe8578afd07244eae11bab36021b8484862ed81010b97a873d", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-9fdeaf36aa1f2b99783aeb16", "type": "sha256", "value": "8c426b04cd3debee6a21646f14d72a09db7ad335d1cf348484a654a7905760f5", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-37a5b4b8d7e81efe20c48b8c", "type": "sha256", "value": "95562c2db2cc4094800540ee79790996a5e1fab12a5a3a99432545af45eb2be8", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d2aaa3794e041135b0b64a51", "type": "sha256", "value": "974ec9b1a263ff7658a88da7dc41e55989ff284562111577e0b1fd36144c8bd7", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c9d07eb9c18fa2fab43b77b9", "type": "sha256", "value": "9b7024bd4a97fed7a3823a6d98653f66ec959b8e5b73aa533f7e78d0900f9e6d", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ffbb1714e92263a78f0ee808", "type": "sha256", "value": "9c50a96c859b9beea47b71740bd14e7f69a4df586d015f47434037f8def53b52", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-eec4713ca2415a80dd7870a8", "type": "sha256", "value": "a219ef1a0091feb8ab30c92f4a25833c4f431001bdec691af31878cdcaa1e43d", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-4dbe0c92895033cc153468e2", "type": "sha256", "value": "a869f2e254fb5a41a1745f2ad858148a990c11f543012e43f14780a0e3b57538", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f4a7bde78b2effd766512763", "type": "sha256", "value": "b42b0d8a915682fe8b49af799d072001ddc761191069bd18b2f2974c77a8cf65", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8847efcc70dfbc32f3ca82ee", "type": "sha256", "value": "b6c573fcecf8b4204abd88d9076ae381da57f8969c241e9f08215d3016adc612", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-84230f61622febf22adab21b", "type": "sha256", "value": "be8eb05fd0a2321d069099b171050e5b03effc735dcb43da10d0751ca721a026", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-87629e6c9710b2d4910af7e6", "type": "sha256", "value": "c3bdfe5de3424f3d07872f6ecb6de79015e4301a4eb72803fbff251c41311f88", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-56bcee48fd3dffba445c2e66", "type": "sha256", "value": "c4015f58592d68396095b177ad8dd20f7c3910e2e08c0c81b24a9efd0f40c0c8", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e6c5f6e014b81e33ac58d824", "type": "sha256", "value": "c623c1144c540ad5f5ee378220c6237026df828fa5d63c95e072de454aa1113a", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-87780ebde50f911be1ef83f2", "type": "sha256", "value": "c683bc3d52a2a1a0b299fe17e0ccddf7fdc01d8b246fb1652ea258904a8bff7f", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0ec5abc100d17cbcbdac37c0", "type": "sha256", "value": "c76ea8b0db60dcccfdc0217059e37eb5b10d10940e649f9bc1d07d4ddcc797d1", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-9d518921fb2f718809849782", "type": "sha256", "value": "c942686010e285633d77a24341c43850ccd6162fcc7e8281ae8a70c2921a9af5", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f9d22b81db3b2691d42127d9", "type": "sha256", "value": "cf0d2bf5ac3284cc068e414be2a74d56bc5c1543413d3965aa96075114817a7a", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-cdd4d2dcda904b1c7c66ee35", "type": "sha256", "value": "d34dc64266e873c506a07bb00c46b2eef77d812e9c312bd12717fbb67b9740c2", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-eb0fce0251c8981ec6dfdeed", "type": "sha256", "value": "d5fd173d00d9733900834e0e1083de86b532e048b15c0420ba5c2db0623644b8", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-06b845b1a6520a8ebd08e1c1", "type": "sha256", "value": "d774beebaea68f3e3be399e441d6f5bf073ce036a8cce8a90b444c60d2985f04", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a61e6283d1417d174fe45e28", "type": "sha256", "value": "f0f761f95b7d8b5f5b64d8c078bb7e9274a0d248d73094d7d16581213c3fb7ef", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-083d838da0eec950a3a79fd7", "type": "sha256", "value": "f1a04b0b791b515d66978d2f6d2980bec1455795486bb71b19e7ad8a84aab865", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-982db7932a9e3be05374897b", "type": "sha256", "value": "f1d535264c136ef79dcbc92b30a25b313ed312dc611c92cd70d6470a1609ee88", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-22dd927b89b05e0ea7a5d400", "type": "sha256", "value": "fe4428ffba8707caf8541a0ca37cfc96234012a10d051e3362d9d05fbbd9e659", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0ae370cb268a03b560abddcf", "type": "domain", "value": "112.146.166.173.b.barracudacentral.org", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e9156ac12fe3d43eef54ec27", "type": "domain", "value": "112.146.166.173.cbl.abuseat.org", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c9d1d2a47f934606c8214c66", "type": "domain", "value": "112.146.166.173.dnsbl-1.uceprotect.net", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f6f11aff95e520a1108fd336", "type": "domain", "value": "112.146.166.173.spam.dnsbl.sorbs.net", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-05b72742a034fe11edc59623", "type": "domain", "value": "112.146.166.173.zen.spamhaus.org", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-4a0f0cd02d740dbca8387a46", "type": "domain", "value": "adhcinqls.mondogreek.com", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-50a552d0927c85adb0bd6caa", "type": "domain", "value": "dns.msftncsi.com", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-74fc8c4db993f08ad4ec7591", "type": "domain", "value": "kcvsmarszhnhqdd.mondogreek.com", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-bbb6fe6311bb3deeb8792faa", "type": "domain", "value": "msftspeechmodelsprod.azureedge.net", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0387d0395b96a9163ea27c46", "type": "domain", "value": "muewhinerfhe.mondogreek.com", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-598334da9c6a5dc0b261441d", "type": "domain", "value": "nhfbugwsjf.mondogreek.com", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-876ad876a2a05ecd0c7a6c8d", "type": "domain", "value": "nvzkinvuuinkgs.mondogreek.com", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1e16c976be53a9f9f7c880a9", "type": "domain", "value": "roijvdflsx.mondogreek.com", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5053a6ad945b2b10a724cc74", "type": "domain", "value": "twitter.com", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a002cc24dec2affa37d78150", "type": "domain", "value": "ukrtzhmkwhgj.mondogreek.com", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-390a43172c93fca895b0c134", "type": "domain", "value": "vbwxoaflt.mondogreek.com", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ffd616a26c7fc85d83a1aa3d", "type": "domain", "value": "vzxmvhjnnsazsyw.mondogreek.com", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-467d2539f56dab43ccb36218", "type": "domain", "value": "wpad.mondogreek.com", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0a308ab2ef090dce83d0d24e", "type": "domain", "value": "www.godaddy.com", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-76f59dc21699281723c0c5c3", "type": "domain", "value": "1605158521.rsc.cdn77.org", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-78901863fb1c158c12fb435a", "type": "domain", "value": "ads-bid.l.doubleclick.net", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a0a89ac65764adc7f94bc1ac", "type": "domain", "value": "arc.msn.com.nsatc.net", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-da0310415f379e8f0dc82c7e", "type": "domain", "value": "c.storage.googleapis.com", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-25d92732f145f581a9ce651a", "type": "domain", "value": "cm.everesttech.net.akadns.net", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c23ee5a2dfccf76f561af69d", "type": "domain", "value": "combsscreenprinting.com", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f4cd96e137b9d8a9477bf743", "type": "domain", "value": "cookie.coreprod.west2.steelhouse.com", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-943dc40f2a94a7d25cf5e991", "type": "domain", "value": "cs2005.wpc.alphacdn.net", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2ea6a0128f9f1f1e08a8ce77", "type": "domain", "value": "cs22.wpc.v0cdn.net", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b387642262723218d7f6c8fb", "type": "domain", "value": "cs9.wac.phicdn.net", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-384e3809ea37cafc57