{ "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "session_id": "869e7fd1-f976-40e4-affa-f9960f431cf8", "status": "completed", "filename": "2021-09-10-traffic-analysis-exercise.pcap", "source_sha256": "a9576008f7fd634740253a52b2937a205cd214cdde09f6924f0921b8e266dd12", "source_size_bytes": 6180050, "schema_version": "pcap-analysis-v1", "semantic_sha256": "ce8b10a4ba7a6615d2c58f5895ecb69dca768d904402026068da26b4ef7db5ed", "analyzer_manifest": { "schema_version": "pcap-analyzer-manifest-v1", "profile_id": "tshark-evidence-v3", "rulepack_version": "pcap-rules-v3", "tshark_version": "TShark (Wireshark) 4.4.18.", "implementation_sha256": "9e8d2397c92213d4143ee2e4e2f86f0c1606d085cc7a81fd3ab98e687a5a9388", "capinfos_version": "Capinfos (Wireshark) 4.4.18.", "limits": { "max_upload_bytes": 536870912, "tool_timeout_seconds": 300, "max_tool_output_bytes": 268435456, "max_events_per_kind": 50000, "max_flows": 50000, "max_endpoints": 20000, "max_exported_objects": 500, "max_object_hash_index": 50000, "max_exported_object_bytes": 52428800, "max_exported_total_bytes": 268435456 }, "requested_fields_sha256": "fb9865915ed277886a75f522c6f27708f67e4e28e7a9d4a051ed816dd6783b15", "supported_profile_fields_sha256": "917cc2ac17024ecb151d0baaf8ddfb0767624db4f29d127ec668d6ebb5d80604", "profile_sha256": "7bdd5b06266e645efbbef1674e9934e21a27fcb37b084c18bcfe6abd8192ade3", "manifest_sha256": "ee952aeb7cdc6958f4ae5178c54c274a1e4f0aec4d42f3bdb95baaff063b3dde" }, "summary": "Decoded 9221 packets across 66 IP endpoints and 263 transport flows. Observed 199 DNS events, 58 HTTP requests, 105 TLS ClientHello events, and 45 exported HTTP object(s). Deterministic rules produced 9 finding(s): 0 high, 2 medium, and 7 low. Findings are evidence-bound candidates and require analyst review; encrypted payload contents remain unavailable.", "report": "# AdversaryGraph Deterministic PCAP Analysis\n\nSource: 2021-09-10-traffic-analysis-exercise.pcap\nCapture SHA-256: `a9576008f7fd634740253a52b2937a205cd214cdde09f6924f0921b8e266dd12`\nSemantic result SHA-256: `ce8b10a4ba7a6615d2c58f5895ecb69dca768d904402026068da26b4ef7db5ed`\nAnalyzer manifest SHA-256: `ee952aeb7cdc6958f4ae5178c54c274a1e4f0aec4d42f3bdb95baaff063b3dde`\n\n## Executive summary\n\nDecoded 9221 packets across 66 IP endpoints and 263 transport flows. Observed 199 DNS events, 58 HTTP requests, 105 TLS ClientHello events, and 45 exported HTTP object(s). Deterministic rules produced 9 finding(s): 0 high, 2 medium, and 7 low. Findings are evidence-bound candidates and require analyst review; encrypted payload contents remain unavailable.\n\n## Capture facts\n\n- Packets: 9221\n- Duration: 4609.2884 seconds\n- Captured bytes: 6032490\n- Endpoints: 66\n- Flows: 263\n\n## Deterministic findings\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v3`; confidence: 0.86; evidence: frame 4193 / TCP stream 100, frame 4198 / TCP stream 100, frame 4200 / TCP stream 100, frame 6404 / TCP stream 100.\n\nMetrics: `{\"content_type\":\"application/octet-stream\",\"declared_body_bytes\":1048578,\"destination\":\"10.9.10.102\",\"response_count\":2,\"source\":\"23.1.237.216\",\"uri\":\"/d/msdownload/update/software/defu/2021/09/am_delta_patch_1.349.439.0_dcf977cccce1b58289d270f71f8151b3acc1566b.exe\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v3`; confidence: 0.86; evidence: frame 4195 / TCP stream 101, frame 4199 / TCP stream 101, frame 4201 / TCP stream 101, frame 6356 / TCP stream 101, frame 6371 / TCP stream 101.\n\nMetrics: `{\"content_type\":\"application/octet-stream\",\"declared_body_bytes\":1970634,\"destination\":\"10.9.10.102\",\"response_count\":3,\"source\":\"23.1.237.225\",\"uri\":\"/d/msdownload/update/software/defu/2021/09/am_delta_patch_1.349.439.0_dcf977cccce1b58289d270f71f8151b3acc1566b.exe\"}`\n\n### LOW — Repeated unsuccessful DNS resolution\n\nRepeated NXDOMAIN responses may indicate a dead domain, misconfiguration, retrying software, or malicious fallback. They do not establish a domain-generation algorithm.\n\nRule: `repeated-nxdomain@pcap-rules-v3`; confidence: 0.5; evidence: frame 19, frame 64, frame 134, frame 168, frame 7624.\n\nMetrics: `{\"domain\":\"wpad.angrypoutine.com\",\"response_count\":12,\"source\":\"10.9.10.102\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 389 / TCP stream 15, frame 398 / TCP stream 15, frame 404 / TCP stream 15, frame 417 / TCP stream 15, frame 2059 / TCP stream 67.\n\nMetrics: `{\"destination\":\"10.9.10.9\",\"event_count\":25,\"operation_numbers\":[\"0\",\"1\",\"12\"],\"protocol\":\"drsuapi\",\"source\":\"10.9.10.102\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 80 / TCP stream 1, frame 83 / TCP stream 1, frame 478 / TCP stream 22, frame 483 / TCP stream 22, frame 486 / TCP stream 22.\n\nMetrics: `{\"destination\":\"10.9.10.9\",\"event_count\":50,\"operation_numbers\":[\"0\",\"2\",\"3\"],\"protocol\":\"ldap\",\"source\":\"10.9.10.102\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 440 / TCP stream 19, frame 442 / TCP stream 19, frame 444 / TCP stream 19, frame 446 / TCP stream 19, frame 448 / TCP stream 19.\n\nMetrics: `{\"destination\":\"10.9.10.9\",\"event_count\":57,\"operation_numbers\":[\"1\",\"16\",\"17\",\"18\",\"19\",\"20\",\"25\",\"3\",\"34\",\"36\",\"39\",\"5\",\"6\",\"64\",\"7\"],\"protocol\":\"samr\",\"source\":\"10.9.10.102\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 391 / TCP stream 15, frame 401 / TCP stream 15, frame 406 / TCP stream 15, frame 418 / TCP stream 15, frame 2060 / TCP stream 67.\n\nMetrics: `{\"destination\":\"10.9.10.102\",\"event_count\":25,\"operation_numbers\":[\"0\",\"1\",\"12\"],\"protocol\":\"drsuapi\",\"source\":\"10.9.10.9\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 82 / TCP stream 1, frame 480 / TCP stream 22, frame 485 / TCP stream 22, frame 487 / TCP stream 22, frame 495 / TCP stream 23.\n\nMetrics: `{\"destination\":\"10.9.10.102\",\"event_count\":39,\"operation_numbers\":[\"1\",\"4,19,19,19,5\",\"4,5\",\"5\"],\"protocol\":\"ldap\",\"source\":\"10.9.10.9\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 441 / TCP stream 19, frame 443 / TCP stream 19, frame 445 / TCP stream 19, frame 447 / TCP stream 19, frame 449 / TCP stream 19.\n\nMetrics: `{\"destination\":\"10.9.10.102\",\"event_count\":57,\"operation_numbers\":[\"1\",\"16\",\"17\",\"18\",\"19\",\"20\",\"25\",\"3\",\"34\",\"36\",\"39\",\"5\",\"6\",\"64\",\"7\"],\"protocol\":\"samr\",\"source\":\"10.9.10.9\"}`\n\n## ATT&CK candidates\n\n- T1105 Ingress Tool Transfer (command-and-control), confidence=0.8, status=suggested; basis=versioned-deterministic-rule.\n\n## Identities\n\n- account: `hobart.gunnarsson`; client IPs: 10.9.10.102; frames: 300, 311, 315, 332, 341\n- full-name: `Hobart Gunnarsson`; client IPs: 10.9.10.102; frames: 455\n- hostname: `DESKTOP-KKITB6Q`; client IPs: 10.9.10.102, 169.254.181.227; frames: 1, 3, 5, 6, 9\n- netbios-group: `ANGRYPOUTINE`; client IPs: unbound subject; frames: 7, 8, 11, 35, 38\n\n## IOC and artifact candidates\n\n- domain: `68091d435f184f9c8d6273bdb538ff4b.clo.footprintdns.com`; roles: dns-query, tls-sni\n- domain: `a-ring.msedge.net`; roles: dns-query, tls-sni\n- domain: `am2prdapp01-canary.cloudapp.net`; roles: dns-cname\n- domain: `angrypoutine-dc.angrypoutine.com`; roles: dns-query\n- domain: `angrypoutine.com`; roles: dns-query\n- domain: `api.msn.com`; roles: dns-query, tls-sni\n- domain: `au.download.windowsupdate.com`; roles: dns-query, http-host\n- domain: `bing.com`; roles: tls-sni\n- domain: `cdn.onenote.net`; roles: dns-query, tls-sni\n- domain: `client.wns.windows.com`; roles: tls-sni\n- domain: `cp601.prod.do.dsp.mp.microsoft.com`; roles: dns-query, tls-sni\n- domain: `ctldl.windowsupdate.com`; roles: dns-query, http-host\n- domain: `desktop-kkitb6q.angrypoutine.com`; roles: dns-query\n- domain: `desktop-muyeyv7.angrypoutine.com`; roles: dns-query\n- domain: `dns.msftncsi.com`; roles: dns-query\n- domain: `download.windowsupdate.com`; roles: dns-query, http-host\n- domain: `evoke-windowsservices-tas.msedge.net`; roles: dns-query, tls-sni\n- domain: `f005cab8a8840abf6ab35152a071b205.clo.footprintdns.com`; roles: dns-query, tls-sni\n- domain: `fe2cr.update.microsoft.com`; roles: dns-query, tls-sni\n- domain: `fe2cr.update.microsoft.com.akadns.net`; roles: dns-cname\n- domain: `fe3cr.delivery.mp.microsoft.com`; roles: dns-query, tls-sni\n- domain: `fp-afd.azureedge.us`; roles: dns-query, tls-sni\n- domain: `fp-afd.azurefd.us`; roles: dns-query, tls-sni\n- domain: `fp-vs-nocache.azureedge.net`; roles: dns-query, tls-sni\n- domain: `fp.msedge.net`; roles: dns-query, tls-sni\n- domain: `fs.microsoft.com`; roles: dns-query, tls-sni\n- domain: `gameplayapi.intel.com`; roles: dns-query, tls-sni\n- domain: `geo.prod.do.dsp.mp.microsoft.com`; roles: dns-query, tls-sni\n- domain: `k-ring.msedge.net`; roles: dns-query, tls-sni\n- domain: `kv601.prod.do.dsp.mp.microsoft.com`; roles: dns-query, tls-sni\n- domain: `login.live.com`; roles: dns-query, tls-sni\n- domain: `microsoft.com`; roles: dns-query, tls-sni\n- domain: `moiafdazure.clo.footprintdns.com`; roles: dns-query, tls-sni\n- domain: `myexternalip.com`; roles: dns-query, tls-sni\n- domain: `nexus.officeapps.live.com`; roles: dns-query, tls-sni\n- domain: `nexusrules.officeapps.live.com`; roles: dns-query, tls-sni\n- domain: `office15client.microsoft.com`; roles: dns-query\n- domain: `prod-w.nexus.live.com.akadns.net`; roles: dns-cname\n- domain: `prod.nexusrules.live.com.akadns.net`; roles: dns-cname\n- domain: `q-ring.msedge.net`; roles: dns-query, tls-sni\n- domain: `s-ring.msedge.net`; roles: dns-query, tls-sni\n- domain: `settings-win.data.microsoft.com`; roles: dns-query, tls-sni\n- domain: `settingsfd-geo.trafficmanager.net`; roles: dns-cname\n- domain: `simpsonsavingss.com`; roles: dns-query, http-host\n- domain: `slscr.update.microsoft.com`; roles: dns-query, tls-sni\n- domain: `spo-ring.msedge.net`; roles: dns-query, tls-sni\n- domain: `store-images.s-microsoft.com`; roles: dns-query, http-host\n- domain: `storeedgefd.dsx.mp.microsoft.com`; roles: dns-query, tls-sni\n- domain: `t-ring.msedge.net`; roles: dns-query, tls-sni\n- domain: `teams-ring.msedge.net`; roles: dns-query, tls-sni\n- domain: `update.googleapis.com`; roles: dns-query, tls-sni\n- domain: `v10.events.data.microsoft.com`; roles: dns-query, tls-sni\n- domain: `wpad.angrypoutine.com`; roles: dns-query\n- domain: `www.bing.com`; roles: dns-query, tls-sni\n- domain: `www.microsoft.com`; roles: dns-query, tls-sni\n- domain: `www.msftncsi.com`; roles: dns-query, http-host\n- ipv4: `0.0.0.0`; roles: network-endpoint\n- ipv4: `10.9.10.102`; roles: dns-answer, network-endpoint\n- ipv4: `10.9.10.103`; roles: dns-answer, network-endpoint\n- ipv4: `10.9.10.255`; roles: network-endpoint\n- ipv4: `10.9.10.9`; roles: dns-answer, network-endpoint\n- ipv4: `104.125.253.131`; roles: dns-answer, network-endpoint\n- ipv4: `104.215.148.63`; roles: dns-answer, network-endpoint\n- ipv4: `104.46.162.226`; roles: dns-answer, network-endpoint\n- ipv4: `13.107.136.254`; roles: dns-answer, network-endpoint\n- ipv4: `13.107.18.254`; roles: dns-answer, network-endpoint\n- ipv4: `13.107.21.200`; roles: dns-answer, network-endpoint\n- ipv4: `13.107.246.254`; roles: dns-answer, network-endpoint\n- ipv4: `13.107.3.254`; roles: dns-answer, network-endpoint\n- ipv4: `13.107.49.254`; roles: dns-answer, network-endpoint\n- ipv4: `13.107.5.88`; roles: dns-answer, network-endpoint\n- ipv4: `13.69.239.72`; roles: dns-answer, network-endpoint\n- ipv4: `13.77.161.179`; roles: dns-answer\n- ipv4: `131.107.255.255`; roles: dns-answer\n- ipv4: `167.172.37.9`; roles: network-endpoint\n- ipv4: `169.254.181.227`; roles: network-endpoint\n- ipv4: `169.254.255.255`; roles: network-endpoint\n- ipv4: `172.217.168.195`; roles: dns-answer, network-endpoint\n- ipv4: `184.85.229.68`; roles: dns-answer, network-endpoint\n- ipv4: `194.62.42.206`; roles: dns-answer, network-endpoint\n- ipv4: `20.140.48.71`; roles: dns-answer, network-endpoint\n- ipv4: `20.189.173.7`; roles: dns-answer, network-endpoint\n- ipv4: `20.190.151.131`; roles: dns-answer, network-endpoint\n- ipv4: `20.190.151.132`; roles: dns-answer\n- ipv4: `20.190.151.133`; roles: dns-answer\n- ipv4: `20.190.151.134`; roles: dns-answer\n- ipv4: `20.190.151.6`; roles: dns-answer\n- ipv4: `20.190.151.68`; roles: dns-answer\n- ipv4: `20.190.151.69`; roles: dns-answer\n- ipv4: `20.190.151.9`; roles: dns-answer\n- ipv4: `20.190.154.136`; roles: dns-answer\n- ipv4: `20.190.154.138`; roles: dns-answer, network-endpoint\n- ipv4: `20.190.154.139`; roles: dns-answer\n- ipv4: `20.190.154.16`; roles: dns-answer\n- ipv4: `20.190.154.17`; roles: dns-answer\n- ipv4: `20.190.154.18`; roles: dns-answer\n- ipv4: `20.190.154.19`; roles: dns-answer\n- ipv4: `20.42.73.25`; roles: dns-answer, network-endpoint\n- ipv4: `20.50.73.10`; roles: dns-answer, network-endpoint\n- ipv4: `204.79.197.200`; roles: dns-answer, network-endpoint\n- ipv4: `204.79.197.203`; roles: dns-answer, network-endpoint\n- ipv4: `204.79.197.222`; roles: dns-answer, network-endpoint\n- ipv4: `204.79.197.254`; roles: dns-answer, network-endpoint\n- ipv4: `224.0.0.22`; roles: network-endpoint\n- ipv4: `224.0.0.251`; roles: network-endpoint\n- ipv4: `224.0.0.252`; roles: network-endpoint\n- ipv4: `23.1.237.200`; roles: dns-answer, network-endpoint\n- ipv4: `23.1.237.201`; roles: dns-answer, network-endpoint\n- ipv4: `23.1.237.209`; roles: dns-answer\n- ipv4: `23.1.237.216`; roles: dns-answer, network-endpoint\n- ipv4: `23.1.237.225`; roles: dns-answer, network-endpoint\n- ipv4: `23.100.36.182`; roles: dns-answer, network-endpoint\n- ipv4: `23.3.6.28`; roles: dns-answer, network-endpoint\n- ipv4: `23.3.84.67`; roles: dns-answer, network-endpoint\n- ipv4: `23.3.85.202`; roles: dns-answer, network-endpoint\n- ipv4: `23.3.85.234`; roles: dns-answer, network-endpoint\n- ipv4: `23.3.86.10`; roles: dns-answer, network-endpoint\n- ipv4: `239.255.255.250`; roles: http-host, network-endpoint\n- ipv4: `255.255.255.255`; roles: network-endpoint\n- ipv4: `34.117.59.81`; roles: dns-answer, network-endpoint\n- ipv4: `40.112.72.205`; roles: dns-answer\n- ipv4: `40.113.200.201`; roles: dns-answer\n- ipv4: `40.125.122.151`; roles: dns-answer, network-endpoint\n- ipv4: `40.126.26.132`; roles: dns-answer\n- ipv4: `40.126.26.134`; roles: dns-answer\n- ipv4: `40.126.26.135`; roles: dns-answer, network-endpoint\n- ipv4: `40.76.4.15`; roles: dns-answer\n- ipv4: `40.83.240.146`; roles: network-endpoint\n- ipv4: `51.137.102.183`; roles: dns-answer, network-endpoint\n- ipv4: `52.109.20.75`; roles: dns-answer\n- ipv4: `52.109.76.32`; roles: dns-answer, network-endpoint\n- ipv4: `52.109.76.36`; roles: network-endpoint\n- ipv4: `52.109.8.19`; roles: network-endpoint\n- ipv4: `52.109.8.22`; roles: dns-answer, network-endpoint\n- ipv4: `52.109.8.25`; roles: dns-answer, network-endpoint\n- ipv4: `52.113.196.254`; roles: dns-answer, network-endpoint\n- ipv4: `52.137.106.217`; roles: dns-answer, network-endpoint\n- ipv4: `52.182.143.208`; roles: dns-answer, network-endpoint\n- ipv4: `52.184.217.20`; roles: dns-answer, network-endpoint\n- ipv4: `52.238.248.6`; roles: dns-answer, network-endpoint\n- ipv4: `52.242.101.226`; roles: dns-answer, network-endpoint\n- ipv4: `52.242.97.97`; roles: dns-answer\n- ipv4: `72.21.81.200`; roles: dns-answer, network-endpoint\n- ipv4: `94.158.245.52`; roles: network-endpoint\n- ipv4: `96.17.68.66`; roles: dns-answer, network-endpoint\n- ipv4: `96.17.68.83`; roles: dns-answer\n- ja3: `28a2c9bd18a11de089ef85a160da29e4`; roles: tls-client-fingerprint\n- ja3: `37f463bf4616ecd445d4a1937da06e19`; roles: tls-client-fingerprint\n- ja3: `3b5074b1b5d032e5620f69f9f700ff0e`; roles: tls-client-fingerprint\n- ja3: `51c64c77e60f3980eea90869b68c58a8`; roles: tls-client-fingerprint\n- ja3: `6271f898ce5be7dd52b0fc260d0662b3`; roles: tls-client-fingerprint\n- ja3: `a0e9f5d64349fb13191bc781f81f42e1`; roles: tls-client-fingerprint\n- sha256: `0076eaec4990322f0ebf53a5a53997c1525f358dc28dd6b7e1cbffd9bd41a9a5`; roles: exported-object\n- sha256: `01b57c485bc90409c12dfff1fcca905e8ee03a18958ebb8fb7f007d317c2e6fc`; roles: exported-object\n- sha256: `0550952e70d2e4e5ca28a8160e31cab6418ecb152915ec5dbfe88248d39fc2c7`; roles: exported-object\n- sha256: `07a1470ae3b863578779e025fc6009e6519e0f77325e7a94a426a58b7e408196`; roles: exported-object\n- sha256: `0c58b13a7b5d78c8a9e35d5995b7352c3b38acee77d6af9886c3cf2d668bfd3c`; roles: exported-object\n- sha256: `0f132c40ca33c057af0aed28534cd23b31ce36da1ad0cda3f2c2f1e03d646bca`; roles: exported-object\n- sha256: `0fb4d47bcda9b77b0fbd8cb88b34ba180365991f6a376e00add1ac880b67fd8f`; roles: exported-object\n- sha256: `1127774b7710ffa8c9bd5d3182517be848d9373e8f4382f28f801ba9e44f80fb`; roles: exported-object\n- sha256: `153eec5b545f82f598d7728472073b1cdee325fc30cb7bc743c21d753610950d`; roles: exported-object\n- sha256: `1d48d9166408d8b8bf39f9557e4f8a57133c353567c55966ec2831a7bc230431`; roles: exported-object\n- sha256: `2972f477a28570de6c949fba237ace8c1bc2ea29b961b63aab3a57469e70cb51`; roles: exported-object\n- sha256: `2ac413d79efa22e42a179f0450d7e8e4bb8202c881bf9e02a5a13a9a3626d792`; roles: exported-object\n- sha256: `2cd96ea2a66b8bc4526b21c3744118b75f834d24739b04e2e7ceef21b8ad706f`; roles: exported-object\n- sha256: `3197375f525ce4d0d339e56b343ecd510ffc72dcfa250b1352f8bd6a02d49864`; roles: exported-object\n- sha256: `36d3e002691397fefd5287603499d03fd0d929ebc2d4b08ece3d9e8b74cb3219`; roles: exported-object\n- sha256: `4839da5b25468809fbc7708652e77c4aa945e6735bf5c9119b3299653898ce34`; roles: exported-object\n- sha256: `4a11107d730c5943885081bfc3e902af14e8e83f59d110979bb2af47e325c38e`; roles: exported-object\n- sha256: `4b03bfd94c00eecc15b41ef45adb7196c1bcfc942383b2ace3fac4a0423bdef4`; roles: exported-object\n- sha256: `6137f8db2192e638e13610f75e73b9247c05f4706f0afd1fdb132d86de6b4012`; roles: exported-object\n- sha256: `6a115a372e460c1de12760689955740a891b6d1e3f97bbe7e667c93ee940150c`; roles: exported-object\n- sha256: `6c1eac65b98a81cd11abeaffe3fcf7f268e8788f733a0a8598b900201f05fc6d`; roles: exported-object\n- sha256: `6db9e2137a8e7ebe66680ad4b9deeb17f7fc9f3103d9a1d9cde353f898de1bee`; roles: exported-object\n- sha256: `729388a4d1b0e06eb28c982bf4a2e9304937ad1a92932dfc76d822b441563b6d`; roles: exported-object\n- sha256: `809e5e4344a517b4f713aa55e03e2dc0c0d21cfa77ac2963e2e6e937e7d1264a`; roles: exported-object\n- sha256: `80a71674cf8a71eaaf73c661d43ca1b69c4f393ccd603b89436812913fffb0f1`; roles: exported-object\n- sha256: `84520bc8bb4f129be41a7ab2a1ff1064efcd060d5521c2d5c23afd8710339411`; roles: exported-object\n- sha256: `8529705a28a2cc8a6ac692e2f9a8cba5d6a3f44b81041270251389f1a017656c`; roles: exported-object\n- sha256: `8eddb32e5ab1436d9cec5cbf730ad2a82d559730d69e35c534863d64d038d7c5`; roles: exported-object\n- sha256: `9b8db510ef42b8ed54a3712636fda55a4f8cfcd5493e20b74ab00cd4f3979f2d`; roles: exported-object\n- sha256: `9db86bb697c7b6a5f3ed228546c9cb8a7037901e61efe0b244ba38e7d9ad3886`; roles: exported-object\n- sha256: `b4effa72b591f85bed1dd07d82d924b9423f5e58a26c62290d11a628768676e4`; roles: exported-object\n- sha256: `b80ed4f18c472ca7a6dd8dad53acc51a77e0ee0dc1fbadcc2e5d8e42efaa37fe`; roles: exported-object\n- sha256: `b96661475f79113a3685ff208a52c3dde1340f93a479011f027c7bd3859c5334`; roles: exported-object\n- sha256: `c1c72144b320890b971bf8cd335438dd6c2e50783398965e7891ccb30b4e3652`; roles: exported-object\n- sha256: `cb82f8b3153b5c172ae382d0cf92ca5373017dd09f98137bc3b06982115006d7`; roles: exported-object\n- sha256: `d98626686f7c56a852f3d658d947d96137ecbcfed278bdc2bc6158239a7434a2`; roles: exported-object\n- sha256: `dd3eb184a16f533fcce480c533d93846a6bb11138dc12468830115263490238d`; roles: exported-object\n- sha256: `e008608c81024ed297a07321b7c9ba9a00adac7cea71f24491af04b5e88f2f21`; roles: exported-object\n- sha256: `e65eaf9faa6e7f3f0ce49c052a35be7cd5fed3ffc70b3f1ff7c213bee79f83fe`; roles: exported-object\n- sha256: `e9132eaa61c1d06d76b82c27cffa7b6ba171f5e31fcec6fa78b03a7523f0f40a`; roles: exported-object\n- sha256: `ea203eb1b56387cac02308b5aca040993e2d1c7fbd06413d41c957a726e4898f`; roles: exported-object\n- sha256: `eddbff1244adffc83452a0a77a9c25fb8eb31625f9d18203acde9fd85eaa7f74`; roles: exported-object\n- sha256: `eed363fc4af7a9070d69340592dcab7c78db4f90710357de29e3b624aa957cf8`; roles: exported-object\n- sha256: `f040d968ae5f0c4324a4e3fce10f7bfbc4370251aecb695f4a5f6c5af7a66aa7`; roles: exported-object\n- sha256: `f7018b08490ebc04900ec28586710f3e93542ebe3ce390378e7f4e6665f28c43`; roles: exported-object\n- url: `http://239.255.255.250:1900*`; roles: http-request\n- url: `http://au.download.windowsupdate.com/d/msdownload/update/software/defu/2021/09/am_delta_patch_1.349.439.0_dcf977cccce1b58289d270f71f8151b3acc1566b.exe`; roles: http-request\n- url: `http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?8afe60e61b27f828`; roles: http-request\n- url: `http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/pinrulesstl.cab?22c230ae05c29e0f`; roles: http-request\n- url: `http://download.windowsupdate.com/c/msdownload/update/others/2021/09/35094710_046a1ec2fc584f3c2f6653542576b125ec45b91b.cab`; roles: http-request\n- url: `http://download.windowsupdate.com/c/msdownload/update/others/2021/09/35094711_e3993b23840c0d600179f647e9ac08158269c095.cab`; roles: http-request\n- url: `http://download.windowsupdate.com/c/msdownload/update/others/2021/09/35094827_769ef074432ee9d2982132709c97d7a039b1441d.cab`; roles: http-request\n- url: `http://download.windowsupdate.com/c/msdownload/update/others/2021/09/35095041_d6fbe7dcab58bad491f97a8fb16f67acdd9c5880.cab`; roles: http-request\n- url: `http://download.windowsupdate.com/c/msdownload/update/others/2021/09/35095042_571a24bf1c59b2fc66012aba76936bc63860b918.cab`; roles: http-request\n- url: `http://download.windowsupdate.com/c/msdownload/update/others/2021/09/35095158_9a369166024cd2046a41b3fcf5a7d5743d20b1f8.cab`; roles: http-request\n- url: `http://download.windowsupdate.com/c/msdownload/update/others/2021/09/35095401_461f0f3035a629e02f33b5439ab5d58c4e45c62f.cab`; roles: http-request\n- url: `http://download.windowsupdate.com/c/msdownload/update/others/2021/09/35095402_3a3af9d09b295d5cad27c058b669144408fd1987.cab`; roles: http-request\n- url: `http://download.windowsupdate.com/c/msdownload/update/others/2021/09/35095511_08bd8b8ea97b82600094601b9451b7fa9b028927.cab`; roles: http-request\n- url: `http://download.windowsupdate.com/c/msdownload/update/others/2021/09/35097431_5695ed6029065d034bdbaa6edef143ec73f43570.cab`; roles: http-request\n- url: `http://download.windowsupdate.com/c/msdownload/update/others/2021/09/35097432_b4cbace49a072b37958e15b9d3daadf28c89f361.cab`; roles: http-request\n- url: `http://download.windowsupdate.com/c/msdownload/update/others/2021/09/35097541_59453a64ae1a0f59447d0c4e4bae68350827ad3f.cab`; roles: http-request\n- url: `http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35095718_d6052d2a18efec5d0584f7d9db0c6df36c871e5e.cab`; roles: http-request\n- url: `http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35095719_bb98167530418ae8aa387c077bca2d54e52a227b.cab`; roles: http-request\n- url: `http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35095828_d42aac61fe6047b9b6b654db9d5c9ae957613125.cab`; roles: http-request\n- url: `http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35096071_6f89138c772d9cca2cda43656eecab96a5cd44fc.cab`; roles: http-request\n- url: `http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35096072_5331372f4a198d80f7a5602f73259ff77d004730.cab`; roles: http-request\n- url: `http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35096188_49a74f42962e10ef9cfa9492f2c1955c24967958.cab`; roles: http-request\n- url: `http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35096401_980e49644362fb40897606d01fddd1ef79c6702a.cab`; roles: http-request\n- url: `http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35096402_83d0bc9d8970cab311753b171496293c4e0588b8.cab`; roles: http-request\n- url: `http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35096518_246960552fd8974bcfe0af13e362f8d00f0c6046.cab`; roles: http-request\n- url: `http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35096747_f2ef0a3546df9b0fe01091e8cf6244c2b18ad27a.cab`; roles: http-request\n- url: `http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35096748_a533dd985a0175649c16855a9c628da8f21d78da.cab`; roles: http-request\n- url: `http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35096864_51f3f34383a28a4d5d63528d9978515e66a6806e.cab`; roles: http-request\n- url: `http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35097071_01580b64b700158e52507faa6223a4cb41c43f05.cab`; roles: http-request\n- url: `http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35097072_9c18abaa0dd4f3355c05cb1e0ac0d0a1da10552a.cab`; roles: http-request\n- url: `http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35097188_47bf5b9e41cf731eeaf7b93672b38948c413df0b.cab`; roles: http-request\n- url: `http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35097759_f51781226900f2c3a24cac0d25d7e32ce4232b12.cab`; roles: http-request\n- url: `http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35097760_94afc464b79c1922edc5d9f1aa46b8bbdafcac27.cab`; roles: http-request\n- url: `http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35097869_11f02196bd92ebd3ff0745749654d98eb8ddd58c.cab`; roles: http-request\n- url: `http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35098112_e6ce21ecdf7d899a6a8671574b68871ce853efe6.cab`; roles: http-request\n- url: `http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35098113_ea9c1c8bf8003ad3b08ee004e09ae3bbf5fb1456.cab`; roles: http-request\n- url: `http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35098229_d9a668acd9af16621c688b823ada2c10de963ca4.cab`; roles: http-request\n- url: `http://simpsonsavingss.com/bmdff/BhoHsCtZ/MLdmpfjaX/5uFG3Dz7yt/date1?BNLv65=pAAS`; roles: http-request\n- url: `http://store-images.s-microsoft.com/image/apps.11608.14255546098955437.c2922c50-eb00-4f80-b393-4e513d9f81c7.4345eb8f-f893-40a2-aec5-20f4758af165?w=150&h=150`; roles: http-request\n- url: `http://store-images.s-microsoft.com/image/apps.16525.14618985536919905.4b30e4f3-f7a1-4421-840c-2cc97b10e8e0.13409c3f-0e0f-40dd-b458-b324f658c185?w=150&h=150`; roles: http-request\n- url: `http://store-images.s-microsoft.com/image/apps.16999.13510798885065391.a43a9782-6060-4560-b391-7f6f188559d0.dc15b6ee-644d-41e3-8d76-67c8c9dac9e9?w=150&h=225`; roles: http-request\n- url: `http://store-images.s-microsoft.com/image/apps.28261.13798539581762600.abe1643f-1704-4a4d-a61b-47ccc25da012.ada314ec-db8e-49bb-a756-60487526418e?w=150&h=150`; roles: http-request\n- url: `http://store-images.s-microsoft.com/image/apps.31617.13655054093851568.f2bf9430-60d7-4569-a50d-0f21c9ade6b3.c563d383-997d-4da1-9def-d7200e3547f8?w=150&h=150`; roles: http-request\n- url: `http://store-images.s-microsoft.com/image/apps.40518.14127333176902609.7be7b901-15fe-4c27-863c-7c0dbfc26c5c.5c278f58-912b-4af9-88f8-a65fff2da477?w=150&h=150`; roles: http-request\n- url: `http://www.msftncsi.com/ncsi.txt`; roles: http-request\n- user_agent: `Microsoft NCSI`; roles: http-client\n- user_agent: `Microsoft-CryptoAPI/10.0`; roles: http-client\n- user_agent: `Microsoft-Delivery-Optimization/10.0`; roles: http-client\n- user_agent: `Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)`; roles: http-client\n- user_agent: `Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19043`; roles: http-client\n- user_agent: `Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.32`; roles: http-client\n- exported object `am_delta_patch_1.349.439.0_dcf977cccce1b58289d270f71f8151b3acc1566b(3).exe`; SHA-256 `1d48d9166408d8b8bf39f9557e4f8a57133c353567c55966ec2831a7bc230431`; size 1048576 bytes\n Static content: `{\"content_kind\":\"pe\",\"features\":[],\"inspected_bytes\":262144,\"inspection_truncated\":true,\"interpretation\":\"Static content only; not proof of execution, intent, or malware family\"}`. Not execution proof.\n- exported object `am_delta_patch_1.349.439.0_dcf977cccce1b58289d270f71f8151b3acc1566b(2).exe`; SHA-256 `2ac413d79efa22e42a179f0450d7e8e4bb8202c881bf9e02a5a13a9a3626d792`; size 1048576 bytes\n Static content: `{\"content_kind\":\"script-like-text\",\"features\":[{\"excerpt\":\"iEx\",\"feature\":\"dynamic-evaluation\",\"offset\":207057}],\"inspected_bytes\":262144,\"inspection_truncated\":true,\"interpretation\":\"Static content only; not proof of execution, intent, or malware family\"}`. Not execution proof.\n- exported object `date1%3fBNLv65=pAAS`; SHA-256 `eed363fc4af7a9070d69340592dcab7c78db4f90710357de29e3b624aa957cf8`; size 284816 bytes\n Static content: `{\"content_kind\":\"pe\",\"features\":[],\"inspected_bytes\":262144,\"inspection_truncated\":true,\"interpretation\":\"Static content only; not proof of execution, intent, or malware family\"}`. Not execution proof.\n- exported object `am_delta_patch_1.349.439.0_dcf977cccce1b58289d270f71f8151b3acc1566b(4).exe`; SHA-256 `0fb4d47bcda9b77b0fbd8cb88b34ba180365991f6a376e00add1ac880b67fd8f`; size 922056 bytes\n- exported object `apps.40518.14127333176902609.7be7b901-15fe-4c27-863c-7c0dbfc26c5c.5c278f58-912b-4af9-88f8-a65fff2da477%3fw=150&h=150`; SHA-256 `c1c72144b320890b971bf8cd335438dd6c2e50783398965e7891ccb30b4e3652`; size 24101 bytes\n- exported object `apps.16525.14618985536919905.4b30e4f3-f7a1-4421-840c-2cc97b10e8e0.13409c3f-0e0f-40dd-b458-b324f658c185%3fw=150&h=150`; SHA-256 `f7018b08490ebc04900ec28586710f3e93542ebe3ce390378e7f4e6665f28c43`; size 19230 bytes\n- exported object `apps.31617.13655054093851568.f2bf9430-60d7-4569-a50d-0f21c9ade6b3.c563d383-997d-4da1-9def-d7200e3547f8%3fw=150&h=150`; SHA-256 `0c58b13a7b5d78c8a9e35d5995b7352c3b38acee77d6af9886c3cf2d668bfd3c`; size 17906 bytes\n- exported object `apps.16999.13510798885065391.a43a9782-6060-4560-b391-7f6f188559d0.dc15b6ee-644d-41e3-8d76-67c8c9dac9e9%3fw=150&h=225`; SHA-256 `4a11107d730c5943885081bfc3e902af14e8e83f59d110979bb2af47e325c38e`; size 16870 bytes\n- exported object `apps.11608.14255546098955437.c2922c50-eb00-4f80-b393-4e513d9f81c7.4345eb8f-f893-40a2-aec5-20f4758af165%3fw=150&h=150`; SHA-256 `0f132c40ca33c057af0aed28534cd23b31ce36da1ad0cda3f2c2f1e03d646bca`; size 13972 bytes\n- exported object `35098229_d9a668acd9af16621c688b823ada2c10de963ca4.cab`; SHA-256 `4b03bfd94c00eecc15b41ef45adb7196c1bcfc942383b2ace3fac4a0423bdef4`; size 10821 bytes\n- exported object `35094827_769ef074432ee9d2982132709c97d7a039b1441d.cab`; SHA-256 `4839da5b25468809fbc7708652e77c4aa945e6735bf5c9119b3299653898ce34`; size 10791 bytes\n- exported object `35096864_51f3f34383a28a4d5d63528d9978515e66a6806e.cab`; SHA-256 `cb82f8b3153b5c172ae382d0cf92ca5373017dd09f98137bc3b06982115006d7`; size 10789 bytes\n- exported object `35096188_49a74f42962e10ef9cfa9492f2c1955c24967958.cab`; SHA-256 `2972f477a28570de6c949fba237ace8c1bc2ea29b961b63aab3a57469e70cb51`; size 10781 bytes\n- exported object `35096518_246960552fd8974bcfe0af13e362f8d00f0c6046.cab`; SHA-256 `8529705a28a2cc8a6ac692e2f9a8cba5d6a3f44b81041270251389f1a017656c`; size 10767 bytes\n- exported object `35095158_9a369166024cd2046a41b3fcf5a7d5743d20b1f8.cab`; SHA-256 `1127774b7710ffa8c9bd5d3182517be848d9373e8f4382f28f801ba9e44f80fb`; size 10765 bytes\n- exported object `35097188_47bf5b9e41cf731eeaf7b93672b38948c413df0b.cab`; SHA-256 `80a71674cf8a71eaaf73c661d43ca1b69c4f393ccd603b89436812913fffb0f1`; size 10763 bytes\n- exported object `35095511_08bd8b8ea97b82600094601b9451b7fa9b028927.cab`; SHA-256 `07a1470ae3b863578779e025fc6009e6519e0f77325e7a94a426a58b7e408196`; size 10623 bytes\n- exported object `35097541_59453a64ae1a0f59447d0c4e4bae68350827ad3f.cab`; SHA-256 `e9132eaa61c1d06d76b82c27cffa7b6ba171f5e31fcec6fa78b03a7523f0f40a`; size 10621 bytes\n- exported object `35095828_d42aac61fe6047b9b6b654db9d5c9ae957613125.cab`; SHA-256 `dd3eb184a16f533fcce480c533d93846a6bb11138dc12468830115263490238d`; size 10593 bytes\n- exported object `35097869_11f02196bd92ebd3ff0745749654d98eb8ddd58c.cab`; SHA-256 `0076eaec4990322f0ebf53a5a53997c1525f358dc28dd6b7e1cbffd9bd41a9a5`; size 10589 bytes\n- exported object `35096748_a533dd985a0175649c16855a9c628da8f21d78da.cab`; SHA-256 `9db86bb697c7b6a5f3ed228546c9cb8a7037901e61efe0b244ba38e7d9ad3886`; size 7287 bytes\n- exported object `35098113_ea9c1c8bf8003ad3b08ee004e09ae3bbf5fb1456.cab`; SHA-256 `01b57c485bc90409c12dfff1fcca905e8ee03a18958ebb8fb7f007d317c2e6fc`; size 7285 bytes\n- exported object `35096747_f2ef0a3546df9b0fe01091e8cf6244c2b18ad27a.cab`; SHA-256 `2cd96ea2a66b8bc4526b21c3744118b75f834d24739b04e2e7ceef21b8ad706f`; size 7285 bytes\n- exported object `35096072_5331372f4a198d80f7a5602f73259ff77d004730.cab`; SHA-256 `6db9e2137a8e7ebe66680ad4b9deeb17f7fc9f3103d9a1d9cde353f898de1bee`; size 7283 bytes\n- exported object `35098112_e6ce21ecdf7d899a6a8671574b68871ce853efe6.cab`; SHA-256 `d98626686f7c56a852f3d658d947d96137ecbcfed278bdc2bc6158239a7434a2`; size 7277 bytes\n- exported object `35094710_046a1ec2fc584f3c2f6653542576b125ec45b91b.cab`; SHA-256 `ea203eb1b56387cac02308b5aca040993e2d1c7fbd06413d41c957a726e4898f`; size 7277 bytes\n- exported object `35096071_6f89138c772d9cca2cda43656eecab96a5cd44fc.cab`; SHA-256 `153eec5b545f82f598d7728472073b1cdee325fc30cb7bc743c21d753610950d`; size 7275 bytes\n- exported object `35097432_b4cbace49a072b37958e15b9d3daadf28c89f361.cab`; SHA-256 `729388a4d1b0e06eb28c982bf4a2e9304937ad1a92932dfc76d822b441563b6d`; size 7275 bytes\n- exported object `35094711_e3993b23840c0d600179f647e9ac08158269c095.cab`; SHA-256 `e008608c81024ed297a07321b7c9ba9a00adac7cea71f24491af04b5e88f2f21`; size 7275 bytes\n- exported object `35097431_5695ed6029065d034bdbaa6edef143ec73f43570.cab`; SHA-256 `8eddb32e5ab1436d9cec5cbf730ad2a82d559730d69e35c534863d64d038d7c5`; size 7273 bytes\n- exported object `35095402_3a3af9d09b295d5cad27c058b669144408fd1987.cab`; SHA-256 `3197375f525ce4d0d339e56b343ecd510ffc72dcfa250b1352f8bd6a02d49864`; size 7267 bytes\n- exported object `35095401_461f0f3035a629e02f33b5439ab5d58c4e45c62f.cab`; SHA-256 `f040d968ae5f0c4324a4e3fce10f7bfbc4370251aecb695f4a5f6c5af7a66aa7`; size 7261 bytes\n- exported object `35097072_9c18abaa0dd4f3355c05cb1e0ac0d0a1da10552a.cab`; SHA-256 `6c1eac65b98a81cd11abeaffe3fcf7f268e8788f733a0a8598b900201f05fc6d`; size 7189 bytes\n- exported object `35097071_01580b64b700158e52507faa6223a4cb41c43f05.cab`; SHA-256 `0550952e70d2e4e5ca28a8160e31cab6418ecb152915ec5dbfe88248d39fc2c7`; size 7185 bytes\n- exported object `35096401_980e49644362fb40897606d01fddd1ef79c6702a.cab`; SHA-256 `b4effa72b591f85bed1dd07d82d924b9423f5e58a26c62290d11a628768676e4`; size 7183 bytes\n- exported object `35096402_83d0bc9d8970cab311753b171496293c4e0588b8.cab`; SHA-256 `36d3e002691397fefd5287603499d03fd0d929ebc2d4b08ece3d9e8b74cb3219`; size 7181 bytes\n- exported object `35095042_571a24bf1c59b2fc66012aba76936bc63860b918.cab`; SHA-256 `e65eaf9faa6e7f3f0ce49c052a35be7cd5fed3ffc70b3f1ff7c213bee79f83fe`; size 7181 bytes\n- exported object `35097759_f51781226900f2c3a24cac0d25d7e32ce4232b12.cab`; SHA-256 `809e5e4344a517b4f713aa55e03e2dc0c0d21cfa77ac2963e2e6e937e7d1264a`; size 7175 bytes\n- exported object `35097760_94afc464b79c1922edc5d9f1aa46b8bbdafcac27.cab`; SHA-256 `b96661475f79113a3685ff208a52c3dde1340f93a479011f027c7bd3859c5334`; size 7175 bytes\n- exported object `35095719_bb98167530418ae8aa387c077bca2d54e52a227b.cab`; SHA-256 `6a115a372e460c1de12760689955740a891b6d1e3f97bbe7e667c93ee940150c`; size 7171 bytes\n- exported object `35095718_d6052d2a18efec5d0584f7d9db0c6df36c871e5e.cab`; SHA-256 `b80ed4f18c472ca7a6dd8dad53acc51a77e0ee0dc1fbadcc2e5d8e42efaa37fe`; size 7171 bytes\n- exported object `35095041_d6fbe7dcab58bad491f97a8fb16f67acdd9c5880.cab`; SHA-256 `eddbff1244adffc83452a0a77a9c25fb8eb31625f9d18203acde9fd85eaa7f74`; size 7171 bytes\n- exported object `apps.28261.13798539581762600.abe1643f-1704-4a4d-a61b-47ccc25da012.ada314ec-db8e-49bb-a756-60487526418e%3fw=150&h=150`; SHA-256 `84520bc8bb4f129be41a7ab2a1ff1064efcd060d5521c2d5c23afd8710339411`; size 2222 bytes\n- exported object `ncsi.txt`; SHA-256 `6137f8db2192e638e13610f75e73b9247c05f4706f0afd1fdb132d86de6b4012`; size 14 bytes\n- exported object `am_delta_patch_1.349.439.0_dcf977cccce1b58289d270f71f8151b3acc1566b(1).exe`; SHA-256 `9b8db510ef42b8ed54a3712636fda55a4f8cfcd5493e20b74ab00cd4f3979f2d`; size 2 bytes\n\n## Actor similarity leads\n\n- Volatile Cedar (G0123): 20% TTP overlap. This is an investigation lead, not attribution.