b8af9e", "type": "domain", "value": "dualstack.com.imgix.map.fastly.net", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e2b873d086441fb6d3dfeb98", "type": "domain", "value": "fe2cr.update.microsoft.com.akadns.net", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-cce8ddf852f7735cde2f67b7", "type": "domain", "value": "gstaticadssl.l.google.com", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d748acea2fb2b861d4a63bb1", "type": "domain", "value": "insight-760077375.us-east-1.elb.amazonaws.com", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-066115c1d1d7c67f02d74f92", "type": "domain", "value": "itm-efz.office.com", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-439d7a6fa04d5944ca678cd1", "type": "domain", "value": "l-0005.dc-msedge.net", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d733975cb9aec00ebbf3a952", "type": "domain", "value": "match-975362022.us-east-1.elb.amazonaws.com", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5c9303fb887e42bf457b8a76", "type": "domain", "value": "newegg.com.ssl.sc.omtrdc.net", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1e9f085bf4ea6b82d9170d74", "type": "domain", "value": "pagead.l.doubleclick.net", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d96525b4492194d007eb9f83", "type": "domain", "value": "pagead46.l.doubleclick.net", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-70f3911a93cbbe9592b0c533", "type": "domain", "value": "partnerad.l.doubleclick.net", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-57691020a7d51e6dfd5cd492", "type": "domain", "value": "pixel.rubiconproject.net.akadns.net", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f05a0ae62b2532ac94d7e518", "type": "domain", "value": "plus.l.google.com", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-01356047e0a784cb871ed12f", "type": "domain", "value": "prod.mrodevicemgr.live.com.akadns.net", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-39a46292a15be15a5f1932df", "type": "domain", "value": "prod.nexusrules.live.com.akadns.net", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f600b97968a199475b927715", "type": "domain", "value": "pxtm.steelhousemedia.com", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3f3891427c3c108ac264c220", "type": "domain", "value": "s-0001.s-msedge.net", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-72cdd77693b1dc882bc0d6cf", "type": "domain", "value": "scontent.xx.fbcdn.net", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-02bfb21a1ef9388b5e799d76", "type": "domain", "value": "settingsfd-geo.trafficmanager.net", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f96ef48d1952acced3ae4c3c", "type": "domain", "value": "star-mini.c10r.facebook.com", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a4a888286b45ad81f63afa84", "type": "domain", "value": "stats.l.doubleclick.net", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-653b03e3ba18826497365c1a", "type": "domain", "value": "tags-cluster.rd.linksynergy.com", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-4e21eeb94c49dfb824ea3611", "type": "domain", "value": "tuscaloosabarnyard.com", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-38d6b80c8108d3d8ba79c812", "type": "domain", "value": "umwatson.trafficmanager.net", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-efaf809fde38ece4cbac7d86", "type": "domain", "value": "www-google-analytics.l.google.com", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b34036b6c06367a28b7e1659", "type": "domain", "value": "www-googletagmanager.l.google.com", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-117eb10a51866a3788ab1f48", "type": "domain", "value": "www3.l.google.com", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c6a52b2cb59bc84f03f15d95", "type": "ipv4", "value": "104.105.248.178", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e67da5ddc7b420515bdd215f", "type": "ipv4", "value": "104.244.42.1", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-51dd877850ef2335c2ba9b99", "type": "ipv4", "value": "104.244.42.129", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3abfaf7e6c56d4397213f728", "type": "ipv4", "value": "104.244.42.136", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3059659c693dae3cfefab1f0", "type": "ipv4", "value": "104.244.42.200", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-30c984aa70aa0afb021463e6", "type": "ipv4", "value": "104.244.42.72", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-6416a8040e396afc73fdf5fd", "type": "ipv4", "value": "104.254.148.133", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-fd59a109bebd5b234e70001e", "type": "ipv4", "value": "104.254.148.165", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-51bf82e132088bdea7b04313", "type": "ipv4", "value": "104.254.148.196", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-789a3ba9d8709338d08c3609", "type": "ipv4", "value": "104.254.149.100", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-321c9a4f014e8807fd65b6bc", "type": "ipv4", "value": "104.254.149.101", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-68be57a33d1522039d6ea728", "type": "ipv4", "value": "104.254.149.68", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-852a15c86ac38173fb6183a1", "type": "ipv4", "value": "104.254.149.69", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-411957f7527145803efdc67c", "type": "ipv4", "value": "104.26.8.32", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-aa6a09d76eb1825962f6bdb4", "type": "ipv4", "value": "13.249.26.114", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2aa19fcf1636a414de489b1a", "type": "ipv4", "value": "13.249.26.125", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-42d1137d0bbbd812d2bb7e0e", "type": "ipv4", "value": "13.249.26.87", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-90d7a5a6cf040f7b1c6007d8", "type": "ipv4", "value": "131.107.255.255", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a5f3c1c25d5efd7b0275d41d", "type": "ipv4", "value": "172.245.249.117", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c8fca9d0eddefb6ff7bcce5f", "type": "ipv4", "value": "173.194.223.155", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-da0f75ae33bcc1227da6dd6d", "type": "ipv4", "value": "173.194.223.156", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f3cbf61c2082e45f918ccd00", "type": "ipv4", "value": "173.194.223.157", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a2e9313785f4fbb251591d7b", "type": "ipv4", "value": "18.204.46.201", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-58ae84053c3fc941451613f4", "type": "ipv4", "value": "18.208.78.141", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-4a83e6a62f06198f8c5dbd91", "type": "ipv4", "value": "18.211.91.10", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-297cab48e03c404da9ce77e7", "type": "ipv4", "value": "18.214.132.216", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-476948b12c8e07674f72cd97", "type": "ipv4", "value": "18.232.32.205", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f50a516368eb9fbdccbf39ba", "type": "ipv4", "value": "18.233.90.151", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c8a090c852f0d9adbf4eab1c", "type": "ipv4", "value": "185.141.27.238", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2b5f81c2541070def26ad339", "type": "ipv4", "value": "185.180.198.50", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-09ee1310276d4651cd54c178", "type": "ipv4", "value": "195.123.242.48", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-42dad44edf1f21b60ba08345", "type": "ipv4", "value": "198.23.252.130", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-fba1b1437d3caa5fa48917b9", "type": "ipv4", "value": "205.185.216.10", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-bd58aa91bb2bc03f14e0e413", "type": "ipv4", "value": "23.199.253.242", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-216321716ed926a1cfdeb6cf", "type": "ipv4", "value": "23.204.68.230", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-51bba2a7439ce055061b555a", "type": "ipv4", "value": "23.46.28.24", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5520df03d2f3af7d51f09a7f", "type": "ipv4", "value": "23.63.253.147", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3890ed97741d35f