\n- Winnti Group (G0044): 17% TTP overlap. This is an investigation lead, not attribution.\n- Ajax Security Team (G0130): 17% TTP overlap. This is an investigation lead, not attribution.\n- IndigoZebra (G0136): 14% TTP overlap. This is an investigation lead, not attribution.\n- Nomadic Octopus (G0133): 14% TTP overlap. This is an investigation lead, not attribution.\n- Whitefly (G0107): 11% TTP overlap. This is an investigation lead, not attribution.\n- Metador (G1013): 11% TTP overlap. This is an investigation lead, not attribution.\n- Elderwood (G0066): 11% TTP overlap. This is an investigation lead, not attribution.\n- Rancor (G0075): 11% TTP overlap. This is an investigation lead, not attribution.\n- Evilnum (G0120): 9% TTP overlap. This is an investigation lead, not attribution.\n\n## Local enrichment and correlations\n\nNo match means unknown in this corpus. Local CTI may postdate the capture. Matches and shared infrastructure require review; no automatic promotion or attribution.\nSnapshot: `fd1ef8f35792013eb051dd90b6a512f313f5655d99849d97a044c7dc6beb785f`; recorded 2026-09-19T12:10:32.214995+00:00; mode: local-only.\nCoverage: `{\"matched_observables\":0,\"no_exact_match\":248,\"observable_limit\":5000,\"observables_checked\":248,\"observables_total\":248,\"prior_case_limit_reached\":false,\"prior_cases_checked\":15,\"truncated\":false}`\n\n- Catalog T1105: https://attack.mitre.org/techniques/T1105; detection strategies: [{\"attack_id\":\"DET0060\",\"name\":\"Detect Ingress Tool Transfers via Behavioral Chain\",\"stix_id\":\"x-mitre-detection-strategy--67677c4c-5778-49eb-ae74-1920645b8554\"}]\n- Prior analysis `8f0da1cd-9998-4d41-9fc7-683302a6ee24` shares 51 observations. This does not establish a common campaign.\n- Prior analysis `96e0e828-93ae-49d5-8104-9f14cb584c3e` shares 23 observations. This does not establish a common campaign.\n- Prior analysis `6e50c68f-5552-400c-9835-15867ddb022d` shares 23 observations. This does not establish a common campaign.\n- Prior analysis `43bc93eb-d6db-4400-b983-b0dd404c8ca4` shares 35 observations. This does not establish a common campaign.\n- Prior analysis `6df36b51-4b44-4660-b534-2fa89705e807` shares 35 observations. This does not establish a common campaign.\n- Prior analysis `29aa3ef8-47c9-4c47-b4cc-1ff3e0708142` shares 10 observations. This does not establish a common campaign.\n- Prior analysis `b79032a8-d69e-4ac1-bdd4-542473fa8e3b` shares 15 observations. This does not establish a common campaign.\n- Prior analysis `faf041c3-70e0-4a01-8780-10917e5e187c` shares 12 observations. This does not establish a common campaign.\n- Prior analysis `08324647-35af-4af2-8d82-4387eec03918` shares 14 observations. This does not establish a common campaign.\n- Prior analysis `616a90fa-f15e-4fcb-8d56-7b8e0eff5785` shares 4 observations. This does not establish a common campaign.\n- Prior analysis `459e119d-191f-49e8-85ea-c78f9de41826` shares 15 observations. This does not establish a common campaign.\n- Prior analysis `7a2cfe72-f48d-4894-8a2d-8889cb3b11b2` shares 12 observations. This does not establish a common campaign.\n- Prior analysis `81373b30-6a59-49d1-89b0-bad73ed19eaa` shares 13 observations. This does not establish a common campaign.\n- Prior analysis `38851ad7-b3a0-423d-ae89-3b7be4e4b908` shares 21 observations. This does not establish a common campaign.\n- Prior analysis `bfccc426-aa9b-4007-8558-a66d37ecb90c` shares 18 observations. This does not establish a common campaign.\n- External provider queries: 0. Not requested; no unknown indicator is classified as benign.\n\n## Coverage and limitations\n\n- Packet and protocol facts are deterministic for the recorded analyzer manifest.\n- Encrypted application payloads are not decrypted; only available metadata is reported.\n- ATT&CK mappings and actor overlaps are candidates until analyst review and promotion.\n- HTTP object inventory: `{\"compact_objects\":0,\"complete\":true,\"detailed_objects\":45,\"exported_objects\":46,\"hashed_bytes\":3675348,\"hashed_objects\":46,\"omitted_unique_hashes\":0,\"returned_unique_hashes\":45,\"selection\":\"content-classified first, then size descending, SHA256 tie-break; deduplicated by full hash; overflow retains a compact hash index\",\"unhashed_objects\":0,\"unique_hashes\":45}`. Compact overflow hashes are retained in JSON coverage and observables.\n- A directory subject is not necessarily a logged-in user; consult identity bindings in the JSON evidence.\n- Rendered / available: findings 9/9, identities 4/4, observables 248/248, artifacts 45/45. Full returned inventory is in the JSON result.\n", "result": { "schema_version": "pcap-analysis-v1", "analysis_key_material": { "source_sha256": "a9576008f7fd634740253a52b2937a205cd214cdde09f6924f0921b8e266dd12", "analyzer_manifest_sha256": "ee952aeb7cdc6958f4ae5178c54c274a1e4f0aec4d42f3bdb95baaff063b3dde", "rulepack_version": "pcap-rules-v3" }, "analyzer_manifest": { "schema_version": "pcap-analyzer-manifest-v1", "profile_id": "tshark-evidence-v3", "rulepack_version": "pcap-rules-v3", "tshark_version": "TShark (Wireshark) 4.4.18.", "implementation_sha256": "9e8d2397c92213d4143ee2e4e2f86f0c1606d085cc7a81fd3ab98e687a5a9388", "capinfos_version": "Capinfos (Wireshark) 4.4.18.", "limits": { "max_upload_bytes": 536870912, "tool_timeout_seconds": 300, "max_tool_output_bytes": 268435456, "max_events_per_kind": 50000, "max_flows": 50000, "max_endpoints": 20000, "max_exported_objects": 500, "max_object_hash_index": 50000, "max_exported_object_bytes": 52428800, "max_exported_total_bytes": 268435456 }, "requested_fields_sha256": "fb9865915ed277886a75f522c6f27708f67e4e28e7a9d4a051ed816dd6783b15", "supported_profile_fields_sha256": "917cc2ac17024ecb151d0baaf8ddfb0767624db4f29d127ec668d6ebb5d80604", "profile_sha256": "7bdd5b06266e645efbbef1674e9934e21a27fcb37b084c18bcfe6abd8192ade3", "manifest_sha256": "ee952aeb7cdc6958f4ae5178c54c274a1e4f0aec4d42f3bdb95baaff063b3dde" }, "capture": { "packet_count": 9221, "captured_bytes": 6032490, "first_packet_epoch": "1631315707.787295", "last_packet_epoch": "1631320317.075695", "duration_seconds": 4609.2884, "interface_ids": [], "encapsulation_types": [ 1 ], "format": "pcap-le-microsecond", "source_sha256": "a9576008f7fd634740253a52b2937a205cd214cdde09f6924f0921b8e266dd12", "source_size_bytes": 6180050, "protocol_counts": { "eth": 9221, "ethertype": 9221, "ip": 8959, "tcp": 8657, "x509sat": 1418, "x509ce": 1183, "tls": 1127, "nbss": 494, "smb2": 469, "udp": 293, "arp": 262, "dcerpc": 246, "spnego-krb5": 222, "dns": 199, "pkix1implicit": 143, "gss-api": 106, "http": 96, "ldap": 94, "spnego": 80, "data": 64, "pkix1explicit": 55, "smb": 43, "media": 33, "nbns": 31, "ocsp": 31, "browser": 20, "nbdgm": 20, "igmp": 18, "kerberos": 18, "cldap": 16, "ntp": 10, "pkcs-1": 10, "ssdp": 10, "ntlmssp": 5, "png": 5, "dhcp": 4, "cms": 3, "mdns": 2, "data-text-lines": 1, "image-jfif": 1, "llmnr": 1 } }, "endpoints": [ { "endpoint_id": "endpoint-9886675b81a151929f7e7e2b", "ip": "0.0.0.0", "ip_version": 4, "is_private": true, "mac_addresses": [ "00:4f:49:b1:e8:c3" ], "packets_sent": 2, "packets_received": 0, "bytes_sent": 731, "bytes_received": 0, "first_seen_epoch": "1631315707.787295", "last_seen_epoch": "1631315707.790675", "evidence_frames": [ 1, 3 ] }, { "endpoint_id": "endpoint-9e4ddd858d9ab0b0c6c5e63e", "ip": "10.9.10.102", "ip_version": 4, "is_private": true, "mac_addresses": [ "00:4f:49:b1:e8:c3" ], "packets_sent": 3625, "packets_received": 5323, "bytes_sent": 707606, "bytes_received": 5306956, "first_seen_epoch": "1631315709.531811", "last_seen_epoch": "1631320317.075695", "evidence_frames": [ 12, 13, 16, 17, 18 ] }, { "endpoint_id": "endpoint-56d560082bc0690b3971a1ce", "ip": "10.9.10.103", "ip_version": 4, "is_private": true, "mac_addresses": [ "20:1a:06:68:23:49" ], "packets_sent": 16, "packets_received": 14, "bytes_sent": 2581, "bytes_received": 1853, "first_seen_epoch": "1631315962.249925", "last_seen_epoch": "1631315979.126566", "evidence_frames": [ 2634, 2635, 2641, 2642, 2643 ] }, { "endpoint_id": "endpoint-a80ed16a4857f99076bcf173", "ip": "10.9.10.255", "ip_version": 4, "is_private": true, "mac_addresses": [ "ff:ff:ff:ff:ff:ff" ], "packets_sent": 0, "packets_received": 35, "bytes_sent": 0, "bytes_received": 5550, "first_seen_epoch": "1631315709.575825", "last_seen_epoch": "1631320040.658572", "evidence_frames": [ 31, 35, 36, 38, 43 ] }, { "endpoint_id": "endpoint-ce39f579212ffb3791c927f5", "ip": "10.9.10.9", "ip_version": 4, "is_private": true, "mac_addresses": [ "14:18:77:0f:c6:9e" ], "packets_sent": 680, "packets_received": 797, "bytes_sent": 160571, "bytes_received": 184719, "first_seen_epoch": "1631315707.787997", "last_seen_epoch": "1631320316.054404", "evidence_frames": [ 2, 4, 18, 19, 22 ] }, { "endpoint_id": "endpoint-f191456c08a2696b72d1d40e", "ip": "104.125.253.131", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:a2:89:12:d3:d7" ], "packets_sent": 28, "packets_received": 22, "bytes_sent": 15159, "bytes_received": 2901, "first_seen_epoch": "1631316287.059686", "last_seen_epoch": "1631316378.883553", "evidence_frames": [ 4125, 4127, 4130, 4131, 4132 ] }, { "endpoint_id": "endpoint-26b380635e1533dbc5b59230", "ip": "104.215.148.63", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:a2:89:12:d3:d7" ], "packets_sent": 16, "packets_received": 15, "bytes_sent": 9103, "bytes_received": 1406, "first_seen_epoch": "1631315851.874672", "last_seen_epoch": "1631315962.054928", "evidence_frames": [ 1481, 1483, 1485, 1486, 1492 ] }, { "endpoint_id": "endpoint-0aa17a49756eeaa8074f7544", "ip": "104.46.162.226", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:a2:89:12:d3:d7" ], "packets_sent": 37, "packets_received": 40, "bytes_sent": 21346, "bytes_received": 15007, "first_seen_epoch": "1631316276.470271", "last_seen_epoch": "1631316291.340572", "evidence_frames": [ 3166, 3224, 3227, 3228, 3236 ] }, { "endpoint_id": "endpoint-1a149a3291bdb44cba596e50", "ip": "13.107.136.254", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:a2:89:12:d3:d7" ], "packets_sent": 12, "packets_received": 10, "bytes_sent": 5569, "bytes_received": 1060, "first_seen_epoch": "1631315821.796722", "last_seen_epoch": "1631315944.875435", "evidence_frames": [ 639, 696, 699, 700, 781 ] }, { "endpoint_id": "endpoint-85e73b9d9bc8ff1cf1444f96", "ip": "13.107.18.254", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:a2:89:12:d3:d7" ], "packets_sent": 12, "packets_received": 10, "bytes_sent": 5546, "bytes_received": 1058, "first_seen_epoch": "1631315821.7788", "last_seen_epoch": "1631315942.442602", "evidence_frames": [ 629, 664, 679, 684, 728 ] }, { "endpoint_id": "endpoint-378706fe2dcd52a6c52f4da5", "ip": "13.107.21.200", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:a2:89:12:d3:d7" ], "packets_sent": 12, "packets_received": 9, "bytes_sent": 6397, "bytes_received": 989, "first_seen_epoch": "1631315821.613978", "last_seen_epoch": "1631315946.568613", "evidence_frames": [ 580, 585, 588, 594, 607 ] }, { "endpoint_id": "endpoint-5908cf9402fc460e415fff60", "ip": "13.107.246.254", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:a2:89:12:d3:d7" ], "packets_sent": 26, "packets_received": 19, "bytes_sent": 11258, "bytes_received": 2071, "first_seen_epoch": "1631315821.689017", "last_seen_epoch": "1631315948.767331", "evidence_frames": [ 589, 598, 606, 610, 613 ] }, { "endpoint_id": "endpoint-354326de0a4970f8b96e04ad", "ip": "13.107.3.254", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:a2:89:12:d3:d7" ], "packets_sent": 12, "packets_received": 10, "bytes_sent": 5569, "bytes_received": 1058, "first_seen_epoch": "1631315821.777925", "last_seen_epoch": "1631315946.079771", "evidence_frames": [ 626, 645, 651, 657, 716 ] }, { "endpoint_id": "endpoint-7985888bd9a27cb103692ce0", "ip": "13.107.49.254", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:a2:89:12:d3:d7" ], "packets_sent": 13, "packets_received": 11, "bytes_sent": 5629, "bytes_received": 1118, "first_seen_epoch": "1631315821.692432", "last_seen_epoch": "1631315945.922103", "evidence_frames": [ 592, 615, 622, 628, 666 ] }, { "endpoint_id": "endpoint-e7bc877371c3f628da3b7cca", "ip": "13.107.5.88", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:a2:89:12:d3:d7" ], "packets_sent": 15, "packets_received": 13, "bytes_sent": 6038, "bytes_received": 1666, "first_seen_epoch": "1631317871.125427", "last_seen_epoch": "1631317999.721956", "evidence_frames": [ 7991, 7992, 7993, 7994, 7995 ] }, { "endpoint_id": "endpoint-f15d799d487c83b10f4dc97f", "ip": "13.69.239.72", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:a2:89:12:d3:d7" ], "packets_sent": 9, "packets_received": 10, "bytes_sent": 5321, "bytes_received": 2840, "first_seen_epoch": "1631317951.434397", "last_seen_epoch": "1631317953.67101", "evidence_frames": [ 8045, 8046, 8047, 8048, 8049 ] }, { "endpoint_id": "endpoint-104ffbe4512b3639f808ed47", "ip": "167.172.37.9", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:a2:89:12:d3:d7" ], "packets_sent": 226, "packets_received": 83, "bytes_sent": 303762, "bytes_received": 8226, "first_seen_epoch": "1631315851.848422", "last_seen_epoch": "1631315856.387032", "evidence_frames": [ 1479, 1482, 1484, 1487, 1488 ] }, { "endpoint_id": "endpoint-d34a027320fc68fb98788137", "ip": "169.254.181.227", "ip_version": 4, "is_private": true, "mac_addresses": [ "00:4f:49:b1:e8:c3" ], "packets_sent": 7, "packets_received": 0, "bytes_sent": 770, "bytes_received": 0, "first_seen_epoch": "1631315707.932871", "last_seen_epoch": "1631315709.495571", "evidence_frames": [ 5, 6, 7, 8, 9 ] }, { "endpoint_id": "endpoint-28492d03f009f328aaacd887", "ip": "169.254.255.255", "ip_version": 4, "is_private": true, "mac_addresses": [ "ff:ff:ff:ff:ff:ff" ], "packets_sent": 0, "packets_received": 7, "bytes_sent": 0, "bytes_received": 770, "first_seen_epoch": "1631315707.932871", "last_seen_epoch": "1631315709.495571", "evidence_frames": [ 5, 6, 7, 8, 9 ] }, { "endpoint_id": "endpoint-70ca1c0cebf96e342f586e04", "ip": "172.217.168.195", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:a2:89:12:d3:d7" ], "packets_sent": 14, "packets_received": 16, "bytes_sent": 5455, "bytes_received": 2960, "first_seen_epoch": "1631318945.43711", "last_seen_epoch": "1631318950.257507", "evidence_frames": [ 8339, 8340, 8341, 8342, 8343 ] }, { "endpoint_id": "endpoint-d3751b9f49876daf322f5b79", "ip": "184.85.229.68", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:a2:89:12:d3:d7" ], "packets_sent": 30, "packets_received": 23, "bytes_sent": 18492, "bytes_received": 2272, "first_seen_epoch": "1631315817.581479", "last_seen_epoch": "1631315878.157973", "evidence_frames": [ 