640d54fc9", "type": "ipv4", "value": "3.208.14.195", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-52f7a99c324d9d1140ba7273", "type": "ipv4", "value": "3.211.188.196", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-696e903634b226656eb5ad02", "type": "ipv4", "value": "3.212.136.177", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-db715eb129e1f507cd974269", "type": "ipv4", "value": "3.213.24.71", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-6e50015a679511870409877a", "type": "ipv4", "value": "3.217.52.69", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-6a13837642f3c983d7af03d6", "type": "ipv4", "value": "3.218.90.66", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-026938190305caa827f2ed60", "type": "ipv4", "value": "3.224.145.145", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-24bfc7f5cd9a1f06bdc1c47f", "type": "ipv4", "value": "3.92.109.57", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1fe87e109f924fcc0e8b25b5", "type": "ipv4", "value": "34.192.244.88", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-815cfa137ef572df9feedf21", "type": "ipv4", "value": "34.192.250.175", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-fefdbc9d21ff21ac122363ea", "type": "ipv4", "value": "34.193.215.190", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-363a9252d915c7e4d51a2afc", "type": "ipv4", "value": "34.194.253.146", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-963b7cfcd00bd0fa4485bb98", "type": "ipv4", "value": "34.196.181.158", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-933c849ba5ccb856258e19b5", "type": "ipv4", "value": "34.197.12.81", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-23339749bb5370af1defb56d", "type": "ipv4", "value": "34.206.247.240", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-91a655a9597691c42572dc45", "type": "ipv4", "value": "34.208.124.133", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-eb14020ff65e8b7d60dd5324", "type": "ipv4", "value": "34.208.36.157", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-9fa2aaf08e9df9a2a4dae738", "type": "ipv4", "value": "34.212.232.109", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1aaf979bbed278f691bd024c", "type": "ipv4", "value": "34.213.227.128", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c2027fe767a0b064bf2fc1e3", "type": "ipv4", "value": "34.224.92.105", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-17fceabe2ab49d8a1302f0ca", "type": "ipv4", "value": "34.225.211.231", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-24f9dab2293a866b8b89dca5", "type": "ipv4", "value": "34.231.65.133", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3eb5116a714dbcfba08fdd6f", "type": "ipv4", "value": "34.232.94.82", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b5d6d09d0be7a94aab3c4ea9", "type": "ipv4", "value": "34.234.23.242", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-df66da7c0d834dadb2a9a61e", "type": "ipv4", "value": "34.236.165.152", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-83ab37863754b87df9cf37b6", "type": "ipv4", "value": "35.161.118.223", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-54d391ca599767ad2d787054", "type": "ipv4", "value": "35.161.52.15", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-935b9486dc3d95f6f2b76b2b", "type": "ipv4", "value": "35.163.173.161", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-deee192e3820de882c3aaabf", "type": "ipv4", "value": "35.167.5.179", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-734003cf6b0ac079888d17fa", "type": "ipv4", "value": "35.169.43.149", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-224a863bbbe67d186970d2ff", "type": "ipv4", "value": "40.100.155.18", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-fcdb51b2c630cd83f1063eb1", "type": "ipv4", "value": "40.100.155.2", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-6d9ebc2e200af1ca86128afc", "type": "ipv4", "value": "40.126.0.65", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2985a2c27ef44bd660510f2f", "type": "ipv4", "value": "40.126.0.66", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3ae4f5896bfb92f0e49a06cf", "type": "ipv4", "value": "40.126.0.68", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-6bd7725f8e1544d9d17d020d", "type": "ipv4", "value": "40.126.0.69", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2c54a7db047c514da40801c6", "type": "ipv4", "value": "40.126.0.71", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-351f15c26bb6ae43146256ac", "type": "ipv4", "value": "40.126.0.72", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-789bf898ccdfdc85b98c117e", "type": "ipv4", "value": "40.126.0.73", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-bec5bec32ff689bd5af2156d", "type": "ipv4", "value": "40.90.22.183", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5a8bbf6ea195c14de99c72cd", "type": "ipv4", "value": "40.90.22.188", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-6b77d4ed0020f8229fbd1238", "type": "ipv4", "value": "40.90.22.189", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b73fe1a7bbb1a93ee294edce", "type": "ipv4", "value": "40.90.22.190", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-6d7d53dc686f91852a63cb26", "type": "ipv4", "value": "52.0.81.73", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-296bc8ca665ee8edf438cd1e", "type": "ipv4", "value": "52.2.35.4", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-082d61d238beef3217627724", "type": "ipv4", "value": "52.201.53.231", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-dd00cf1865319c43a6481154", "type": "ipv4", "value": "52.202.136.43", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8f75be07e9afd189e5bf14f7", "type": "ipv4", "value": "52.202.7.233", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a81bf85bd787e589c4eecac3", "type": "ipv4", "value": "52.204.219.227", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a08247ea10f2de4dd61c3990", "type": "ipv4", "value": "52.204.222.100", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f9c975b2826dad73b2e342c2", "type": "ipv4", "value": "52.206.178.1", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-105cb8461e214e54e86eb4d0", "type": "ipv4", "value": "52.23.116.187", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b0bb4dd223044664f01b3a45", "type": "ipv4", "value": "52.3.121.18", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2b831c66817e906a0f82696b", "type": "ipv4", "value": "52.70.73.113", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2a237f3c00e4e967e33c589b", "type": "ipv4", "value": "52.73.178.122", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-87757fb77355128439b9297f", "type": "ipv4", "value": "52.98.73.210", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-80b5ebca70f2b14d43837e7d", "type": "ipv4", "value": "52.98.73.242", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5e38c9d3e1f05862a63a4235", "type": "ipv4", "value": "52.98.77.66", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-7885680650d446cb8e40f569", "type": "ipv4", "value": "52.98.77.82", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-46cdf533a8ccf34a41a1ee6a", "type": "ipv4", "value": "52.98.80.210", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8de04fe6c964dfafd4738ed5", "type": "ipv4", "value": "52.98.81.178", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b6e773759ee8f83e2ca88c0f", "type": "ipv4", "value": "52.98.81.2", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d401b9d080f87c39fe6294e6", "type": "ipv4", "value": "52.98.93.2", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-011d56c6b0c2e29279ffc532", "type": "ipv4", "value": "54.173.98.209", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ba092c79f590d914609ddf66", "type": "ipv4", "value": "54.175.87.114", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-739a1b04a5e2d8e490e3a9c3", "type": "ipv4", "value": "54.197.51.7", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-841104cd06b068235b239530", "type": "ipv4", "value": "54.213.212.101", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1925176da8b005304f178a61", "type": "ipv4", "value": "54.68.183.142", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-cde9406325fb1e81bb2a7fb1", "type": "ipv4", "value": "54.83.179.223", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-515ebb6775fc345726119657", "type": "ipv4", "value": "54.83.97.43", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c0866de89a145dbcc5058eb3", "type": "ipv4", "value": "54.86.220.14", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-266225aa53818a8996c40267", "type": "ipv4", "value": "67.27.98.254", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-6b5fcf86249dd1e55c8f6d7b", "type": "ipv4", "value": "67.27.99.254", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-05be0fd501cf93d815b15d11", "type": "ipv4", "value": "8.253.112.120", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b20149df43cda8a66537d7c4", "type": "ipv4", "value": "8.253.164.240", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-fee7e5ceb1c600cc1b3dde8a", "type": "ipv4", "value": "8.43.72.98", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-7eda0f2160c7166adbe45a69", "type": "sha256", "value": "68798ccf8e2a5f9682a4e011bec288ad9b3f900244f82c6ae5e8ca538725f92e", "priority": 100, "reasons": [ "existing-evidence-candidate", "recovered-pe-bytes" ], "direct_checked": false, "checked_providers": [ "malwarebazaar", "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": true }, { "observable_id": "observable-2efb80932910ed9446f560a4", "type": "sha256", "value": "8aa9c596dd3eb7560bc7416ba181e858f1174fcbcb5432050f3f9a663ed1ffa2", "priority": 100, "reasons": [ "existing-evidence-candidate", "recovered-pe-bytes" ], "direct_checked": false, "checked_providers": [ "malwarebazaar", "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": true }, { "observable_id": "observable-d3c3ed12a0a52664cd402487", "type": "sha256", "value": "fef9b646dba5c7372fe92b6a9d227833c1d15d8cc3a73fd22be9d1869b21cd67", "priority": 100, "reasons": [ "existing-evidence-candidate", "recovered-pe-bytes" ], "direct_checked": false, "checked_providers": [ "malwarebazaar", "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": true }, { "observable_id": "observable-85340b2b43a54acdc129ba7f", "type": "sha256", "value": "02db3c6b9aff73bf8a11c41107c836b6c800c919c5d3d1304f336aee03f79f4c", "priority": 95, "reasons": [ "recovered-pe-bytes" ], "direct_checked": false, "checked_providers": [ "malwarebazaar", "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-bb90e25f4a050fb1c116e7c0", "type": "sha256", "value": "1ca2faaa4a7ba86c934c337dcb47ebd521dd5721a9f62302ef36f074c1a4c8d8", "priority": 95, "reasons": [ "recovered-script-like-text-bytes" ], "direct_checked": false, "checked_providers": [ "malwarebazaar", "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-90e67161e4374a86a235355c", "type": "sha256", "value": "5638ee72bed581aec1cf09b1e7fdeb37a23b69d8f5927ca00b84f2286a695066", "priority": 95, "reasons": [ "recovered-script-like-text-bytes" ], "direct_checked": false, "checked_providers": [ "malwarebazaar", "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-4cda9a6c6ae54c3360daafe8", "type": "domain", "value": "bolton-tech.com", "priority": 80, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2d56ef3bc0ec648cce947c26", "type": "domain", "value": "img1.wsimg.com", "priority": 80, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-637e04571d4102417d69d826", "type": "domain", "value": "img2.wsimg.com", "priority": 80, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-513895eac4dd944e6f14f739", "type": "domain", "value": "img4.wsimg.com", "priority": 80, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c92d01e31450bef11e65f195", "type": "domain", "value": "nebula.wsimg.com", "priority": 80, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-cb80e882345115fb814bf57a", "type": "ipv4", "value": "23.209.74.120", "priority": 80, "reasons": [ "http_request-peer", "served-inspectable-file-not-transitive-verdict", "unclassified_tcp-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-08e6bd1fc40023076fe11df5", "type": "ipv4", "value": "23.211.18.27", "priority": 80, "reasons": [ "http_request-peer", "served-inspectable-file-not-transitive-verdict", "tls_client_hello-peer", "unclassified_tcp-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1fa516e46dc6dd3ae28c5f77", "type": "ipv4", "value": "50.87.248.17", "priority": 80, "reasons": [ "http_request-peer", "served-inspectable-file-not-transitive-verdict" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f0ae0595f3e5d7ee92b7e4a8", "type": "ipv4", "value": "64.44.133.131", "priority": 80, "reasons": [ "http_request-peer", "served-inspectable-file-not-transitive-verdict" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-4c1bb410881eeb8df3d499a3", "type": "domain", "value": "mondogreek.com", "priority": 60, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-db313399ad53bc3a475fd5a1", "type": "ipv4", "value": "203.176.135.102", "priority": 60, "reasons": [ "http_request-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-41204ee1d75e0b6e880227c2", "type": "domain", "value": "3750657afd7bdc4d4398b8849268b8a3.nrb.footprintdns.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-32208ce5507d21c89db7990e", "type": "domain", "value": "3af21bab922f1a3fff13816e3eed341a.clo.footprintdns.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0191862f5d2c7a51df93d6c9", "type": "domain", "value": "7754def074cd4b67fe16c8cfdb10e874.clo.footprintdns.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-604f3c7b82d84a07d610fc10", "type": "domain", "value": "a-ring.msedge.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-65e20b1da385060b3d5293ac", "type": "domain", "value": "act-us.rd.linksynergy.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-585bd071d4dee9cd569191f3", "type": "domain", "value": "adservice.google.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-17eddbab547f394592b74c04", "type": "domain", "value": "ajax.googleapis.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-43e7c41d5fa5db1d10ab694e", "type": "domain", "value": "api.bing.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-15f9c9217630fff58412e4d0", "type": "domain", "value": "apis.google.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-544f05eadedd9cba76d91c5d", "type": "domain", "value": "arc.msn.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-245b597dbb970839092a032e", "type": "domain", "value": "array801.prod.do.dsp.mp.microsoft.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0a0e108c1217475396615e9a", "type": "domain", "value": "array802.prod.do.dsp.mp.microsoft.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2a19bbce2fa3cf90d33d60ca", "type": "domain", "value": "array803.prod.do.dsp.mp.microsoft.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1d67d6de284f0bdbade853f6", "type": "domain", "value": "array807.prod.do.dsp.mp.microsoft.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b58abbea21a98641535af6c9", "type": "domain", "value": "assets.adobedtm.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5d3e59cc7011ccb30047b5b9", "type": "domain", "value": "az725175.vo.msecnd.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-66fcfd3b0edf7b64db4f5e0b", "type": "domain", "value": "b-ring.msedge.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-7113586740877f7bdc0118df", "type": "domain", "value": "c1.neweggimages.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f0382da974f4947210d0bfda", "type": "domain", "value": "checkip.amazonaws.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f8b1236ba7d07fae4345bdd8", "type": "domain", "value": "client.wns.windows.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2544d55789420327e442a050", "type": "domain", "value": "cm.everesttech.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f9a97b240d38b14d02f7925c", "type": "domain", "value": "cm.g.doubleclick.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b34e47e49b9d4dca6459389b", "type": "domain", "value": "config.edge.skype.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-097426c7715099a8e7103cf4", "type": "domain", "value": "connect.facebook.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-76152bf96069bc445aac9ffe", "type": "domain", "value": "consent.dc-storm.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-036bcf14e458ef91ddbd8a0b", "type": "domain", "value": "consent.jrs5.