512, 513, 514, 515, 516 ] }, { "endpoint_id": "endpoint-cf9237dfe6b8b78f1e5af084", "ip": "194.62.42.206", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:a2:89:12:d3:d7" ], "packets_sent": 212, "packets_received": 79, "bytes_sent": 296693, "bytes_received": 5096, "first_seen_epoch": "1631315847.500681", "last_seen_epoch": "1631315850.281468", "evidence_frames": [ 1183, 1184, 1188, 1189, 1191 ] }, { "endpoint_id": "endpoint-d238d58e909236faf2c6c50d", "ip": "20.140.48.71", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:a2:89:12:d3:d7" ], "packets_sent": 19, "packets_received": 18, "bytes_sent": 8334, "bytes_received": 1998, "first_seen_epoch": "1631315821.920343", "last_seen_epoch": "1631315951.453256", "evidence_frames": [ 715, 867, 869, 870, 917 ] }, { "endpoint_id": "endpoint-13f7273fcba11e2e1ab7cab7", "ip": "20.189.173.7", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:a2:89:12:d3:d7" ], "packets_sent": 10, "packets_received": 12, "bytes_sent": 5382, "bytes_received": 4163, "first_seen_epoch": "1631316382.490984", "last_seen_epoch": "1631316383.263691", "evidence_frames": [ 7587, 7588, 7589, 7590, 7591 ] }, { "endpoint_id": "endpoint-f83925097310dc2472456238", "ip": "20.190.151.131", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:a2:89:12:d3:d7" ], "packets_sent": 21, "packets_received": 19, "bytes_sent": 20750, "bytes_received": 6707, "first_seen_epoch": "1631315821.898094", "last_seen_epoch": "1631315932.244675", "evidence_frames": [ 710, 804, 813, 822, 903 ] }, { "endpoint_id": "endpoint-3b285a38c3c2f1263d13f7b1", "ip": "20.190.154.138", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:a2:89:12:d3:d7" ], "packets_sent": 19, "packets_received": 17, "bytes_sent": 18303, "bytes_received": 6508, "first_seen_epoch": "1631316275.718665", "last_seen_epoch": "1631316386.062631", "evidence_frames": [ 3074, 3078, 3080, 3082, 3085 ] }, { "endpoint_id": "endpoint-e2ab4c733e37d98663687974", "ip": "20.42.73.25", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:a2:89:12:d3:d7" ], "packets_sent": 9, "packets_received": 10, "bytes_sent": 5322, "bytes_received": 2903, "first_seen_epoch": "1631319727.268302", "last_seen_epoch": "1631319728.130849", "evidence_frames": [ 8656, 8657, 8658, 8659, 8660 ] }, { "endpoint_id": "endpoint-a55630c2ea8dfe436483dc22", "ip": "20.50.73.10", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:a2:89:12:d3:d7" ], "packets_sent": 18, "packets_received": 21, "bytes_sent": 10644, "bytes_received": 6926, "first_seen_epoch": "1631316292.834631", "last_seen_epoch": "1631316304.969377", "evidence_frames": [ 7359, 7360, 7361, 7362, 7363 ] }, { "endpoint_id": "endpoint-19535785b2677ee788847b17", "ip": "204.79.197.200", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:a2:89:12:d3:d7" ], "packets_sent": 30, "packets_received": 23, "bytes_sent": 14372, "bytes_received": 8063, "first_seen_epoch": "1631315821.692656", "last_seen_epoch": "1631317053.52479", "evidence_frames": [ 593, 608, 620, 624, 656 ] }, { "endpoint_id": "endpoint-be7ebdf622ab6c0787044fff", "ip": "204.79.197.203", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:a2:89:12:d3:d7" ], "packets_sent": 35, "packets_received": 27, "bytes_sent": 23722, "bytes_received": 4093, "first_seen_epoch": "1631315818.400952", "last_seen_epoch": "1631315951.62099", "evidence_frames": [ 557, 558, 559, 560, 561 ] }, { "endpoint_id": "endpoint-42330ecc9a43293b414fe469", "ip": "204.79.197.222", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:a2:89:12:d3:d7" ], "packets_sent": 12, "packets_received": 11, "bytes_sent": 5569, "bytes_received": 1114, "first_seen_epoch": "1631315821.865835", "last_seen_epoch": "1631315948.612846", "evidence_frames": [ 691, 758, 766, 768, 817 ] }, { "endpoint_id": "endpoint-800807b08023c067ee25eb01", "ip": "204.79.197.254", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:a2:89:12:d3:d7" ], "packets_sent": 12, "packets_received": 10, "bytes_sent": 5569, "bytes_received": 1058, "first_seen_epoch": "1631315821.865834", "last_seen_epoch": "1631315947.305954", "evidence_frames": [ 690, 757, 765, 769, 819 ] }, { "endpoint_id": "endpoint-55159a88ae306dac54e6e8d3", "ip": "224.0.0.22", "ip_version": 4, "is_private": false, "mac_addresses": [ "01:00:5e:00:00:16" ], "packets_sent": 0, "packets_received": 9, "bytes_sent": 0, "bytes_received": 542, "first_seen_epoch": "1631315709.531811", "last_seen_epoch": "1631315709.809138", "evidence_frames": [ 12, 13, 16, 17, 20 ] }, { "endpoint_id": "endpoint-5b0cf602095298b3d5d81ba5", "ip": "224.0.0.251", "ip_version": 4, "is_private": false, "mac_addresses": [ "01:00:5e:00:00:fb" ], "packets_sent": 0, "packets_received": 2, "bytes_sent": 0, "bytes_received": 172, "first_seen_epoch": "1631315709.550831", "last_seen_epoch": "1631315709.550832", "evidence_frames": [ 27, 28 ] }, { "endpoint_id": "endpoint-8db73add195b808e787ef6c2", "ip": "224.0.0.252", "ip_version": 4, "is_private": false, "mac_addresses": [ "01:00:5e:00:00:fc" ], "packets_sent": 0, "packets_received": 1, "bytes_sent": 0, "bytes_received": 75, "first_seen_epoch": "1631315709.551279", "last_seen_epoch": "1631315709.551279", "evidence_frames": [ 29 ] }, { "endpoint_id": "endpoint-a0fa1e8b72ee96616997ad21", "ip": "23.1.237.200", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:a2:89:12:d3:d7" ], "packets_sent": 235, "packets_received": 128, "bytes_sent": 301512, "bytes_received": 15711, "first_seen_epoch": "1631316276.888503", "last_seen_epoch": "1631316282.52658", "evidence_frames": [ 3234, 3235, 3238, 3241, 3244 ] }, { "endpoint_id": "endpoint-2b96b046e929360557a1f9ac", "ip": "23.1.237.201", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:a2:89:12:d3:d7" ], "packets_sent": 7, "packets_received": 9, "bytes_sent": 952, "bytes_received": 1103, "first_seen_epoch": "1631319034.475672", "last_seen_epoch": "1631319047.478638", "evidence_frames": [ 8443, 8444, 8445, 8446, 8447 ] }, { "endpoint_id": "endpoint-d1eb2eea906bea8e89710094", "ip": "23.1.237.216", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:a2:89:12:d3:d7" ], "packets_sent": 778, "packets_received": 338, "bytes_sent": 1091418, "bytes_received": 20950, "first_seen_epoch": "1631316288.69351", "last_seen_epoch": "1631316291.702775", "evidence_frames": [ 4188, 4190, 4192, 4193, 4196 ] }, { "endpoint_id": "endpoint-d19a96b4423da72cacc38b85", "ip": "23.1.237.225", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:a2:89:12:d3:d7" ], "packets_sent": 1456, "packets_received": 578, "bytes_sent": 2051093, "bytes_received": 36509, "first_seen_epoch": "1631316288.694885", "last_seen_epoch": "1631316319.027172", "evidence_frames": [ 4189, 4191, 4194, 4195, 4197 ] }, { "endpoint_id": "endpoint-693e99156d5806808e3d69ae", "ip": "23.100.36.182", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:a2:89:12:d3:d7" ], "packets_sent": 11, "packets_received": 9, "bytes_sent": 4983, "bytes_received": 1034, "first_seen_epoch": "1631315821.708475", "last_seen_epoch": "1631315948.727655", "evidence_frames": [ 603, 638, 640, 641, 701 ] }, { "endpoint_id": "endpoint-67bbd48f64cb93346640bcfb", "ip": "23.3.6.28", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:a2:89:12:d3:d7" ], "packets_sent": 22, "packets_received": 23, "bytes_sent": 6676, "bytes_received": 3717, "first_seen_epoch": "1631315877.912984", "last_seen_epoch": "1631315941.856987", "evidence_frames": [ 2411, 2442, 2446, 2457, 2460 ] }, { "endpoint_id": "endpoint-fd82d8c1cbae7df2e42eaf6a", "ip": "23.3.84.67", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:a2:89:12:d3:d7" ], "packets_sent": 42, "packets_received": 34, "bytes_sent": 22097, "bytes_received": 3605, "first_seen_epoch": "1631315798.072457", "last_seen_epoch": "1631315909.868361", "evidence_frames": [ 220, 221, 222, 223, 224 ] }, { "endpoint_id": "endpoint-6199331f045c7ec460f46c07", "ip": "23.3.85.202", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:a2:89:12:d3:d7" ], "packets_sent": 86, "packets_received": 58, "bytes_sent": 101555, "bytes_received": 5940, "first_seen_epoch": "1631315877.620509", "last_seen_epoch": "1631315877.999136", "evidence_frames": [ 2307, 2308, 2309, 2310, 2311 ] }, { "endpoint_id": "endpoint-2661999715a035309254b521", "ip": "23.3.85.234", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:a2:89:12:d3:d7" ], "packets_sent": 19, "packets_received": 14, "bytes_sent": 7840, "bytes_received": 1375, "first_seen_epoch": "1631315853.547297", "last_seen_epoch": "1631315874.924545", "evidence_frames": [ 1538, 1540, 1543, 1546, 1569 ] }, { "endpoint_id": "endpoint-ad1c4ab45f91d9803210d9e7", "ip": "23.3.86.10", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:a2:89:12:d3:d7" ], "packets_sent": 179, "packets_received": 129, "bytes_sent": 142468, "bytes_received": 32743, "first_seen_epoch": "1631315876.501044", "last_seen_epoch": "1631316387.886587", "evidence_frames": [ 1947, 1948, 1949, 1950, 1951 ] }, { "endpoint_id": "endpoint-79a18e93155d36c3a0f67e3d", "ip": "239.255.255.250", "ip_version": 4, "is_private": false, "mac_addresses": [ "01:00:5e:7f:ff:fa" ], "packets_sent": 0, "packets_received": 10, "bytes_sent": 0, "bytes_received": 1790, "first_seen_epoch": "1631315709.778075", "last_seen_epoch": "1631315798.880079", "evidence_frames": [ 32, 56, 93, 106, 122 ] }, { "endpoint_id": "endpoint-dcead1bfef26c7435fab631e", "ip": "255.255.255.255", "ip_version": 4, "is_private": true, "mac_addresses": [ "ff:ff:ff:ff:ff:ff" ], "packets_sent": 0, "packets_received": 4, "bytes_sent": 0, "bytes_received": 1438, "first_seen_epoch": "1631315707.787295", "last_seen_epoch": "1631315707.79165", "evidence_frames": [ 1, 2, 3, 4 ] }, { "endpoint_id": "endpoint-a4536e17dc9e1796e6fac332", "ip": "34.117.59.81", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:a2:89:12:d3:d7" ], "packets_sent": 13, "packets_received": 13, "bytes_sent": 5927, "bytes_received": 1238, "first_seen_epoch": "1631315961.595672", "last_seen_epoch": "1631316077.137027", "evidence_frames": [ 2607, 2608, 2610, 2611, 2612 ] }, { "endpoint_id": "endpoint-be39079d6f046848fa915c72", "ip": "40.125.122.151", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:a2:89:12:d3:d7" ], "packets_sent": 24, "packets_received": 29, "bytes_sent": 5881, "bytes_received": 16543, "first_seen_epoch": "1631316283.655992", "last_seen_epoch": "1631316285.892722", "evidence_frames": [ 4025, 4026, 4027, 4028, 4029 ] }, { "endpoint_id": "endpoint-83039e767b3b92636fa9166b", "ip": "40.126.26.135", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:a2:89:12:d3:d7" ], "packets_sent": 19, "packets_received": 16, "bytes_sent": 18327, "bytes_received": 6469, "first_seen_epoch": "1631318972.827993", "last_seen_epoch": "1631319083.12337", "evidence_frames": [ 8400, 8401, 8402, 8403, 8404 ] }, { "endpoint_id": "endpoint-95f21e582a637ddf8d2b2c02", "ip": "40.83.240.146", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:a2:89:12:d3:d7" ], "packets_sent": 16, "packets_received": 18, "bytes_sent": 6023, "bytes_received": 3737, "first_seen_epoch": "1631315715.513126", "last_seen_epoch": "1631320285.52944", "evidence_frames": [ 94, 95, 96, 97, 99 ] }, { "endpoint_id": "endpoint-072adefa427444db463b219d", "ip": "51.137.102.183", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:a2:89:12:d3:d7" ], "packets_sent": 10, "packets_received": 10, "bytes_sent": 4924, "bytes_received": 1094, "first_seen_epoch": "1631315821.689913", "last_seen_epoch": "1631315946.800213", "evidence_frames": [ 591, 711, 713, 714, 895 ] }, { "endpoint_id": "endpoint-2a7aa397ce92c039cafd8c72", "ip": "52.109.76.32", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:a2:89:12:d3:d7" ], "packets_sent": 8, "packets_received": 9, "bytes_sent": 6714, "bytes_received": 1344, "first_seen_epoch": "1631315969.974288", "last_seen_epoch": "1631315985.7223", "evidence_frames": [ 2879, 2880, 2881, 2882, 2883 ] }, { "endpoint_id": "endpoint-376ab655dbc50e8235ff8064", "ip": "52.109.76.36", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:a2:89:12:d3:d7" ], "packets_sent": 8, "packets_received": 9, "bytes_sent": 6971, "bytes_received": 1339, "first_seen_epoch": "1631315840.681391", "last_seen_epoch": "1631315891.920568", "evidence_frames": [ 1147, 1148, 1149, 1150, 1151 ] }, { "endpoint_id": "endpoint-aadc310984d1a2187eb00d6d", "ip": "52.109.8.19", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:a2:89:12:d3:d7" ], "packets_sent": 8, "packets_received": 9, "bytes_sent": 6714, "bytes_received": 1344, "first_seen_epoch": "1631315842.036098", "last_seen_epoch": "1631315891.92057", "evidence_frames": [ 1162, 1164, 1165, 1166, 1167 ] }, { "endpoint_id": "endpoint-e3483276fc18c656a237d3e3", "ip": "52.109.8.22", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:a2:89:12:d3:d7" ], "packets_sent": 17, "packets_received": 18, "bytes_sent": 13810, "bytes_received": 3831, "first_seen_epoch": "1631315968.526833", "last_seen_epoch": "1631318521.277083", "evidence_frames": [ 2855, 2856, 2857, 2858, 2863 ] }, { "endpoint_id": "endpoint-70a3896330c42c63ce8007fb", "ip": "52.109.8.25", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:a2:89:12:d3:d7" ], "packets_sent": 9, "packets_received": 8, "bytes_sent": 6839, "bytes_received": 2432, "first_seen_epoch": "1631320316.060854", "last_seen_epoch": "1631320317.075695", "evidence_frames": [ 9205, 9206, 9207, 9208, 9209 ] }, { "endpoint_id": "endpoint-730bba870f54a41c7781f80a", "ip": "52.113.196.254", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:a2:89:12:d3:d7" ], "packets_sent": 13, "packets_received": 10, "bytes_sent": 5629, "bytes_received": 1062, "first_seen_epoch": "1631315821.779973", "last_seen_epoch": "1631315945.93728", "evidence_frames": [ 630, 663, 678, 683, 727 ] }, { "endpoint_id": "endpoint-757db14018e22ec5dc6ac7b9", "ip": "52.137.106.217", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:a2:89:12:d3:d7" ], "packets_sent": 79, "packets_received": 92, "bytes_sent": 41577, "bytes_received": 14213, "first_seen_epoch": "1631315834.202715", "last_seen_epoch": "1631318977.234336", "evidence_frames": [ 1089, 1090, 1091, 1092, 1093 ] }, { "endpoint_id": "endpoint-4804e430d8f2554769a5d818", "ip": "52.182.143.208", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:a2:89:12:d3:d7" ], "packets_sent": 0, "packets_received": 5, "bytes_sent": 0, "bytes_received": 330, "first_seen_epoch": "1631317927.321531", "last_seen_epoch": "1631317942.417934", "evidence_frames": [ 8028, 8029, 8030, 8037, 8038 ] }, { "endpoint_id": "endpoint-23b41078dba68fe47189cbac", "ip": "52.184.217.20", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:a2:89:12:d3:d7" ], "packets_sent": 9, "packets_received": 12, "bytes_sent": 3660, "bytes_received": 1374, "first_seen_epoch": "1631316286.175088", "last_seen_epoch": "1631316287.161113", "evidence_frames": [ 4098, 4103, 4105, 4107, 4108 ] }, { "endpoint_id": "endpoint-af95d5ba71be07bdff1ba65f", "ip": "52.238.248.6", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:a2:89:12:d3:d7" ], "packets_sent": 359, "packets_received": 188, "bytes_sent": 366256, "bytes_received": 90396, "first_seen_epoch": "1631316274.507703", "last_seen_epoch": "1631316283.229537", "evidence_frames": [ 3051, 3052, 3053, 3054, 3055 ] }, { "endpoint_id": "endpoint-8f0cc49b52b4c4d01949ce7e", "ip": "52.242.101.226", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:a2:89:12:d3:d7" ], "packets_sent": 9, "packets_received": 12, "bytes_sent": 3427, "bytes_received": 1448, "first_seen_epoch": "1631316272.969876", "last_seen_epoch": "1631316273.920116", "evidence_frames": [ 3028, 3029, 3030, 3031, 3032 ] }, { "endpoint_id": "endpoint-592bcdefc89fc04937968eb4", "ip": "72.21.81.200", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:a2:89:12:d3:d7" ], "packets_sent": 16, "packets_received": 20, "bytes_sent": 8071, "bytes_received": 1636, "first_seen_epoch": "1631315821.781223", "last_seen_epoch": "1631316944.553191", "evidence_frames": [ 631, 665, 680, 682, 731 ] }, { "endpoint_id": "endpoint-743c4b9dd54c434f67794dc3", "ip": "94.158.245.52", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:a2:89:12:d3:d7" ], "packets_sent": 313, "packets_received": 416, "bytes_sent": 63384, "bytes_received": 146730, "first_seen_epoch": "1631315856.466363", "last_seen_epoch": "1631320284.093031", "evidence_frames": [ 1842, 1843, 1844, 1845, 1846 ] }, { "endpoint_id": "endpoint-f5fd4f4af007e1710d5159b3", "ip": "96.17.68.66", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:a2:89:12:d3:d7" ], "packets_sent": 5, "packets_received": 5, "bytes_sent": 479, "bytes_received": 397, "first_seen_epoch": "1631315714.252737", "last_seen_epoch": "1631315715.033857", "evidence_frames": [ 69, 71, 74, 75, 87 ] } ], "identities": [ { "identity_id": "identity-f7b6d432f3eade83def31af2", "type": "account", "value": "hobart.gunnarsson", "ip_addresses": [ "10.9.10.102" ], "mac_addresses": [ "00:4f:49:b1:e8:c3" ], "evidence": [ { "frame_number": 300, "timestamp_epoch": "1631315815.761043000", "display_filter": "frame.number == 300", "tcp_stream": 11 }, { "frame_number": 