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-7d2ae74abd75181862da750c", "type": "domain", "value": "consent.linksynergy.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-80b2ac8a6e80132067fb44d4", "type": "domain", "value": "consent.mediaforge.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0e61e6d1985d312211428cd4", "type": "domain", "value": "consent.nxtck.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a66273e03527b18aa0d9cf08", "type": "domain", "value": "cookie-sync-service-prod.steelhousemedia.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-06b4160fe8f02466535caf5e", "type": "domain", "value": "cp801.prod.do.dsp.mp.microsoft.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d0add20799ca79c7bb7aeda7", "type": "domain", "value": "crl.securetrust.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a5716e3c4855000d423c0b10", "type": "domain", "value": "ctldl.windowsupdate.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-971b077dcad87d68e277ce9c", "type": "domain", "value": "disc801.prod.do.dsp.mp.microsoft.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-868b982523a66112cca36b0b", "type": "domain", "value": "dp58aslhmbcib.cloudfront.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5fb817e280a1925ed15c1d17", "type": "domain", "value": "dpm.demdex.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d03ab386fad7cbafb5fbf028", "type": "domain", "value": "dsum-sec.casalemedia.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a6a385ab23ca13e828a5ed07", "type": "domain", "value": "dx.steelhousemedia.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-fbbbca3371089da6171e98db", "type": "domain", "value": "ec-apis.newegg.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b8156b9826eb0e7ac59cfeb4", "type": "domain", "value": "edge.microsoft.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a9f3b5dee051b894dcb70668", "type": "domain", "value": "eu-u.openx.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-11bfdbf09a08e9ab40200fd4", "type": "domain", "value": "f.monetate.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-fdb5485f3b86bcc9a06dec97", "type": "domain", "value": "fareharbor.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-36821d46676685b73ef96232", "type": "domain", "value": "fe2cr.update.microsoft.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f350c583e37d4c9be78d65d4", "type": "domain", "value": "fe3cr.delivery.mp.microsoft.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b93bff5eb8f2a9044b5d0371", "type": "domain", "value": "fh-kit.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-746486615a0c4b39cc3c774f", "type": "domain", "value": "fh-sites.imgix.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0b31f0b17fe65eae874a44b4", "type": "domain", "value": "files.markerly.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a4a3a1f54b8c3b40fc765aaa", "type": "domain", "value": "fonts.googleapis.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3ce1aed19b8676ac4483f0bb", "type": "domain", "value": "fonts.gstatic.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-23a9781200a3890a101cffbd", "type": "domain", "value": "fp-afd.azureedge.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0f688f7f7e8ff4eb423f405c", "type": "domain", "value": "fp-as.azureedge.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-72aea44564d9fc3480a43963", "type": "domain", "value": "fp-vp.azureedge.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0e8573cd0b6b47b4aece50cf", "type": "domain", "value": "fp.msedge.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-92abde5cd08edeadc2f99562", "type": "domain", "value": "geo.prod.do.dsp.mp.microsoft.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-522ef96dc30c20264516468e", "type": "domain", "value": "go.microsoft.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f7617f8cef59730032c2c46c", "type": "domain", "value": "hakunamatatata.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1fd8e066886a6c8af4164897", "type": "domain", "value": "help.newegg.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false } ], "eligible_count": 519, "next_batch": [ "observable-7c3a374c518e1e8f1ce8988c", "observable-fadb7cd5af8afbb4e006250c", "observable-1da897a56e11180802e489f3", "observable-64d001a8850bdc20ade414e4", "observable-428a354cf08f0afe2889c67e", "observable-3a5236bc7b03332a970ff733", "observable-e8cbececcbc858f451f54f28", "observable-756ca6657cc65b69cca4fa9e", "observable-3441bf67bbbf6a405d3a8261", "observable-f70c35b771911bd9805c3cc0" ], "scope": "Query recommendations, not IOC verdicts. Partial provider coverage stays pending; cooldowns/credential failures are not completed checks. Checked means completed attempted direct providers, not all available providers. Review before external disclosure." }, "assessment_sha256": "fb5331850ba125f73c605e4b158c4e295f9056cc73c5dcfe31a54ad66d8f1e30" }, "enrichment": { "items": [ { "type": "domain", "value": "help.newegg.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:22.510826+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:22.505357+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:22.500770+00:00", "observable_id": "observable-1fd8e066886a6c8af4164897" }, { "type": "domain", "value": "hakunamatatata.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:22.303632+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:22.301085+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:22.296130+00:00", "observable_id": "observable-f7617f8cef59730032c2c46c" }, { "type": "domain", "value": "go.microsoft.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:22.062012+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:22.060222+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:22.057812+00:00", "observable_id": "observable-522ef96dc30c20264516468e" }, { "type": "domain", "value": "geo.prod.do.dsp.mp.microsoft.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:21.871597+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:21.867167+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:21.862611+00:00", "observable_id": "observable-92abde5cd08edeadc2f99562" }, { "type": "domain", "value": "fp.msedge.net", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:21.666722+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:21.664841+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:21.662122+00:00", "observable_id": "observable-0e8573cd0b6b47b4aece50cf" }, { "type": "domain", "value": "fp-vp.azureedge.net", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:20.879395+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:20.874919+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:20.870059+00:00", "observable_id": "observable-72aea44564d9fc3480a43963" }, { "type": "domain", "value": "fp-as.azureedge.net", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:20.567068+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:20.563050+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:20.556357+00:00", "observable_id": "observable-0f688f7f7e8ff4eb423f405c" }, { "type": "domain", "value": "fp-afd.azureedge.net", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:20.257825+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:20.252528+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:20.247471+00:00", "observable_id": "observable-23a9781200a3890a101cffbd" }, { "type": "domain", "value": "fonts.gstatic.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:19.985832+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:19.983395+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:19.980322+00:00", "observable_id": "observable-3ce1aed19b8676ac4483f0bb" }, { "type": "domain", "value": "fonts.googleapis.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:19.818148+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:19.816332+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:19.814239+00:00", "observable_id": "observable-a4a3a1f54b8c3b40fc765aaa" }, { "type": "domain", "value": "files.markerly.