311, "timestamp_epoch": "1631315815.983665000", "display_filter": "frame.number == 311", "tcp_stream": 12 }, { "frame_number": 315, "timestamp_epoch": "1631315815.985466000", "display_filter": "frame.number == 315", "tcp_stream": 12 }, { "frame_number": 332, "timestamp_epoch": "1631315815.995245000", "display_filter": "frame.number == 332", "tcp_stream": 14 }, { "frame_number": 341, "timestamp_epoch": "1631315815.996631000", "display_filter": "frame.number == 341", "tcp_stream": 16 }, { "frame_number": 350, "timestamp_epoch": "1631315816.020222000", "display_filter": "frame.number == 350", "tcp_stream": 17 }, { "frame_number": 352, "timestamp_epoch": "1631315816.021278000", "display_filter": "frame.number == 352", "tcp_stream": 17 }, { "frame_number": 367, "timestamp_epoch": "1631315816.109766000", "display_filter": "frame.number == 367", "tcp_stream": 18 }, { "frame_number": 393, "timestamp_epoch": "1631315816.203285000", "display_filter": "frame.number == 393", "tcp_stream": 20 }, { "frame_number": 408, "timestamp_epoch": "1631315816.206084000", "display_filter": "frame.number == 408", "tcp_stream": 21 }, { "frame_number": 455, "timestamp_epoch": "1631315816.256961000", "display_filter": "frame.number == 455", "tcp_stream": 19 }, { "frame_number": 2681, "timestamp_epoch": "1631315966.487925000", "display_filter": "frame.number == 2681", "tcp_stream": 81 } ], "bindings": [ { "frame_number": 300, "relationship": "kerberos-client-principal", "owner_ip": "10.9.10.102", "conversation_src": "10.9.10.102", "conversation_dst": "10.9.10.9", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 311, "relationship": "kerberos-client-principal", "owner_ip": "10.9.10.102", "conversation_src": "10.9.10.102", "conversation_dst": "10.9.10.9", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 315, "relationship": "kerberos-client-principal", "owner_ip": "10.9.10.102", "conversation_src": "10.9.10.9", "conversation_dst": "10.9.10.102", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 332, "relationship": "kerberos-client-principal", "owner_ip": "10.9.10.102", "conversation_src": "10.9.10.9", "conversation_dst": "10.9.10.102", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 341, "relationship": "kerberos-client-principal", "owner_ip": "10.9.10.102", "conversation_src": "10.9.10.102", "conversation_dst": "10.9.10.9", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 350, "relationship": "kerberos-client-principal", "owner_ip": "10.9.10.102", "conversation_src": "10.9.10.102", "conversation_dst": "10.9.10.9", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 352, "relationship": "kerberos-client-principal", "owner_ip": "10.9.10.102", "conversation_src": "10.9.10.9", "conversation_dst": "10.9.10.102", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 367, "relationship": "kerberos-client-principal", "owner_ip": "10.9.10.102", "conversation_src": "10.9.10.9", "conversation_dst": "10.9.10.102", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 393, "relationship": "kerberos-client-principal", "owner_ip": "10.9.10.102", "conversation_src": "10.9.10.9", "conversation_dst": "10.9.10.102", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 408, "relationship": "kerberos-client-principal", "owner_ip": "10.9.10.102", "conversation_src": "10.9.10.9", "conversation_dst": "10.9.10.102", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 455, "relationship": "directory-subject-returned-to-client", "owner_ip": null, "conversation_src": "10.9.10.9", "conversation_dst": "10.9.10.102", "account": "hobart.gunnarsson", "source_field": "samr.samr_UserInfo21.account_name" }, { "frame_number": 2681, "relationship": "kerberos-client-principal", "owner_ip": "10.9.10.102", "conversation_src": "10.9.10.9", "conversation_dst": "10.9.10.102", "account": "", "source_field": "kerberos.CNameString" } ], "raw_values": [ "hobart.gunnarsson" ] }, { "identity_id": "identity-0b21cf421c3092d50b297bba", "type": "full-name", "value": "Hobart Gunnarsson", "ip_addresses": [ "10.9.10.102" ], "mac_addresses": [], "evidence": [ { "frame_number": 455, "timestamp_epoch": "1631315816.256961000", "display_filter": "frame.number == 455", "tcp_stream": 19 } ], "bindings": [ { "frame_number": 455, "relationship": "directory-name-correlated-with-client-principal", "owner_ip": "10.9.10.102", "conversation_src": "10.9.10.9", "conversation_dst": "10.9.10.102", "account": "hobart.gunnarsson", "source_field": "samr.samr_UserInfo21.full_name" } ], "raw_values": [ "Hobart Gunnarsson" ] }, { "identity_id": "identity-7bbffa5c46aa4e795236652a", "type": "hostname", "value": "DESKTOP-KKITB6Q", "ip_addresses": [ "10.9.10.102", "169.254.181.227" ], "mac_addresses": [ "00:4f:49:b1:e8:c3", "00:4f:49:b1:e8:c3,00:4f:49:b1:e8:c3" ], "evidence": [ { "frame_number": 1, "timestamp_epoch": "1631315707.787295000", "display_filter": "frame.number == 1", "udp_stream": 0 }, { "frame_number": 3, "timestamp_epoch": "1631315707.790675000", "display_filter": "frame.number == 3", "udp_stream": 0 }, { "frame_number": 5, "timestamp_epoch": "1631315707.932871000", "display_filter": "frame.number == 5", "udp_stream": 2 }, { "frame_number": 6, "timestamp_epoch": "1631315707.932872000", "display_filter": "frame.number == 6", "udp_stream": 2 }, { "frame_number": 9, "timestamp_epoch": "1631315708.684599000", "display_filter": "frame.number == 9", "udp_stream": 2 }, { "frame_number": 10, "timestamp_epoch": "1631315708.684600000", "display_filter": "frame.number == 10", "udp_stream": 2 }, { "frame_number": 31, "timestamp_epoch": "1631315709.575825000", "display_filter": "frame.number == 31", "udp_stream": 8 }, { "frame_number": 36, "timestamp_epoch": "1631315710.353794000", "display_filter": "frame.number == 36", "udp_stream": 8 }, { "frame_number": 43, "timestamp_epoch": "1631315711.117648000", "display_filter": "frame.number == 43", "udp_stream": 8 }, { "frame_number": 52, "timestamp_epoch": "1631315711.869204000", "display_filter": "frame.number == 52", "udp_stream": 8 }, { "frame_number": 54, "timestamp_epoch": "1631315712.599978000", "display_filter": "frame.number == 54", "udp_stream": 8 }, { "frame_number": 55, "timestamp_epoch": "1631315712.687123000", "display_filter": "frame.number == 55", "udp_stream": 14 }, { "frame_number": 58, "timestamp_epoch": "1631315713.358829000", "display_filter": "frame.number == 58", "udp_stream": 8 }, { "frame_number": 61, "timestamp_epoch": "1631315714.122641000", "display_filter": "frame.number == 61", "udp_stream": 8 }, { "frame_number": 72, "timestamp_epoch": "1631315714.885657000", "display_filter": "frame.number == 72", "udp_stream": 8 }, { "frame_number": 98, "timestamp_epoch": "1631315715.685778000", "display_filter": "frame.number == 98", "udp_stream": 14 }, { "frame_number": 121, "timestamp_epoch": "1631315717.199232000", "display_filter": "frame.number == 121", "udp_stream": 14 }, { "frame_number": 131, "timestamp_epoch": "1631315721.834465000", "display_filter": "frame.number == 131", "udp_stream": 14 }, { "frame_number": 132, "timestamp_epoch": "1631315721.842967000", "display_filter": "frame.number == 132", "udp_stream": 14 }, { "frame_number": 2651, "timestamp_epoch": "1631315964.378254000", "display_filter": "frame.number == 2651", "tcp_stream": 79 } ], "bindings": [ { "frame_number": 1, "relationship": "dhcp-client-assertion", "owner_ip": "0.0.0.0", "conversation_src": "0.0.0.0", "conversation_dst": "255.255.255.255", "account": "", "source_field": "dhcp.option.hostname" }, { "frame_number": 3, "relationship": "dhcp-client-assertion", "owner_ip": "0.0.0.0", "conversation_src": "0.0.0.0", "conversation_dst": "255.255.255.255", "account": "", "source_field": "dhcp.option.hostname" }, { "frame_number": 5, "relationship": "netbios-registration", "owner_ip": "169.254.181.227", "conversation_src": "169.254.181.227", "conversation_dst": "169.254.255.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 6, "relationship": "netbios-registration", "owner_ip": "169.254.181.227", "conversation_src": "169.254.181.227", "conversation_dst": "169.254.255.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 9, "relationship": "netbios-registration", "owner_ip": "169.254.181.227", "conversation_src": "169.254.181.227", "conversation_dst": "169.254.255.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 10, "relationship": "netbios-registration", "owner_ip": "169.254.181.227", "conversation_src": "169.254.181.227", "conversation_dst": "169.254.255.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 31, "relationship": "netbios-registration", "owner_ip": "10.9.10.102", "conversation_src": "10.9.10.102", "conversation_dst": "10.9.10.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 36, "relationship": "netbios-registration", "owner_ip": "10.9.10.102", "conversation_src": "10.9.10.102", "conversation_dst": "10.9.10.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 43, "relationship": "netbios-registration", "owner_ip": "10.9.10.102", "conversation_src": "10.9.10.102", "conversation_dst": "10.9.10.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 52, "relationship": "netbios-registration", "owner_ip": "10.9.10.102", "conversation_src": "10.9.10.102", "conversation_dst": "10.9.10.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 54, "relationship": "netbios-registration", "owner_ip": "10.9.10.102", "conversation_src": "10.9.10.102", "conversation_dst": "10.9.10.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 55, "relationship": "client-asserted", "owner_ip": "10.9.10.102", "conversation_src": "10.9.10.102", "conversation_dst": "10.9.10.255", "account": "", "source_field": "browser.server" }, { "frame_number": 58, "relationship": "netbios-registration", "owner_ip": "10.9.10.102", "conversation_src": "10.9.10.102", "conversation_dst": "10.9.10.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 61, "relationship": "netbios-registration", "owner_ip": "10.9.10.102", "conversation_src": "10.9.10.102", "conversation_dst": "10.9.10.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 72, "relationship": "netbios-registration", "owner_ip": "10.9.10.102", "conversation_src": "10.9.10.102", "conversation_dst": "10.9.10.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 98, "relationship": "client-asserted", "owner_ip": "10.9.10.102", "conversation_src": "10.9.10.102", "conversation_dst": "10.9.10.255", "account": "", "source_field": "browser.response_computer_name" }, { "frame_number": 121, "relationship": "client-asserted", "owner_ip": "10.9.10.102", "conversation_src": "10.9.10.102", "conversation_dst": "10.9.10.255", "account": "", "source_field": "browser.response_computer_name" }, { "frame_number": 131, "relationship": "client-asserted", "owner_ip": "10.9.10.102", "conversation_src": "10.9.10.102", "conversation_dst": "10.9.10.255", "account": "", "source_field": "browser.response_computer_name" }, { "frame_number": 132, "relationship": "client-asserted", "owner_ip": "10.9.10.102", "conversation_src": "10.9.10.102", "conversation_dst": "10.9.10.255", "account": "", "source_field": "browser.server" }, { "frame_number": 2651, "relationship": "client-asserted", "owner_ip": "10.9.10.102", "conversation_src": "10.9.10.102", "conversation_dst": "10.9.10.103", "account": "", "source_field": "ntlmssp.auth.hostname" } ], "raw_values": [ "DESKTOP-KKITB6Q", "DESKTOP-KKITB6Q<00>,DESKTOP-KKITB6Q<00> (Workstation/Redirector)", "DESKTOP-KKITB6Q<20>,DESKTOP-KKITB6Q<20> (Server service)" ] }, { "identity_id": "identity-6f0a9bd41209a8a862000245", "type": "netbios-group", "value": "ANGRYPOUTINE", "ip_addresses": [], "mac_addresses": [], "evidence": [ { "frame_number": 7, "timestamp_epoch": "1631315707.932873000", "display_filter": "frame.number == 7", "udp_stream": 2 }, { "frame_number": 8, "timestamp_epoch": "1631315708.684598000", "display_filter": "frame.number == 8", "udp_stream": 2 }, { "frame_number": 11, "timestamp_epoch": "1631315709.495571000", "display_filter": "frame.number == 11", "udp_stream": 2 }, { "frame_number": 35, "timestamp_epoch": "1631315710.258173000", "display_filter": "frame.number == 35", "udp_stream": 8 }, { "frame_number": 38, "timestamp_epoch": "1631315711.017650000", "display_filter": "frame.number == 38", "udp_stream": 8 }, { "frame_number": 50, "timestamp_epoch": "1631315711.789000000", "display_filter": "frame.number == 50", "udp_stream": 8 }, { "frame_number": 53, "timestamp_epoch": "1631315712.599977000", "display_filter": "frame.number == 53", "udp_stream": 8 }, { "frame_number": 59, "timestamp_epoch": "1631315713.358831000", "display_filter": "frame.number == 59", "udp_stream": 8 }, { "frame_number": 60, "timestamp_epoch": "1631315714.122639000", "display_filter": "frame.number == 60", "udp_stream": 8 }, { "frame_number": 73, "timestamp_epoch": "1631315714.885658000", "display_filter": "frame.number == 73", "udp_stream": 8 }, { "frame_number": 123, "timestamp_epoch": "1631315718.747751000", "display_filter": "frame.number == 123", "udp_stream": 8 }, { "frame_number": 127, "timestamp_epoch": "1631315719.511263000", "display_filter": "frame.number == 127", "udp_stream": 8 }, { "frame_number": 128, "timestamp_epoch": "1631315720.278616000", "display_filter": "frame.number == 128", "udp_stream": 8 }, { "frame_number": 129, "timestamp_epoch": "1631315721.040842000", "display_filter": "frame.number == 129", "udp_stream": 8 } ], "bindings": [ { "frame_number": 7, "relationship": "group-membership-not-hostname", "owner_ip": null, "conversation_src": "169.254.181.227", "conversation_dst": "169.254.255.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 8, "relationship": "group-membership-not-hostname", "owner_ip": null, "conversation_src": "169.254.181.227", "conversation_dst": "169.254.255.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 11, "relationship": "group-membership-not-hostname", "owner_ip": null, "conversation_src": "169.254.181.227", "conversation_dst": "169.254.255.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 35, "relationship": "group-membership-not-hostname", "owner_ip": null, "conversation_src": "10.9.10.102", "conversation_dst": "10.9.10.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 38, "relationship": "group-membership-not-hostname", "owner_ip": null, "conversation_src": "10.9.10.102", "conversation_dst": "10.9.10.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 50, "relationship": "group-membership-not-hostname", "owner_ip": null, "conversation_src": "10.9.10.102", "conversation_dst": "10.9.10.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 53, "relationship": "group-membership-not-hostname", "owner_ip": null, "conversation_src": "10.9.10.102", "conversation_dst": "10.9.10.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 59, "relationship": "group-membership-not-hostname", "owner_ip": null, "conversation_src": "10.9.10.102", "conversation_dst": "10.9.10.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 60, "relationship": "group-membership-not-hostname", "owner_ip": null, "conversation_src": "10.9.10.102", "conversation_dst": "10.9.10.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 73, "relationship": "group-membership-not-hostname", "owner_ip": null, "conversation_src": "10.9.10.102", "conversation_dst": "10.9.10.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 123, "relationship": "group-membership-not-hostname", "owner_ip": null, "conversation_src": "10.9.10.102", "conversation_dst": "10.9.10.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 127, "relationship": "group-membership-not-hostname", "owner_ip": null, "conversation_src": "10.9.10.102", "conversation_dst": "10.9.10.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 128, "relationship": "group-membership-not-hostname", "owner_ip": null, "conversation_src": "10.9.10.102", "conversation_dst": "10.9.10.