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:19.645748+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:19.639820+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:19.634972+00:00", "observable_id": "observable-0b31f0b17fe65eae874a44b4" }, { "type": "domain", "value": "fh-sites.imgix.net", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:19.434677+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:19.430591+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:19.426379+00:00", "observable_id": "observable-746486615a0c4b39cc3c774f" }, { "type": "domain", "value": "fh-kit.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:19.188327+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:19.184097+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:19.179552+00:00", "observable_id": "observable-b93bff5eb8f2a9044b5d0371" }, { "type": "domain", "value": "fe3cr.delivery.mp.microsoft.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:18.983978+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:18.978586+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:18.973227+00:00", "observable_id": "observable-f350c583e37d4c9be78d65d4" }, { "type": "domain", "value": "fe2cr.update.microsoft.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:18.790645+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:18.787595+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:18.783568+00:00", "observable_id": "observable-36821d46676685b73ef96232" }, { "type": "domain", "value": "fareharbor.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:18.313468+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:18.308738+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:18.303635+00:00", "observable_id": "observable-fdb5485f3b86bcc9a06dec97" }, { "type": "domain", "value": "f.monetate.net", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:18.098570+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:18.093724+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:18.089070+00:00", "observable_id": "observable-11bfdbf09a08e9ab40200fd4" }, { "type": "domain", "value": "eu-u.openx.net", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:17.902233+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:17.898126+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:17.892611+00:00", "observable_id": "observable-a9f3b5dee051b894dcb70668" }, { "type": "domain", "value": "edge.microsoft.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:17.653359+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:17.648103+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:17.641963+00:00", "observable_id": "observable-b8156b9826eb0e7ac59cfeb4" }, { "type": "domain", "value": "ec-apis.newegg.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:17.476664+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:17.472560+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:17.468086+00:00", "observable_id": "observable-fbbbca3371089da6171e98db" }, { "type": "domain", "value": "dx.steelhousemedia.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:17.270568+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:17.266083+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:17.261613+00:00", "observable_id": "observable-a6a385ab23ca13e828a5ed07" }, { "type": "domain", "value": "dsum-sec.casalemedia.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:17.077543+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:17.073176+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:17.068180+00:00", "observable_id": "observable-d03ab386fad7cbafb5fbf028" }, { "type": "domain", "value": "dpm.demdex.net", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:16.880908+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:16.874591+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:16.870226+00:00", "observable_id": "observable-5fb817e280a1925ed15c1d17" }, { "type": "domain", "value": "dp58aslhmbcib.cloudfront.net", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:16.672653+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:16.668466+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:16.664059+00:00", "observable_id": "observable-868b982523a66112cca36b0b" }, { "type": "domain", "value": "disc801.prod.do.dsp.mp.microsoft.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:16.482572+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:16.478807+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:16.475145+00:00", "observable_id": "observable-971b077dcad87d68e277ce9c" }, { "type": "domain", "value": "ctldl.windowsupdate.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:15.866753+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:15.862074+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:15.856488+00:00", "observable_id": "observable-a5716e3c4855000d423c0b10" }, { "type": "domain", "value": "crl.securetrust.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:15.693251+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:15.691661+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:15.689568+00:00", "observable_id": "observable-d0add20799ca79c7bb7aeda7" }, { "type": "domain", "value": "cp801.prod.do.dsp.mp.microsoft.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:15.538258+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:15.536582+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:15.534496+00:00", "observable_id": "observable-06b4160fe8f02466535caf5e" }, { "type": "domain", "value": "cookie-sync-service-prod.steelhousemedia.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:15.275417+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:15.273541+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:15.271209+00:00", "observable_id": "observable-a66273e03527b18aa0d9cf08" }, { "type": "domain", "value": "consent.nxtck.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:15.099412+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:15.097334+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:15.094770+00:00", "observable_id": "observable-0e61e6d1985d312211428cd4" }, { "type": "domain", "value": "consent.mediaforge.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:14.925570+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:14.923580+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:14.921076+00:00", "observable_id": "observable-80b2ac8a6e80132067fb44d4" }, { "type": "domain", "value": "consent.linksynergy.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:14.674546+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:14.672659+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:14.670515+00:00", "observable_id": "observable-7d2ae74abd75181862da750c" }, { "type": "domain", "value": "consent.jrs5.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:14.517491+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:14.514632+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:14.511625+00:00", "observable_id": "observable-036bcf14e458ef91ddbd8a0b" }, { "type": "domain", "value": "consent.dc-storm.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:14.312283+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:14.309568+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:14.306696+00:00", "observable_id": "observable-76152bf96069bc445aac9ffe" }, { "type": "domain", "value": "connect.facebook.net", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:14.006547+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:14.004031+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:14.000598+00:00", "observable_id": "observable-097426c7715099a8e7103cf4" }, { "type": "domain", "value": "config.edge.skype.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:13.482784+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:13.477746+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:13.473252+00:00", "observable_id": "observable-b34e47e49b9d4dca6459389b" }, { "type": "domain", "value": "cm.g.doubleclick.net", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:13.189219+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:13.185894+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:13.181441+00:00", "observable_id": "observable-f9a97b240d38b14d02f7925c" }, { "type": "domain", "value": "cm.everesttech.net", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:12.881423+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:12.879367+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:12.875157+00:00", "observable_id": "observable-2544d55789420327e442a050" }, { "type": "domain", "value": "client.wns.windows.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:12.580326+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:12.569902+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:12.557319+00:00", "observable_id": "observable-f8b1236ba7d07fae4345bdd8" }, { "type": "domain", "value": "checkip.amazonaws.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:12.374426+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:12.370123+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:12.364602+00:00", "observable_id": "observable-f0382da974f4947210d0bfda" }, { "type": "domain", "value": "c1.neweggimages.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:12.119955+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:12.118227+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:12.116199+00:00", "observable_id": "observable-7113586740877f7bdc0118df" }, { "type": "domain", "value": "b-ring.msedge.net", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:44:54.560020+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:12.108190+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:12.105915+00:00", "observable_id": "observable-66fcfd3b0edf7b64db4f5e0b" }, { "type": "domain", "value": "az725175.vo.msecnd.net", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:11.954868+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:11.952952+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:11.950841+00:00", "observable_id": "observable-5d3e59cc7011ccb30047b5b9" }, { "type": "domain", "value": "assets.adobedtm.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:11.736475+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:11.734368+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:11.731959+00:00", "observable_id": "observable-b58abbea21a98641535af6c9" }, { "type": "domain", "value": "array807.prod.do.dsp.mp.microsoft.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:11.571915+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:11.569603+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:11.565984+00:00", "observable_id": "observable-1d67d6de284f0bdbade853f6" }, { "type": "domain", "value": "array803.prod.do.dsp.mp.microsoft.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:11.173642+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:11.171015+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:11.167971+00:00", "observable_id": "observable-2a19bbce2fa3cf90d33d60ca" }, { "type": "domain", "value": "array802.prod.do.dsp.mp.microsoft.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:10.960475+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:10.958502+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:10.955741+00:00", "observable_id": "observable-0a0e108c1217475396615e9a" }, { "type": "domain", "value": "array801.prod.do.dsp.mp.microsoft.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:10.777110+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:10.774132+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:10.772313+00:00", "observable_id": "observable-245b597dbb970839092a032e" }, { "type": "domain", "value": "arc.msn.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:44:53.249652+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:10.770192+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:10.767353+00:00", "observable_id": "observable-544f05eadedd9cba76d91c5d" }, { "type": "domain", "value": "apis.google.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:44:52.412014+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:10.763854+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:10.760848+00:00", "observable_id": "observable-15f9c9217630fff58412e4d0" }, { "type": "domain", "value": "api.bing.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:10.545520+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:10.538625+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:10.533068+00:00", "observable_id": "observable-43e7c41d5fa5db1d10ab694e" }, { "type": "domain", "value": "ajax.googleapis.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:10.341533+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:10.336684+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:10.331194+00:00", "observable_id": "observable-17eddbab547f394592b74c04" }, { "type": "domain", "value": "adservice.google.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:44:49.436607+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:10.326544+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:10.321648+00:00", "observable_id": "observable-585bd071d4dee9cd569191f3" }, { "type": "domain", "value": "act-us.rd.linksynergy.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:10.144569+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:10.140168+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:10.135647+00:00", "observable_id": "observable-65e20b1da385060b3d5293ac" }, { "type": "domain", "value": "a-ring.msedge.net", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:09.908536+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:09.906001+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:09.903052+00:00", "observable_id": "observable-604f3c7b82d84a07d610fc10" }, { "type": "domain", "value": "7754def074cd4b67fe16c8cfdb10e874.clo.footprintdns.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:09.407553+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:09.402033+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:09.396227+00:00", "observable_id": "observable-0191862f5d2c7a51df93d6c9" }, { "type": "domain", "value": "3af21bab922f1a3fff13816e3eed341a.clo.footprintdns.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:09.203021+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:09.200242+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:09.197514+00:00", "observable_id": "observable-32208ce5507d21c89db7990e" }, { "type": "domain", "value": "3750657afd7bdc4d4398b8849268b8a3.nrb.footprintdns.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:09.002145+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:08.999115+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:08.996052+00:00", "observable_id": "observable-41204ee1d75e0b6e880227c2" }, { "type": "ipv4", "value": "203.176.135.102", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:08.764583+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:08.760654+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:08.755815+00:00", "observable_id": "observable-db313399ad53bc3a475fd5a1" }, { "type": "domain", "value": "mondogreek.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:08.583150+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:08.578770+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:08.573842+00:00", "observable_id": "observable-4c1bb410881eeb8df3d499a3" }, { "type": "ipv4", "value": "64.44.133.131", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:08.364820+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:08.360903+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:08.356323+00:00", "observable_id": "observable-f0ae0595f3e5d7ee92b7e4a8" }, { "type": "ipv4", "value": "50.87.248.17", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:08.139415+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:08.136738+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:08.130907+00:00", "observable_id": "observable-1fa516e46dc6dd3ae28c5f77" }, { "type": "ipv4", "value": "23.211.18.27", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:07.888230+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:07.884029+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:07.879501+00:00", "observable_id": "observable-08e6bd1fc40023076fe11df5" }, { "type": "ipv4", "value": "23.209.74.120", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:07.632683+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:07.628746+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:07.624257+00:00", "observable_id": "observable-cb80e882345115fb814bf57a" }, { "type": "domain", "value": "nebula.wsimg.