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 129, "relationship": "group-membership-not-hostname", "owner_ip": null, "conversation_src": "10.9.10.102", "conversation_dst": "10.9.10.255", "account": "", "source_field": "nbns.name" } ], "raw_values": [ "ANGRYPOUTINE<00>,ANGRYPOUTINE<00> (Workstation/Redirector)", "ANGRYPOUTINE<1e>,ANGRYPOUTINE<1e> (Browser Election Service)" ] } ], "flows": [ { "flow_id": "flow-a987ab3d48038f52948a46c7", "transport": "udp", "stream": 0, "initiator_ip": "0.0.0.0", "initiator_port": 68, "responder_ip": "255.255.255.255", "responder_port": 67, "first_frame": 1, "last_frame": 3, "first_seen_epoch": "1631315707.787295", "last_seen_epoch": "1631315707.790675", "packets": 2, "bytes": 731, "initiator_bytes": 731, "responder_bytes": 0 }, { "flow_id": "flow-dbbe5d907d3675d07768bd91", "transport": "udp", "stream": 1, "initiator_ip": "10.9.10.9", "initiator_port": 67, "responder_ip": "255.255.255.255", "responder_port": 68, "first_frame": 2, "last_frame": 4, "first_seen_epoch": "1631315707.787997", "last_seen_epoch": "1631315707.79165", "packets": 2, "bytes": 707, "initiator_bytes": 707, "responder_bytes": 0 }, { "flow_id": "flow-e4599733bd8c2c53c56a4601", "transport": "udp", "stream": 2, "initiator_ip": "169.254.181.227", "initiator_port": 137, "responder_ip": "169.254.255.255", "responder_port": 137, "first_frame": 5, "last_frame": 11, "first_seen_epoch": "1631315707.932871", "last_seen_epoch": "1631315709.495571", "packets": 7, "bytes": 770, "initiator_bytes": 770, "responder_bytes": 0 }, { "flow_id": "flow-556e1e906866f21cef77baaf", "transport": "udp", "stream": 3, "initiator_ip": "10.9.10.102", "initiator_port": 53124, "responder_ip": "10.9.10.9", "responder_port": 53, "first_frame": 18, "last_frame": 19, "first_seen_epoch": "1631315709.538659", "last_seen_epoch": "1631315709.539026", "packets": 2, "bytes": 241, "initiator_bytes": 81, "responder_bytes": 160 }, { "flow_id": "flow-433f2e5a3322a4436e8852e5", "transport": "udp", "stream": 4, "initiator_ip": "10.9.10.102", "initiator_port": 60310, "responder_ip": "10.9.10.9", "responder_port": 53, "first_frame": 22, "last_frame": 23, "first_seen_epoch": "1631315709.547238", "last_seen_epoch": "1631315709.547578", "packets": 2, "bytes": 263, "initiator_bytes": 92, "responder_bytes": 171 }, { "flow_id": "flow-a2c0c1c001f687fc5878c5c9", "transport": "udp", "stream": 5, "initiator_ip": "10.9.10.102", "initiator_port": 64814, "responder_ip": "10.9.10.9", "responder_port": 53, "first_frame": 26, "last_frame": 30, "first_seen_epoch": "1631315709.55083", "last_seen_epoch": "1631315709.551563", "packets": 2, "bytes": 320, "initiator_bytes": 160, "responder_bytes": 160 }, { "flow_id": "flow-b8567b43fa9fe5376254d82a", "transport": "udp", "stream": 6, "initiator_ip": "10.9.10.102", "initiator_port": 5353, "responder_ip": "224.0.0.251", "responder_port": 5353, "first_frame": 27, "last_frame": 28, "first_seen_epoch": "1631315709.550831", "last_seen_epoch": "1631315709.550832", "packets": 2, "bytes": 172, "initiator_bytes": 172, "responder_bytes": 0 }, { "flow_id": "flow-9b9d6f8cb42f9b5bb580615f", "transport": "udp", "stream": 7, "initiator_ip": "10.9.10.102", "initiator_port": 58033, "responder_ip": "224.0.0.252", "responder_port": 5355, "first_frame": 29, "last_frame": 29, "first_seen_epoch": "1631315709.551279", "last_seen_epoch": "1631315709.551279", "packets": 1, "bytes": 75, "initiator_bytes": 75, "responder_bytes": 0 }, { "flow_id": "flow-54b07bdbece9dc0c1d4e2392", "transport": "udp", "stream": 8, "initiator_ip": "10.9.10.102", "initiator_port": 137, "responder_ip": "10.9.10.255", "responder_port": 137, "first_frame": 31, "last_frame": 2640, "first_seen_epoch": "1631315709.575825", "last_seen_epoch": "1631315962.346778", "packets": 21, "bytes": 2274, "initiator_bytes": 2274, "responder_bytes": 0 }, { "flow_id": "flow-06643a694f3715eafc07905a", "transport": "udp", "stream": 9, "initiator_ip": "10.9.10.102", "initiator_port": 58035, "responder_ip": "239.255.255.250", "responder_port": 1900, "first_frame": 32, "last_frame": 234, "first_seen_epoch": "1631315709.778075", "last_seen_epoch": "1631315798.880079", "packets": 10, "bytes": 1790, "initiator_bytes": 1790, "responder_bytes": 0 }, { "flow_id": "flow-a457c82872dccc5d3e627636", "transport": "udp", "stream": 10, "initiator_ip": "10.9.10.102", "initiator_port": 62920, "responder_ip": "10.9.10.9", "responder_port": 53, "first_frame": 39, "last_frame": 40, "first_seen_epoch": "1631315711.019152", "last_seen_epoch": "1631315711.01948", "packets": 2, "bytes": 324, "initiator_bytes": 128, "responder_bytes": 196 }, { "flow_id": "flow-901eb683815307853cea86ff", "transport": "udp", "stream": 11, "initiator_ip": "10.9.10.102", "initiator_port": 63367, "responder_ip": "10.9.10.9", "responder_port": 53, "first_frame": 41, "last_frame": 45, "first_seen_epoch": "1631315711.022144", "last_seen_epoch": "1631315711.11783", "packets": 4, "bytes": 400, "initiator_bytes": 184, "responder_bytes": 216 }, { "flow_id": "flow-520d646158b7417aaa39ad37", "transport": "udp", "stream": 12, "initiator_ip": "10.9.10.102", "initiator_port": 63368, "responder_ip": "10.9.10.9", "responder_port": 389, "first_frame": 46, "last_frame": 47, "first_seen_epoch": "1631315711.118441", "last_seen_epoch": "1631315711.118866", "packets": 2, "bytes": 513, "initiator_bytes": 269, "responder_bytes": 244 }, { "flow_id": "flow-1c07848e57b74f35ef55a171", "transport": "udp", "stream": 13, "initiator_ip": "10.9.10.102", "initiator_port": 123, "responder_ip": "10.9.10.9", "responder_port": 123, "first_frame": 48, "last_frame": 8769, "first_seen_epoch": "1631315711.228276", "last_seen_epoch": "1631319807.166981", "packets": 10, "bytes": 1620, "initiator_bytes": 810, "responder_bytes": 810 }, { "flow_id": "flow-da27fcc1668f38e4d49d1047", "transport": "udp", "stream": 14, "initiator_ip": "10.9.10.102", "initiator_port": 138, "responder_ip": "10.9.10.255", "responder_port": 138, "first_frame": 55, "last_frame": 8874, "first_seen_epoch": "1631315712.687123", "last_seen_epoch": "1631320040.658572", "packets": 14, "bytes": 3276, "initiator_bytes": 3276, "responder_bytes": 0 }, { "flow_id": "flow-be0ef0436d20ed7bc181af99", "transport": "udp", "stream": 15, "initiator_ip": "10.9.10.102", "initiator_port": 55937, "responder_ip": "10.9.10.9", "responder_port": 53, "first_frame": 62, "last_frame": 65, "first_seen_epoch": "1631315714.160252", "last_seen_epoch": "1631315714.230509", "packets": 2, "bytes": 258, "initiator_bytes": 76, "responder_bytes": 182 }, { "flow_id": "flow-396e10ba7a715771a0d690b6", "transport": "udp", "stream": 16, "initiator_ip": "10.9.10.102", "initiator_port": 64956, "responder_ip": "10.9.10.9", "responder_port": 53, "first_frame": 63, "last_frame": 64, "first_seen_epoch": "1631315714.217547", "last_seen_epoch": "1631315714.217859", "packets": 2, "bytes": 241, "initiator_bytes": 81, "responder_bytes": 160 }, { "flow_id": "flow-63317f16031b187856da64a4", "transport": "tcp", "stream": 0, "initiator_ip": "10.9.10.102", "initiator_port": 58079, "responder_ip": "96.17.68.66", "responder_port": 80, "first_frame": 69, "last_frame": 92, "first_seen_epoch": "1631315714.252737", "last_seen_epoch": "1631315715.033857", "packets": 10, "bytes": 876, "initiator_bytes": 397, "responder_bytes": 479 }, { "flow_id": "flow-6c9d563d596be7f78d4df05b", "transport": "tcp", "stream": 1, "initiator_ip": "10.9.10.102", "initiator_port": 58080, "responder_ip": "10.9.10.9", "responder_port": 389, "first_frame": 76, "last_frame": 86, "first_seen_epoch": "1631315714.887521", "last_seen_epoch": "1631315714.90775", "packets": 11, "bytes": 2902, "initiator_bytes": 2392, "responder_bytes": 510 }, { "flow_id": "flow-239d6e38f84e59477c306c6f", "transport": "tcp", "stream": 2, "initiator_ip": "10.9.10.102", "initiator_port": 58081, "responder_ip": "40.83.240.146", "responder_port": 443, "first_frame": 94, "last_frame": 9198, "first_seen_epoch": "1631315715.513126", "last_seen_epoch": "1631320285.52944", "packets": 34, "bytes": 9760, "initiator_bytes": 3737, "responder_bytes": 6023 }, { "flow_id": "flow-e272b26d340263b013dae708", "transport": "udp", "stream": 17, "initiator_ip": "10.9.10.102", "initiator_port": 58038, "responder_ip": "10.9.10.9", "responder_port": 53, "first_frame": 133, "last_frame": 134, "first_seen_epoch": "1631315732.216866", "last_seen_epoch": "1631315732.217241", "packets": 2, "bytes": 241, "initiator_bytes": 81, "responder_bytes": 160 }, { "flow_id": "flow-cee95c2f3648b9cba583adda", "transport": "udp", "stream": 18, "initiator_ip": "10.9.10.102", "initiator_port": 58039, "responder_ip": "10.9.10.9", "responder_port": 389, "first_frame": 135, "last_frame": 136, "first_seen_epoch": "1631315745.097383", "last_seen_epoch": "1631315745.097831", "packets": 2, "bytes": 513, "initiator_bytes": 269, "responder_bytes": 244 }, { "flow_id": "flow-e150c8d65d1744066c6cabf8", "transport": "tcp", "stream": 3, "initiator_ip": "10.9.10.102", "initiator_port": 58082, "responder_ip": "10.9.10.9", "responder_port": 445, "first_frame": 137, "last_frame": 164, "first_seen_epoch": "1631315745.21459", "last_seen_epoch": "1631315756.787848", "packets": 28, "bytes": 7661, "initiator_bytes": 5433, "responder_bytes": 2228 }, { "flow_id": "flow-e861b09ce664f7ad6163b7e5", "transport": "tcp", "stream": 4, "initiator_ip": "10.9.10.9", "initiator_port": 445, "responder_ip": "10.9.10.102", "responder_port": 52301, "first_frame": 165, "last_frame": 166, "first_seen_epoch": "1631315766.178421", "last_seen_epoch": "1631315766.641137", "packets": 2, "bytes": 120, "initiator_bytes": 60, "responder_bytes": 60 }, { "flow_id": "flow-f14761dc454f9047efb4aa86", "transport": "udp", "stream": 19, "initiator_ip": "10.9.10.102", "initiator_port": 59690, "responder_ip": "10.9.10.9", "responder_port": 53, "first_frame": 167, "last_frame": 168, "first_seen_epoch": "1631315792.232266", "last_seen_epoch": "1631315792.232631", "packets": 2, "bytes": 241, "initiator_bytes": 81, "responder_bytes": 160 }, { "flow_id": "flow-41b717c623a287fad9765dd8", "transport": "tcp", "stream": 5, "initiator_ip": "10.9.10.102", "initiator_port": 58086, "responder_ip": "10.9.10.9", "responder_port": 135, "first_frame": 175, "last_frame": 295, "first_seen_epoch": "1631315796.99524", "last_seen_epoch": "1631315812.815466", "packets": 15, "bytes": 1920, "initiator_bytes": 1024, "responder_bytes": 896 }, { "flow_id": "flow-bc7d3ac31063be174f325c6e", "transport": "tcp", "stream": 6, "initiator_ip": "10.9.10.102", "initiator_port": 58087, "responder_ip": "10.9.10.9", "responder_port": 49671, "first_frame": 182, "last_frame": 294, "first_seen_epoch": "1631315797.282443", "last_seen_epoch": "1631315812.815389", "packets": 24, "bytes": 5276, "initiator_bytes": 3218, "responder_bytes": 2058 }, { "flow_id": "flow-ebd3d4b97d16315b3f42286c", "transport": "tcp", "stream": 7, "initiator_ip": "10.9.10.102", "initiator_port": 58088, "responder_ip": "10.9.10.9", "responder_port": 49667, "first_frame": 204, "last_frame": 293, "first_seen_epoch": "1631315797.855589", "last_seen_epoch": "1631315812.815388", "packets": 16, "bytes": 2432, "initiator_bytes": 1458, "responder_bytes": 974 }, { "flow_id": "flow-2358d401bebe6f73b3eb58d4", "transport": "udp", "stream": 20, "initiator_ip": "10.9.10.102", "initiator_port": 50665, "responder_ip": "10.9.10.9", "responder_port": 53, "first_frame": 218, "last_frame": 219, "first_seen_epoch": "1631315797.993791", "last_seen_epoch": "1631315798.069599", "packets": 2, "bytes": 359, "initiator_bytes": 76, "responder_bytes": 283 }, { "flow_id": "flow-5d7ee5f10fe88c889ff895fd", "transport": "tcp", "stream": 8, "initiator_ip": "10.9.10.102", "initiator_port": 58089, "responder_ip": "23.3.84.67", "responder_port": 443, "first_frame": 220, "last_frame": 2518, "first_seen_epoch": "1631315798.072457", "last_seen_epoch": "1631315908.141833", "packets": 25, "bytes": 8578, "initiator_bytes": 1165, "responder_bytes": 7413 }, { "flow_id": "flow-f730a7e15bb0766eb3a0a1f0", "transport": "tcp", "stream": 9, "initiator_ip": "10.9.10.102", "initiator_port": 58090, "responder_ip": "23.3.84.67", "responder_port": 443, "first_frame": 240, "last_frame": 2524, "first_seen_epoch": "1631315799.077926", "last_seen_epoch": "1631315909.371129", "packets": 25, "bytes": 8470, "initiator_bytes": 1216, "responder_bytes": 7254 }, { "flow_id": "flow-b69f14e1e72c1c2cf7b5ab94", "transport": "tcp", "stream": 10, "initiator_ip": "10.9.10.102", "initiator_port": 58091, "responder_ip": "23.3.84.67", "responder_port": 443, "first_frame": 260, "last_frame": 2535, "first_seen_epoch": "1631315799.74253", "last_seen_epoch": "1631315909.868361", "packets": 26, "bytes": 8654, "initiator_bytes": 1224, "responder_bytes": 7430 }, { "flow_id": "flow-96203584b8b68db944d61e4c", "transport": "tcp", "stream": 11, "initiator_ip": "10.9.10.102", "initiator_port": 58092, "responder_ip": "10.9.10.9", "responder_port": 88, "first_frame": 296, "last_frame": 305, "first_seen_epoch": "1631315815.749535", "last_seen_epoch": "1631315815.762845", "packets": 8, "bytes": 926, "initiator_bytes": 481, "responder_bytes": 445 }, { "flow_id": "flow-eabeed2877993cf3149a72e0", "transport": "udp", "stream": 21, "initiator_ip": "10.9.10.102", "initiator_port": 50666, "responder_ip": "10.9.10.9", "responder_port": 389, "first_frame": 298, "last_frame": 301, "first_seen_epoch": "1631315815.760823", "last_seen_epoch": "1631315815.761277", "packets": 2, "bytes": 513, "initiator_bytes": 269, "responder_bytes": 244 }, { "flow_id": "flow-3b17a23d642d147fe3ed36ea", "transport": "tcp", "stream": 12, "initiator_ip": "10.9.10.102", "initiator_port": 58093, "responder_ip": "10.9.10.9", "responder_port": 88, "first_frame": 306, "last_frame": 321, "first_seen_epoch": "1631315815.771534", "last_seen_epoch": "1631315815.986871", "packets": 10, "bytes": 2605, "initiator_bytes": 621, "responder_bytes": 1984 }, { "flow_id": "flow-8419fd329de38642a53a1d5a", "transport": "tcp", "stream": 13, "initiator_ip": "10.9.10.102", "initiator_port": 58094, "responder_ip": "10.9.10.9", "responder_port": 135, "first_frame": 308, "last_frame": 1049, "first_seen_epoch": "1631315815.983405", "last_seen_epoch": "1631315827.819156", "packets": 13, "bytes": 1548, "initiator_bytes": 748, "responder_bytes": 800 }, { "flow_id": "flow-8d2ec44c672800eeddd48d14", "transport": "tcp", "stream": 14, "initiator_ip": "10.9.10.102", "initiator_port": 58095, "responder_ip": "10.9.10.9", "responder_port": 88, "first_frame": 323, "last_frame": 340, "first_seen_epoch": "1631315815.989152", "last_seen_epoch": "1631315815.996535", "packets": 12, "bytes": 3960, "initiator_bytes": 1949, "responder_bytes": 2011 }, { "flow_id": "flow-8e1f93720e22fe593cb529f9", "transport": "tcp", "stream": 15, "initiator_ip": "10.9.10.102", "initiator_port": 58096, "responder_ip": "10.9.10.9", "responder_port": 49667, "first_frame": 325, "last_frame": 1190, "first_seen_epoch": "1631315815.993777", "last_seen_epoch": "1631315847.823026", "packets": 25, "bytes": 6679, "initiator_bytes": 4116, "responder_bytes": 2563 }, { "flow_id": "flow-82a1e1ffe0bd2786c8584c38", "transport": "tcp", "stream": 16, "initiator_ip": "10.9.10.102", "initiator_port": 58097, "responder_ip": "10.9.10.9", "responder_port": 88, "first_frame": 334, "last_frame": 345, "first_seen_epoch": "1631315815.995888", "last_seen_epoch": "1631315815.997987", "packets": 8, "bytes": 942, "initiator_bytes": 489, "responder_bytes": 453 }, { "flow_id": "flow-5f56c7e8c74f0dfb0ca3a596", "transport": "tcp", "stream": 17, "initiator_ip": "10.9.10.102", "initiator_port": 58098, "responder_ip": "10.9.10.9", "responder_port": 88, "first_frame": 346, "last_frame": 356, "first_seen_epoch": "1631315816.018526", "last_seen_epoch": "1631315816.022743", "packets": 9, "bytes": 2553, "initiator_bytes": 569, "responder_bytes": 1984 }, { "flow_id": "flow-61d4d594ddee180c4526bf86", "transport": "tcp", "stream": 18, "initiator_ip": "10.9.10.102", "initiator_port": 58099, "responder_ip": "10.9.10.9", "responder_port": 88, "first_frame": 357, "last_frame": 372, "first_seen_epoch": "1631315816.0579", "last_seen_epoch": "1631315816.111042", "packets": 12, "bytes": 4259, "initiator_bytes": 2122, "responder_bytes": 2137 }, { "flow_id": "flow-26555564f3501c528e279217", "transport": "tcp", "stream": 19, "initiator_ip": "10.9.10.102", "initiator_port": 58100, "responder_ip": "10.9.10.9", "responder_port": 445, "first_frame": 359, "last_frame": 9185, "first_seen_epoch": "1631315816.108273", "last_seen_epoch": "1631320269.796223", "packets": 246, "bytes": 41170, "initiator_bytes": 20904, "responder_bytes": 20266 }, { "flow_id": "flow-9efd1ef72c0b0bc5486cd110", "transport": "tcp", "stream": 20, "initiator_ip": "10.9.10.102", "initiator_port": 58101, "responder_ip": "10.9.10.9", "responder_port": 88, "first_frame": 383, "last_frame": 397, "first_seen_epoch": "1631315816.200563", "last_seen_epoch": "1631315816.203694", "packets": 12, "bytes": 4170, "initiator_bytes": 2087, "responder_bytes": 2083 }, { "flow_id": "flow-9a2bd90cd44e28bb344e825c", "transport": "tcp", "stream": 21, "initiator_ip": "10.9.10.102", "initiator_port": 58102, "responder_ip": "10.9.10.9", "responder_port": 88, "first_frame": 399, "last_frame": 412, "first_seen_epoch": "1631315816.203853", "last_seen_epoch": "1631315816.206879", "packets": 11, "bytes": 3763, "initiator_bytes": 1837, "responder_bytes": 1926 }, { "flow_id": "flow-0d839d9e3d375bec37ca45dc", "transport": "tcp", "stream": 22, "initiator_ip": "10.9.10.102", "initiator_port": 58103, "responder_ip": "10.9.10.9", "responder_port": 389, "first_frame": 475, "last_frame": 509, "first_seen_epoch": "1631315816.633132", "last_seen_epoch": "1631315817.172382", "packets": 20, "bytes": 7852, "initiator_bytes": 3771, "responder_bytes": 4081 }, { "flow_id": "flow-6743afb130130884782315d7", "transport": "tcp", "stream": 23, "initiator_ip": "10.9.10.102", "initiator_port": 58104, "responder_ip": "10.9.10.9", "responder_port": 389, "first_frame": 488, "last_frame": 505, "first_seen_epoch": "1631315817.02437", "last_seen_epoch": "1631315817.147124", "packets": 15, "bytes": 3836, "initiator_bytes": 2908, "responder_bytes": 928 }, { "flow_id": "flow-a4d00154f953fe94ceee1b0b", "transport": "udp", "stream": 