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:07.452454+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:07.449589+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:07.446059+00:00", "observable_id": "observable-c92d01e31450bef11e65f195" }, { "type": "domain", "value": "img4.wsimg.com", "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:07.148210+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:06.964516+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:06.962640+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:06.958200+00:00", "observable_id": "observable-513895eac4dd944e6f14f739" }, { "type": "domain", "value": "img2.wsimg.com", "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:06.958135+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:06.769360+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:06.765214+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:06.760952+00:00", "observable_id": "observable-637e04571d4102417d69d826" }, { "type": "domain", "value": "img1.wsimg.com", "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:06.760880+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:06.591475+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:06.589381+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:06.586559+00:00", "observable_id": "observable-2d56ef3bc0ec648cce947c26" }, { "type": "domain", "value": "bolton-tech.com", "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:06.586518+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:06.396436+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:06.391982+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:06.386904+00:00", "observable_id": "observable-4cda9a6c6ae54c3360daafe8" }, { "type": "sha256", "value": "fef9b646dba5c7372fe92b6a9d227833c1d15d8cc3a73fd22be9d1869b21cd67", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "malwarebazaar", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:05.918008+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:05.672459+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:05.667874+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:05.663198+00:00", "observable_id": "observable-d3c3ed12a0a52664cd402487" }, { "type": "sha256", "value": "8aa9c596dd3eb7560bc7416ba181e858f1174fcbcb5432050f3f9a663ed1ffa2", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "malwarebazaar", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:05.315083+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:04.954661+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:04.952559+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:04.950505+00:00", "observable_id": "observable-2efb80932910ed9446f560a4" }, { "type": "sha256", "value": "68798ccf8e2a5f9682a4e011bec288ad9b3f900244f82c6ae5e8ca538725f92e", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "malwarebazaar", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:04.621124+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:04.258289+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:04.248592+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:04.240883+00:00", "observable_id": "observable-7eda0f2160c7166adbe45a69" }, { "type": "sha256", "value": "5638ee72bed581aec1cf09b1e7fdeb37a23b69d8f5927ca00b84f2286a695066", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "malwarebazaar", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:03.751076+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:03.363579+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:03.359103+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:03.353393+00:00", "observable_id": "observable-90e67161e4374a86a235355c" }, { "type": "sha256", "value": "1ca2faaa4a7ba86c934c337dcb47ebd521dd5721a9f62302ef36f074c1a4c8d8", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "malwarebazaar", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:02.844784+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:02.541359+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:02.537205+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:02.532978+00:00", "observable_id": "observable-bb90e25f4a050fb1c116e7c0" }, { "type": "sha256", "value": "02db3c6b9aff73bf8a11c41107c836b6c800c919c5d3d1304f336aee03f79f4c", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "malwarebazaar", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:02.064358+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:01.801594+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:01.799475+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:01.796151+00:00", "observable_id": "observable-85340b2b43a54acdc129ba7f" } ], "coverage": { "cache_hits": 0, "active_scans": 0, "batch_results": [ { "status": "deferred-rate-limit", "provider": "virustotal", "observable_id": "observable-0e8573cd0b6b47b4aece50cf" }, { "status": "not_found", "provider": "threatfox", "observable_id": "observable-0e8573cd0b6b47b4aece50cf" }, { "status": "deferred-rate-limit", "provider": "virustotal", "observable_id": "observable-92abde5cd08edeadc2f99562" }, { "status": "not_found", "provider": "threatfox", "observable_id": "observable-92abde5cd08edeadc2f99562" }, { "status": "deferred-rate-limit", "provider": "virustotal", "observable_id": "observable-522ef96dc30c20264516468e" }, { "status": "not_found", "provider": "threatfox", "observable_id": "observable-522ef96dc30c20264516468e" }, { "status": "deferred-rate-limit", "provider": "virustotal", "observable_id": "observable-f7617f8cef59730032c2c46c" }, { "status": "not_found", "provider": "threatfox", "observable_id": "observable-f7617f8cef59730032c2c46c" }, { "status": "deferred-rate-limit", "provider": "virustotal", "observable_id": "observable-1fd8e066886a6c8af4164897" }, { "status": "not_found", "provider": "threatfox", "observable_id": "observable-1fd8e066886a6c8af4164897" } ], "batch_targets": 5, "payload_uploads": 0, "targets_omitted": 0, "retained_targets": 75, "full_urls_disclosed": 0, "provider_lookups_started": 5 }, "updated_at": "2026-09-22T17:45:22.702373+00:00", "schema_version": "pcap-reputation-v1", "snapshot_sha256": "f349b66db87b263bf2ac7d57fba881f2084dc5b2a31c74b953ae3fc20b7cc39a", "source_semantic_sha256": "205701a0e6aebd9492fa2877a3bf42135b1ae3bbda7370a93eeabc0345e40639", "previous_snapshot_sha256": "83321ae54b488209e355ee5534546d781a433acedc277325239c13625fdd397f" }, "artifact_download_available": true, "source_tlp": "TLP:CLEAR", "techniques": [ { "attack_id": "T1105", "name": "Ingress Tool Transfer", "tactic": "command-and-control", "confidence": 0.8, "evidence": "T1105 Ingress Tool Transfer", "review_status": "suggested", "evidence_start": 18181, "evidence_end": 18208, "evidence_source": "source-text", "llm_verified": true, "review_note": null, "reviewer": null, "reviewed_at": null } ], "apt_matches": [ { "group_attack_id": "G0123", "group_name": "Volatile Cedar", "similarity": 0.2, "shared_count": 1, "shared_techniques": [ "T1105" ] }, { "group_attack_id": "G0044", "group_name": "Winnti Group", "similarity": 0.1667, "shared_count": 1, "shared_techniques": [ "T1105" ] }, { "group_attack_id": "G0130", "group_name": "Ajax Security Team", "similarity": 0.1667, "shared_count": 1, "shared_techniques": [ "T1105" ] }, { "group_attack_id": "G0136", "group_name": "IndigoZebra", "similarity": 0.1429, "shared_count": 1, "shared_techniques": [ "T1105" ] }, { "group_attack_id": "G0133", "group_name": "Nomadic Octopus", "similarity": 0.1429, "shared_count": 1, "shared_techniques": [ "T1105" ] }, { "group_attack_id": "G1013", "group_name": "Metador", "similarity": 0.1111, "shared_count": 1, "shared_techniques": [ "T1105" ] }, { "group_attack_id": "G0107", "group_name": "Whitefly", "similarity": 0.1111, "shared_count": 1, "shared_techniques": [ "T1105" ] }, { "group_attack_id": "G0066", "group_name": "Elderwood", "similarity": 0.1111, "shared_count": 1, "shared_techniques": [ "T1105" ] }, { "group_attack_id": "G0075", "group_name": "Rancor", "similarity": 0.1111, "shared_count": 1, "shared_techniques": [ "T1105" ] }, { "group_attack_id": "G0120", "group_name": "Evilnum", "similarity": 0.0909, "shared_count": 1, "shared_techniques": [ "T1105" ] } ], "public_note": "Public derivative: full packet extraction retained; provider evidence bounded; other-session details omitted. Original snapshot hashes do not hash this serialized derivative." }