22, "initiator_ip": "10.9.10.102", "initiator_port": 61056, "responder_ip": "10.9.10.9", "responder_port": 53, "first_frame": 510, "last_frame": 511, "first_seen_epoch": "1631315817.470608", "last_seen_epoch": "1631315817.545292", "packets": 2, "bytes": 240, "initiator_bytes": 75, "responder_bytes": 165 }, { "flow_id": "flow-3e25a44a6526fd1bdc7ff59b", "transport": "tcp", "stream": 24, "initiator_ip": "10.9.10.102", "initiator_port": 58105, "responder_ip": "184.85.229.68", "responder_port": 443, "first_frame": 512, "last_frame": 2474, "first_seen_epoch": "1631315817.581479", "last_seen_epoch": "1631315878.157973", "packets": 27, "bytes": 10412, "initiator_bytes": 1166, "responder_bytes": 9246 }, { "flow_id": "flow-7cdb2e8e202c80dfa062c6bb", "transport": "tcp", "stream": 25, "initiator_ip": "10.9.10.102", "initiator_port": 58106, "responder_ip": "184.85.229.68", "responder_port": 443, "first_frame": 513, "last_frame": 2471, "first_seen_epoch": "1631315817.58148", "last_seen_epoch": "1631315878.107818", "packets": 26, "bytes": 10352, "initiator_bytes": 1106, "responder_bytes": 9246 }, { "flow_id": "flow-bcd7153c852a2554f3d74fdd", "transport": "udp", "stream": 23, "initiator_ip": "10.9.10.102", "initiator_port": 63203, "responder_ip": "10.9.10.9", "responder_port": 53, "first_frame": 555, "last_frame": 556, "first_seen_epoch": "1631315818.320206", "last_seen_epoch": "1631315818.39454", "packets": 2, "bytes": 217, "initiator_bytes": 71, "responder_bytes": 146 }, { "flow_id": "flow-a719eea8ba522f98119920f0", "transport": "tcp", "stream": 26, "initiator_ip": "10.9.10.102", "initiator_port": 58107, "responder_ip": "204.79.197.203", "responder_port": 443, "first_frame": 557, "last_frame": 2500, "first_seen_epoch": "1631315818.400952", "last_seen_epoch": "1631315886.450826", "packets": 21, "bytes": 8304, "initiator_bytes": 1643, "responder_bytes": 6661 }, { "flow_id": "flow-4fe55eefbe1eba6460664970", "transport": "udp", "stream": 24, "initiator_ip": "10.9.10.102", "initiator_port": 63317, "responder_ip": "10.9.10.9", "responder_port": 53, "first_frame": 577, "last_frame": 590, "first_seen_epoch": "1631315821.607731", "last_seen_epoch": "1631315821.689446", "packets": 2, "bytes": 292, "initiator_bytes": 72, "responder_bytes": 220 }, { "flow_id": "flow-7d003e0c870098ce5caa1502", "transport": "udp", "stream": 25, "initiator_ip": "10.9.10.102", "initiator_port": 59335, "responder_ip": "10.9.10.9", "responder_port": 53, "first_frame": 578, "last_frame": 587, "first_seen_epoch": "1631315821.609487", "last_seen_epoch": "1631315821.687583", "packets": 2, "bytes": 287, "initiator_bytes": 113, "responder_bytes": 174 }, { "flow_id": "flow-d967d06ba242df2c00ada0be", "transport": "udp", "stream": 26, "initiator_ip": "10.9.10.102", "initiator_port": 59612, "responder_ip": "10.9.10.9", "responder_port": 53, "first_frame": 579, "last_frame": 584, "first_seen_epoch": "1631315821.612358", "last_seen_epoch": "1631315821.686441", "packets": 2, "bytes": 282, "initiator_bytes": 92, "responder_bytes": 190 }, { "flow_id": "flow-baf9cf4a9e66ce51943b1073", "transport": "tcp", "stream": 27, "initiator_ip": "10.9.10.102", "initiator_port": 58108, "responder_ip": "13.107.21.200", "responder_port": 443, "first_frame": 580, "last_frame": 2575, "first_seen_epoch": "1631315821.613978", "last_seen_epoch": "1631315946.568613", "packets": 21, "bytes": 7386, "initiator_bytes": 989, "responder_bytes": 6397 }, { "flow_id": "flow-be3bf27921db92bfc9f35dfb", "transport": "udp", "stream": 27, "initiator_ip": "10.9.10.102", "initiator_port": 50928, "responder_ip": "10.9.10.9", "responder_port": 53, "first_frame": 581, "last_frame": 586, "first_seen_epoch": "1631315821.615606", "last_seen_epoch": "1631315821.687509", "packets": 2, "bytes": 286, "initiator_bytes": 77, "responder_bytes": 209 }, { "flow_id": "flow-da272fb9383800dfd0b93512", "transport": "udp", "stream": 28, "initiator_ip": "10.9.10.102", "initiator_port": 59983, "responder_ip": "10.9.10.9", "responder_port": 53, "first_frame": 582, "last_frame": 1007, "first_seen_epoch": "1631315821.618106", "last_seen_epoch": "1631315825.758203", "packets": 5, "bytes": 538, "initiator_bytes": 308, "responder_bytes": 230 }, { "flow_id": "flow-8fe59733ae81897b26f52313", "transport": "udp", "stream": 29, "initiator_ip": "10.9.10.102", "initiator_port": 51910, "responder_ip": "10.9.10.9", "responder_port": 53, "first_frame": 583, "last_frame": 601, "first_seen_epoch": "1631315821.620987", "last_seen_epoch": "1631315821.704192", "packets": 2, "bytes": 323, "initiator_bytes": 113, "responder_bytes": 210 }, { "flow_id": "flow-2cda8df7aa3c5abe85c22aef", "transport": "tcp", "stream": 28, "initiator_ip": "10.9.10.102", "initiator_port": 58109, "responder_ip": "13.107.246.254", "responder_port": 443, "first_frame": 589, "last_frame": 2583, "first_seen_epoch": "1631315821.689017", "last_seen_epoch": "1631315948.767331", "packets": 23, "bytes": 6702, "initiator_bytes": 1073, "responder_bytes": 5629 }, { "flow_id": "flow-42230e177b64be4b6941a475", "transport": "tcp", "stream": 29, "initiator_ip": "10.9.10.102", "initiator_port": 58110, "responder_ip": "51.137.102.183", "responder_port": 443, "first_frame": 591, "last_frame": 2576, "first_seen_epoch": "1631315821.689913", "last_seen_epoch": "1631315946.800213", "packets": 20, "bytes": 6018, "initiator_bytes": 1094, "responder_bytes": 4924 }, { "flow_id": "flow-0ff4f5af14e3c6ddfabcdd90", "transport": "tcp", "stream": 30, "initiator_ip": "10.9.10.102", "initiator_port": 58111, "responder_ip": "13.107.49.254", "responder_port": 443, "first_frame": 592, "last_frame": 2572, "first_seen_epoch": "1631315821.692432", "last_seen_epoch": "1631315945.922103", "packets": 24, "bytes": 6747, "initiator_bytes": 1118, "responder_bytes": 5629 }, { "flow_id": "flow-e9886d44a0b745a0fc394038", "transport": "tcp", "stream": 31, "initiator_ip": "10.9.10.102", "initiator_port": 58112, "responder_ip": "204.79.197.200", "responder_port": 443, "first_frame": 593, "last_frame": 2586, "first_seen_epoch": "1631315821.692656", "last_seen_epoch": "1631315952.963315", "packets": 40, "bytes": 15913, "initiator_bytes": 7223, "responder_bytes": 8690 }, { "flow_id": "flow-e88591e2f94cd2f21daabd57", "transport": "udp", "stream": 30, "initiator_ip": "10.9.10.102", "initiator_port": 51031, "responder_ip": "10.9.10.9", "responder_port": 53, "first_frame": 595, "last_frame": 596, "first_seen_epoch": "1631315821.695636", "last_seen_epoch": "1631315821.695989", "packets": 2, "bytes": 221, "initiator_bytes": 77, "responder_bytes": 144 }, { "flow_id": "flow-a5329d64e5ea0b737c539d30", "transport": "udp", "stream": 31, "initiator_ip": "10.9.10.102", "initiator_port": 56838, "responder_ip": "10.9.10.9", "responder_port": 53, "first_frame": 597, "last_frame": 617, "first_seen_epoch": "1631315821.698728", "last_seen_epoch": "1631315821.77566", "packets": 2, "bytes": 221, "initiator_bytes": 77, "responder_bytes": 144 }, { "flow_id": "flow-cf89fb0b59f3ae2df88f15e9", "transport": "tcp", "stream": 32, "initiator_ip": "10.9.10.102", "initiator_port": 58113, "responder_ip": "13.107.246.254", "responder_port": 443, "first_frame": 598, "last_frame": 2579, "first_seen_epoch": "1631315821.699975", "last_seen_epoch": "1631315947.75568", "packets": 22, "bytes": 6627, "initiator_bytes": 998, "responder_bytes": 5629 }, { "flow_id": "flow-8c47b7be0d3a6c5b9ca00e98", "transport": "udp", "stream": 32, "initiator_ip": "10.9.10.102", "initiator_port": 52993, "responder_ip": "10.9.10.9", "responder_port": 53, "first_frame": 599, "last_frame": 619, "first_seen_epoch": "1631315821.701103", "last_seen_epoch": "1631315821.775938", "packets": 2, "bytes": 241, "initiator_bytes": 81, "responder_bytes": 160 }, { "flow_id": "flow-1f8854d8adca2c3fa62a2507", "transport": "udp", "stream": 33, "initiator_ip": "10.9.10.102", "initiator_port": 51512, "responder_ip": "10.9.10.9", "responder_port": 53, "first_frame": 600, "last_frame": 618, "first_seen_epoch": "1631315821.703853", "last_seen_epoch": "1631315821.775735", "packets": 2, "bytes": 221, "initiator_bytes": 77, "responder_bytes": 144 }, { "flow_id": "flow-e620b05f21a7bcf6e1173f7c", "transport": "udp", "stream": 34, "initiator_ip": "10.9.10.102", "initiator_port": 59867, "responder_ip": "10.9.10.9", "responder_port": 53, "first_frame": 602, "last_frame": 625, "first_seen_epoch": "1631315821.707229", "last_seen_epoch": "1631315821.777719", "packets": 2, "bytes": 249, "initiator_bytes": 87, "responder_bytes": 162 }, { "flow_id": "flow-714d0c2b97aea74129052545", "transport": "tcp", "stream": 33, "initiator_ip": "10.9.10.102", "initiator_port": 58114, "responder_ip": "23.100.36.182", "responder_port": 443, "first_frame": 603, "last_frame": 2582, "first_seen_epoch": "1631315821.708475", "last_seen_epoch": "1631315948.727655", "packets": 20, "bytes": 6017, "initiator_bytes": 1034, "responder_bytes": 4983 }, { "flow_id": "flow-c2ae3f8d156ab0a508a5f0d4", "transport": "udp", "stream": 35, "initiator_ip": "10.9.10.102", "initiator_port": 57496, "responder_ip": "10.9.10.9", "responder_port": 53, "first_frame": 604, "last_frame": 637, "first_seen_epoch": "1631315821.711728", "last_seen_epoch": "1631315821.791996", "packets": 2, "bytes": 231, "initiator_bytes": 79, "responder_bytes": 152 }, { "flow_id": "flow-32106c7ca13adf117cfacd3a", "transport": "tcp", "stream": 34, "initiator_ip": "10.9.10.102", "initiator_port": 58115, "responder_ip": "13.107.3.254", "responder_port": 443, "first_frame": 626, "last_frame": 2574, "first_seen_epoch": "1631315821.777925", "last_seen_epoch": "1631315946.079771", "packets": 22, "bytes": 6627, "initiator_bytes": 1058, "responder_bytes": 5569 }, { "flow_id": "flow-eec2912ddc90a889f2eb8079", "transport": "tcp", "stream": 35, "initiator_ip": "10.9.10.102", "initiator_port": 58116, "responder_ip": "13.107.18.254", "responder_port": 443, "first_frame": 629, "last_frame": 2552, "first_seen_epoch": "1631315821.7788", "last_seen_epoch": "1631315942.442602", "packets": 22, "bytes": 6604, "initiator_bytes": 1058, "responder_bytes": 5546 }, { "flow_id": "flow-bc72a2198218876104f2b827", "transport": "tcp", "stream": 36, "initiator_ip": "10.9.10.102", "initiator_port": 58117, "responder_ip": "52.113.196.254", "responder_port": 443, "first_frame": 630, "last_frame": 2573, "first_seen_epoch": "1631315821.779973", "last_seen_epoch": "1631315945.93728", "packets": 23, "bytes": 6691, "initiator_bytes": 1062, "responder_bytes": 5629 }, { "flow_id": "flow-6fbf3fd8c22759bd708ecc2b", "transport": "tcp", "stream": 37, "initiator_ip": "10.9.10.102", "initiator_port": 58118, "responder_ip": "72.21.81.200", "responder_port": 443, "first_frame": 631, "last_frame": 7760, "first_seen_epoch": "1631315821.781223", "last_seen_epoch": "1631316944.553191", "packets": 36, "bytes": 9707, "initiator_bytes": 1636, "responder_bytes": 8071 }, { "flow_id": "flow-6a32d6c43be906deca20ff88", "transport": "udp", "stream": 36, "initiator_ip": "10.9.10.102", "initiator_port": 58243, "responder_ip": "10.9.10.9", "responder_port": 53, "first_frame": 632, "last_frame": 671, "first_seen_epoch": "1631315821.783225", "last_seen_epoch": "1631315821.855931", "packets": 2, "bytes": 221, "initiator_bytes": 77, "responder_bytes": 144 }, { "flow_id": "flow-571983a8910c17bc92b4a37d", "transport": "udp", "stream": 37, "initiator_ip": "10.9.10.102", "initiator_port": 56716, "responder_ip": "10.9.10.9", "responder_port": 53, "first_frame": 633, "last_frame": 672, "first_seen_epoch": "1631315821.787724", "last_seen_epoch": "1631315821.856019", "packets": 2, "bytes": 278, "initiator_bytes": 73, "responder_bytes": 205 }, { "flow_id": "flow-68a51fe5d84425a7d5aa264e", "transport": "udp", "stream": 38, "initiator_ip": "10.9.10.102", "initiator_port": 57627, "responder_ip": "10.9.10.9", "responder_port": 53, "first_frame": 634, "last_frame": 712, "first_seen_epoch": "1631315821.790476", "last_seen_epoch": "1631315821.917378", "packets": 3, "bytes": 433, "initiator_bytes": 158, "responder_bytes": 275 }, { "flow_id": "flow-1147c67d2901556a44a7cd8b", "transport": "tcp", "stream": 38, "initiator_ip": "10.9.10.102", "initiator_port": 58119, "responder_ip": "13.107.136.254", "responder_port": 443, "first_frame": 639, "last_frame": 2570, "first_seen_epoch": "1631315821.796722", "last_seen_epoch": "1631315944.875435", "packets": 22, "bytes": 6629, "initiator_bytes": 1060, "responder_bytes": 5569 }, { "flow_id": "flow-7751b2e567435952d5567dfa", "transport": "udp", "stream": 39, "initiator_ip": "10.9.10.102", "initiator_port": 60501, "responder_ip": "10.9.10.9", "responder_port": 53, "first_frame": 642, "last_frame": 707, "first_seen_epoch": "1631315821.811473", "last_seen_epoch": "1631315821.891636", "packets": 2, "bytes": 413, "initiator_bytes": 74, "responder_bytes": 339 }, { "flow_id": "flow-441b441b7d2435d86e457326", "transport": "tcp", "stream": 39, "initiator_ip": "10.9.10.102", "initiator_port": 58121, "responder_ip": "204.79.197.254", "responder_port": 443, "first_frame": 690, "last_frame": 2577, "first_seen_epoch": "1631315821.865834", "last_seen_epoch": "1631315947.305954", "packets": 22, "bytes": 6627, "initiator_bytes": 1058, "responder_bytes": 5569 }, { "flow_id": "flow-85b6549c797e1ced4b7165d1", "transport": "tcp", "stream": 40, "initiator_ip": "10.9.10.102", "initiator_port": 58120, "responder_ip": "204.79.197.222", "responder_port": 443, "first_frame": 691, "last_frame": 2581, "first_seen_epoch": "1631315821.865835", "last_seen_epoch": "1631315948.612846", "packets": 23, "bytes": 6683, "initiator_bytes": 1114, "responder_bytes": 5569 }, { "flow_id": "flow-3ed7e3ef8a4437630218d010", "transport": "tcp", "stream": 41, "initiator_ip": "10.9.10.102", "initiator_port": 58122, "responder_ip": "20.190.151.131", "responder_port": 443, "first_frame": 710, "last_frame": 2548, "first_seen_epoch": "1631315821.898094", "last_seen_epoch": "1631315932.244675", "packets": 40, "bytes": 27457, "initiator_bytes": 6707, "responder_bytes": 20750 }, { "flow_id": "flow-d2c83dd65fc16e55ce727dc5", "transport": "tcp", "stream": 42, "initiator_ip": "10.9.10.102", "initiator_port": 58123, "responder_ip": "20.140.48.71", "responder_port": 443, "first_frame": 715, "last_frame": 2571, "first_seen_epoch": "1631315821.920343", "last_seen_epoch": "1631315945.60077", "packets": 18, "bytes": 5138, "initiator_bytes": 1000, "responder_bytes": 4138 }, { "flow_id": "flow-c6431d88c98a899a214de58c", "transport": "tcp", "stream": 43, "initiator_ip": "10.9.10.102", "initiator_port": 58124, "responder_ip": "204.79.197.203", "responder_port": 443, "first_frame": 966, "last_frame": 2585, "first_seen_epoch": "1631315823.417922", "last_seen_epoch": "1631315951.62099", "packets": 41, "bytes": 19511, "initiator_bytes": 2450, "responder_bytes": 17061 }, { "flow_id": "flow-9b99c6cc16c3598fdc9ff7aa", "transport": "tcp", "stream": 44, "initiator_ip": "10.9.10.102", "initiator_port": 58125, "responder_ip": "20.140.48.71", "responder_port": 443, "first_frame": 1008, "last_frame": 2584, "first_seen_epoch": "1631315825.760725", "last_seen_epoch": "1631315951.453256", "packets": 19, "bytes": 5194, "initiator_bytes": 998, "responder_bytes": 4196 }, { "flow_id": "flow-0db22aff8f44ce694a20a08f", "transport": "udp", "stream": 40, "initiator_ip": "10.9.10.102", "initiator_port": 57414, "responder_ip": "10.9.10.9", "responder_port": 53, "first_frame": 1086, "last_frame": 1088, "first_seen_epoch": "1631315834.099848", "last_seen_epoch": "1631315834.196449", "packets": 3, "bytes": 336, "initiator_bytes": 182, "responder_bytes": 154 }, { "flow_id": "flow-d08e602dd2f5a553239247f9", "transport": "tcp", "stream": 45, "initiator_ip": "10.9.10.102", "initiator_port": 58126, "responder_ip": "52.137.106.217", "responder_port": 443, "first_frame": 1089, "last_frame": 1179, "first_seen_epoch": "1631315834.202715", "last_seen_epoch": "1631315844.145782", "packets": 15, "bytes": 7571, "initiator_bytes": 1094, "responder_bytes": 6477 }, { "flow_id": "flow-c039e6cb725e57c5b63472ab", "transport": "tcp", "stream": 46, "initiator_ip": "10.9.10.102", "initiator_port": 58127, "responder_ip": "52.137.106.217", "responder_port": 443, "first_frame": 1090, "last_frame": 2587, "first_seen_epoch": "1631315834.203097", "last_seen_epoch": "1631315959.42218", "packets": 21, "bytes": 8080, "initiator_bytes": 1290, "responder_bytes": 6790 }, { "flow_id": "flow-c1202aec5d8aaaf9cf555040", "transport": "tcp", "stream": 47, "initiator_ip": "10.9.10.102", "initiator_port": 58128, "responder_ip": "52.137.106.217", "responder_port": 443, "first_frame": 1123, "last_frame": 1137, "first_seen_epoch": "1631315835.136062", "last_seen_epoch": "1631315836.892605", "packets": 15, "bytes": 6065, "initiator_bytes": 1062, "responder_bytes": 5003 }, { "flow_id": "flow-fc82f3d6f200b9df4acd3161", "transport": "udp", "stream": 41, "initiator_ip": "10.9.10.102", "initiator_port": 52570, "responder_ip": "10.9.10.9", "responder_port": 53, "first_frame": 1143, "last_frame": 1144, "first_seen_epoch": "1631315840.42578", "last_seen_epoch": "1631315840.502907", "packets": 2, "bytes": 295, "initiator_bytes": 88, "responder_bytes": 207 }, { "flow_id": "flow-e070d3b77d858ce44d127837", "transport": "udp", "stream": 42, "initiator_ip": "10.9.10.102", "initiator_port": 60803, "responder_ip": "10.9.10.9", "responder_port": 53, "first_frame": 1145, "last_frame": 1146, "first_seen_epoch": "1631315840.524648", "last_seen_epoch": "1631315840.596048", "packets": 2, "bytes": 321, "initiator_bytes": 77, "responder_bytes": 244 }, { "flow_id": "flow-05be869ce387c670b582454b", "transport": "tcp", "stream": 48, "initiator_ip": "10.9.10.102", "initiator_port": 58129, "responder_ip": "52.109.76.36", "responder_port": 443, "first_frame": 1147, "last_frame": 2505, "first_seen_epoch": "1631315840.681391", "last_seen_epoch": "1631315891.920568", "packets": 17, "bytes": 8310, "initiator_bytes": 1339, "responder_bytes": 6971 }, { "flow_id": "flow-530a9ff2e15091d438827af6", "transport": "tcp", "stream": 49, "initiator_ip": "10.9.10.102", "initiator_port": 58130, "responder_ip": "52.109.8.19", "responder_port": 443, "first_frame": 1162, "last_frame": 2506, "first_seen_epoch": "1631315842.036098", "last_seen_epoch": "1631315891.92057", "packets": 17, "bytes": 8058, "initiator_bytes": 1344, "responder_bytes": 6714 }, { "flow_id": "flow-a5e8e33f92f2b0fe2d55280a", "transport": "udp", "stream": 43, "initiator_ip": "10.9.10.102", "initiator_port": 57667, "responder_ip": "10.9.10.9", "responder_port": 53, "first_frame": 1180, "last_frame": 1182, "first_seen_epoch": "1631315847.020323", "last_seen_epoch": "1631315847.253809", "packets": 3, "bytes": 253, "initiator_bytes": 158, "responder_bytes": 95 }, { "flow_id": "flow-8ace2ac00d73020da30ef0e6", "transport": "tcp", "stream": 50, "initiator_ip": "10.9.10.102", "initiator_port": 58131, "responder_ip": "194.62.42.206", "responder_port": 80, "first_frame": 1183, "last_frame": 1477, "first_seen_epoch": "1631315847.500681", "last_seen_epoch": "1631315850.281468", "packets": 291, "bytes": 301789, "initiator_bytes": 5096, "responder_bytes": 296693 }, { "flow_id": "flow-00ae81da287d3189b4c7c291", "transport": "udp", "stream": 44, "initiator_ip": "10.9.10.102", "initiator_port": 49543, "responder_ip": "10.9.10.9", "responder_port": 53, "first_frame": 1478, "last_frame": 1480, "first_seen_epoch": "1631315851.802675", "last_seen_epoch": "1631315851.872188", "packets": 2, "bytes": 226, "initiator_bytes": 73, "responder_bytes": 153 }, { "flow_id": "flow-5aab904b59c63788dfa4ebf7", "transport": "tcp", "stream": 51, "initiator_ip": "10.9.10.102", "initiator_port": 58132, "responder_ip": "167.172.37.9", "responder_port": 443, "first_frame": 1479, "last_frame": 1841, "first_seen_epoch": "1631315851.848422", "last_seen_epoch": "1631315856.387032", "packets": 309, "bytes": 311988, "initiator_bytes": 8226, "responder_bytes": 303762 }, { "flow_id": "flow-35d7cd1cf2ba3b9e8b8e0215", "transport": "tcp", "stream": 52, "initiator_ip": "10.9.10.102", "initiator_port": 58133, "responder_ip": "104.215.148.63", "responder_port": 443, "first_frame": 1481, "last_frame": 2625, "first_seen_epoch": "1631315851.874672", "last_seen_epoch": "1631315962.054928", "packets": 31, "bytes": 10509, "initiator_bytes": 1406, "responder_bytes": 9103 }, { "flow_id": "flow-51308a645522b74f4706dd54", "transport": "tcp", "stream": 53, "initiator_ip": "10.9.10.102", "initiator_port": 58134, "responder_ip": "23.3.85.234", "responder_port": 443, "first_frame": 1538, "last_frame": 1944, "first_seen_epoch": "1631315853.547297", "last_seen_epoch": "1631315874.924545", "packets": 33, "bytes": 9215, "initiator_bytes": 1375, "responder_bytes": 7840 }, { "flow_id": "flow-101e9de815dc8fa91544426c", "transport": "tcp", "stream": 54, "initiator_ip": "10.9.10.102", "initiator_port": 58135, "responder_ip": "94.158.245.52", "responder_port": 443, "first_frame": 1842, "last_frame": 2830, "first_seen_epoch": "1631315856.466363", "last_seen_epoch": "1631315967.446714", "packets": 25, "bytes": 7539, "initiator_bytes": 3991, "responder_bytes": 3548 }, { "flow_id": "flow-96a5410534dc42d3dfbad970", "transport": "tcp", "stream": 55, "initiator_ip": "10.9.10.102", "initiator_port": 58136, "responder_ip": "94.158.245.52", "responder_port": 443, "first_frame": 1860, "last_frame": 1894, "first_seen_epoch": "1631315861.545999", "last_seen_epoch": "1631315864.646682", "packets": 23, "bytes": 5283, "initiator_bytes": 4325, "responder_bytes": 958 }, { "flow_id": "flow-8dbf95ed48c2d07ecc69ac6e", "transport": "tcp", "stream": 56, "initiator_ip": "10.9.10.102", "initiator_port": 58137, "responder_ip": "94.158.245.52", "responder_port": 443, "first_frame": 1879, "last_frame": 1903, "first_seen_epoch": "1631315863.514196", "last_seen_epoch": "1631315866.078426", "packets": 20, "bytes": 5083, "initiator_bytes": 4185, "responder_bytes": 898 }, { "flow_id": "flow-30bcccfaf3347edacd6e0181", "transport": "tcp", "stream": 57, "initiator_ip": "10.9.10.102", "initiator_port": 58138, "responder_ip": "94.158.245.52", "responder_port": 443, "first_frame": 1902, "last_frame": 1929, "first_seen_epoch": "1631315865.835493", "last_seen_epoch": "1631315868.427968", "packets": 25, "bytes": 5734, "initiator_bytes": 4710, "responder_bytes": 1024 }, { "flow_id": "flow-23c1a0ebd3298b7cd68317bb", "transport": "udp", "stream": 45, "initiator_ip": "10.9.10.102", "initiator_port": 50440, "responder_ip": "10.9.10.9", "responder_port": 53, "first_frame": 1932, "last_frame": 1946, "first_seen_epoch": "1631315872.895782", "last_seen_epoch": "1631315876.496286", "packets": 5, "bytes": 688, "initiator_bytes": 368, "responder_bytes": 320 }, { "flow_id": "flow-20974617e1f2d59179da56e6", "transport": "tcp", "stream": 58, "initiator_ip": "10.9.10.102", "initiator_port": 58139, "responder_ip": "23.3.86.10", "responder_port": 443, "first_frame": 1947, "last_frame": 7566, "first_seen_epoch": "1631315876.501044", "last_seen_epoch": "1631316377.224991", "packets": 28, "bytes": 11933, "initiator_bytes": 3989, "responder_bytes": 7944 }, { "flow_id": "flow-de7cc5dca3a0cd5557b6dd7c", "transport": "tcp", "stream": 59, "initiator_ip": "10.9.10.102", "initiator_port": 58141, "responder_ip": "23.3.86.10", "responder_port": 443, "first_frame": 1948, "last_frame": 7553, "first_seen_epoch": "1631315876.501045", "last_seen_epoch": "1631316377.207218", "packets": 29, "bytes": 12458, "initiator_bytes": 3942, "responder_bytes": 8516 }, { "flow_id": "flow-f4a1c26f2a06b5195e9ec740", "transport": "tcp", "stream": 60, "initiator_ip": "10.9.10.102", "initiator_port": 58142, "responder_ip": "23.3.86.10", "responder_port": 443, "first_frame": 1949, "last_frame": 7557, "first_seen_epoch": "1631315876.501046", "last_seen_epoch": "1631316377.216592", "packets": 51, "bytes": 33177, "initiator_bytes": 4508, "responder_bytes": 28669 }, { "flow_id": "flow-954059215f5d4ee8595a5d53", "transport": "tcp", "stream": 61, "initiator_ip": "10.9.10.102", "initiator_port": 58140, "responder_ip": "23.3.86.10", "responder_port": 443, "first_frame": 1950, "last_frame": 7565, "first_seen_epoch": "1631315876.501047", "last_seen_epoch": "1631316377.223901", "packets": 28, "bytes": 11933, "initiator_bytes": 3989, "responder_bytes": 7944 }, { "flow_id": "flow-b8d78d319694895cd5058f1c", "transport": "tcp", "stream": 62, "initiator_ip": "10.9.10.102", "initiator_port": 58144, "responder_ip": "23.3.86.10", "responder_port": 443, "first_frame": 1951, "last_frame": 7572, "first_seen_epoch": "1631315876.501092", "last_seen_epoch": "1631316377.237587", "packets": 50, "bytes": 33452, "initiator_bytes": 4026, "responder_bytes": 29426 }, { "flow_id": "flow-3f8110e3696d83a873983ac9", "transport": "tcp", "stream": 63, "initiator_ip": "10.9.10.102", "initiator_port": 58143, "responder_ip": "23.3.86.10", "responder_port": 443, "first_frame": 1952, "last_frame": 7564, "first_seen_epoch": "1631315876.501093", "last_seen_epoch": "1631316377.223901", "packets": 25, "bytes": 9829, "initiator_bytes": 3482, "responder_bytes": 6347 }, { "flow_id": "flow-7589daa31146bcee5e7cea60", "transport": "tcp", "stream": 64, "initiator_ip": "10.9.10.102", "initiator_port": 58146, "responder_ip": "23.3.86.10", "responder_port": 443, "first_frame": 1953, "last_frame": 7569, "first_seen_epoch": "1631315876.501173", "last_seen_epoch": "1631316377.235208", "packets": 44, "bytes": 27539, "initiator_bytes": 3904, "responder_bytes": 23635 }, { "flow_id": "flow-2fa85a5a66d6f5aabe68863c", "transport": "tcp", "stream": 65, "initiator_ip": "10.9.10.102", "initiator_port": 58145, "responder_ip": "23.3.86.10", "responder_port": 443, "first_frame": 1954, "last_frame": 7622, "first_seen_epoch": "1631315876.501175", "last_seen_epoch": "1631316387.886587", "packets": 53, "bytes": 34890, "initiator_bytes": 4903, "responder_bytes": 29987 }, { "flow_id": "flow-3e812821f561db5ff1a19a5f", "transport": "udp", "stream": 46, "initiator_ip": "10.9.10.102", "initiator_port": 57207, "responder_ip": "10.9.10.9", "responder_port": 53, "first_frame": 2014, "last_frame": 2015, "first_seen_epoch": "1631315876.832668", "last_seen_epoch": "1631315876.832971", "packets": 2, "bytes": 324, "initiator_bytes": 128, "responder_bytes": 196 }, { "flow_id": "flow-312db17524622b32ca365c38", "transport": "udp", "stream": 47, "initiator_ip": "10.9.10.102", "initiator_port": 57208, "responder_ip": "10.9.10.9", "responder_port": 389, "first_frame": 2016, "last_frame": 2017, "first_seen_epoch": "1631315876.835446", "last_seen_epoch": "1631315876.835875", "packets": 2, "bytes": 513, "initiator_bytes": 269, "responder_bytes": 244 }, { "flow_id": "flow-7985ae68fe3677e874d87d47", "transport": "tcp", "stream": 66, "initiator_ip": "10.9.10.102", "initiator_port": 58147, "responder_ip": "10.9.10.9", "responder_port": 135, "first_frame": 2037, "last_frame": 2153, "first_seen_epoch": "1631315876.966114", "last_seen_epoch": "1631315877.125896", "packets": 11, "bytes": 1584, "initiator_bytes": 904, "responder_bytes": 680 }, { "flow_id": "flow-efc1464159920f12685b2cc1", "transport": "tcp", "stream": 67, "initiator_ip": "10.9.10.102", "initiator_port": 58148, "responder_ip": "10.9.10.9", "responder_port": 49667, "first_frame": 2048, "last_frame": 2154, "first_seen_epoch": "1631315877.044274", "last_seen_epoch": "1631315877.125897", "packets": 24, "bytes": 7021, "initiator_bytes": 4400, "responder_bytes": 2621 }, { "flow_id": "flow-879cd78ddb309a5c7e6d4e29", "transport": "tcp", "stream": 68, "initiator_ip": "10.9.10.102", "initiator_port": 58149, "responder_ip": "10.9.10.9", "responder_port": 389, "first_frame": 2097, "last_frame": 2152, "first_seen_epoch": "1631315877.082422", "last_seen_epoch": "1631315877.120169", "packets": 21, "bytes": 7560, "initiator_bytes": 3481, "responder_bytes": 4079 }, { "flow_id": "flow-f5e62e76b9ae11dd89f098cb", "transport": "tcp", "stream": 69, "initiator_ip": "10.9.10.102", "initiator_port": 58150, "responder_ip": "10.9.10.9", "responder_port": 389, "first_frame": 2128, "last_frame": 2148, "first_seen_epoch": "1631315877.101273", "last_seen_epoch": "1631315877.119773", "packets": 18, "bytes": 6974, "initiator_bytes": 2881, "responder_bytes": 4093 }, { "flow_id": "flow-ca11ab540270a61c56b5ed85", "transport": "udp", "stream": 48, "initiator_ip": "10.9.10.102", "initiator_port": 54756, "responder_ip": "10.9.10.9", "responder_port": 53, "first_frame": 2295, "last_frame": 2306, "first_seen_epoch": "1631315877.448892", "last_seen_epoch": "1631315877.614309", "packets": 3, "bytes": 373, "initiator_bytes": 176, "responder_bytes": 197 }, { "flow_id": "flow-27c41b7bb71c919a12c62cfe", "transport": "tcp", "stream": 70, "initiator_ip": "10.9.10.102", "initiator_port": 58151, "responder_ip": "23.3.85.202", "responder_port": 80, "first_frame": 2307, "last_frame": 2334, "first_seen_epoch": "1631315877.620509", "last_seen_epoch": "1631315877.86575", "packets": 9, "bytes": 3582, "initiator_bytes": 710, "responder_bytes": 2872 }, { "flow_id": "flow-78443d65d6629576dc2e8fdd", "transport": "tcp", "stream": 71, "initiator_ip": "10.9.10.102", "initiator_port": 58153, "responder_ip": "23.3.85.202", "responder_port": 80, "first_frame": 2308, "last_frame": 2400, "first_seen_epoch": "1631315877.62051", "last_seen_epoch": "1631315877.910697", "packets": 29, "bytes": 21713, "initiator_bytes": 1130, "responder_bytes": 20583 }, { "flow_id": "flow-3de28c8842fd1e14ef9788cd", "transport": "tcp", "stream": 72, "initiator_ip": "10.9.10.102", "initiator_port": 58152, "responder_ip": "23.3.85.202", "responder_port": 80, "first_frame": 2309, "last_frame": 2456, "first_seen_epoch": "1631315877.620512", "last_seen_epoch": "1631315877.999136", "packets": 37, "bytes": 27040, "initiator_bytes": 1370, "responder_bytes": 25670 }, { "flow_id": "flow-01045179d49f8731df8d94ce", "transport": "tcp", "stream": 73, "initiator_ip": "10.9.10.102", "initiator_port": 58155, "responder_ip": "23.3.85.202", "responder_port": 80, "first_frame": 2310, "last_frame": 2428, "first_seen_epoch": "1631315877.620512", "last_seen_epoch": "1631315877.936375", "packets": 19, "bytes": 15879, "initiator_bytes": 770, "responder_bytes": 15109 }, { "flow_id": "flow-4b42359e7d67e78dd63caa3d", "transport": "tcp", "stream": 74, "initiator_ip": "10.9.10.102", "initiator_port": 58154, "responder_ip": "23.3.85.202", "responder_port": 80, "first_frame": 2311, "last_frame": 2406, "first_seen_epoch": "1631315877.620541", "last_seen_epoch": "1631315877.911809", "packets": 26, "bytes": 20215, "initiator_bytes": 1010, "responder_bytes": 19205 }, { "flow_id": "flow-527e5261acbdab1679bec8bc", "transport": "tcp", "stream": 75, "initiator_ip": "10.9.10.102", "initiator_port": 58156, "responder_ip": "23.3.85.202", "responder_port": 80, "first_frame": 2326, "last_frame": 2455, "first_seen_epoch": "1631315877.731444", "last_seen_epoch": "1631315877.999134", "packets": 24, "bytes": 19066, "initiator_bytes": 950, "responder_bytes": 18116 }, { "flow_id": "flow-782a319ee8000038dbc06f43", "transport": "udp", "stream": 49, "initiator_ip": "10.9.10.102", "initiator_port": 63034, "responder_ip": "10.9.10.9", "responder_port": 53, "first_frame": 2328, "last_frame": 2370, "first_seen_epoch": "1631315877.761881", "last_seen_epoch": "1631315877.905601", "packets": 3, "bytes": 326, "initiator_bytes": 162, "responder_bytes": 164 }, { "flow_id": "flow-3502c1bbca8469b7c9c47178", "transport": "tcp", "stream": 76, "initiator_ip": "10.9.10.102", "initiator_port": 58157, "responder_ip": "23.3.6.28", "responder_port": 443, "first_frame": 2411, "last_frame": 2551, "first_seen_epoch": "1631315877.912984", "last_seen_epoch": "1631315941.856987", "packets": 45, "bytes": 10393, "initiator_bytes": 3717, "responder_bytes": 6676 }, { "flow_id": "flow-b905fc4a93b26c1f15756a0f", "transport": "tcp", "stream": 77, "initiator_ip": "10.9.10.102", "initiator_port": 58158, "responder_ip": "94.158.245.52", "responder_port": 443, "first_frame": 2588, "last_frame": 7398, "first_seen_epoch": "1631315959.801102", "last_seen_epoch": "1631316297.002503", "packets": 20, "bytes": 5843, "initiator_bytes": 3951, "responder_bytes": 1892 }, { "flow_id": "flow-822d9558a4e3a7830c8fb0b9", "transport": "udp", "stream": 50, "initiator_ip": "10.9.10.102", "initiator_port": 64980, "responder_ip": "10.9.10.9", "responder_port": 53, "first_frame": 2603, "last_frame": 2606, "first_seen_epoch": "1631315961.509438", "last_seen_epoch": "1631315961.591822", "packets": 4, "bytes": 336, "initiator_bytes": 152, "responder_bytes": 184 }, { "flow_id": "flow-2c2f9fcdf2fc826b2bbce331", "transport": "tcp", "stream": 78, "initiator_ip": "10.9.10.102", "initiator_port": 58159, "responder_ip": "34.117.59.81", "responder_port": 443, "first_frame": 2607, "last_frame": 2936, "first_seen_epoch": "1631315961.595672", "last_seen_epoch": "1631316077.137027", "packets": 26, "bytes": 7165, "initiator_bytes": 1238, "responder_bytes": 5927 }, { "flow_id": "flow-7dffba9233065d7c43e47080", "transport": "udp", "stream": 51, "initiator_ip": "10.9.10.9", "initiator_port": 137, "responder_ip": "10.9.10.102", "responder_port": 137, "first_frame": 2630, "last_frame": 2630, "first_seen_epoch": "1631315962.234697", "last_seen_epoch": "1631315962.234697", "packets": 1, "bytes": 104, "initiator_bytes": 104, "responder_bytes": 0 }, { "flow_id": "flow-e7026185ce9ccee562979715", "transport": "udp", "stream": 52, "initiator_ip": "10.9.10.102", "initiator_port": 138, "responder_ip": "10.9.10.9", "responder_port": 138, "first_frame": 2631, "last_frame": 2663, "first_seen_epoch": "1631315962.249217", "last_seen_epoch": "1631315965.742479", "packets": 3, "bytes": 648, "initiator_bytes": 648, "responder_bytes": 0 }, { "flow_id": "flow-0f077fa4666403dc4a6828de", "transport": "udp", "stream": 53, "initiator_ip": "10.9.10.102", "initiator_port": 137, "responder_ip": "10.9.10.103", "responder_port": 137, "first_frame": 2634, "last_frame": 2641, "first_seen_epoch": "1631315962.249925", "last_seen_epoch": "1631315962.347248", "packets": 2, "bytes": 208, "initiator_bytes": 104, "responder_bytes": 104 }, { "flow_id": "flow-1bea6894a569723f616eeed5", "transport": "udp", "stream": 54, "initiator_ip": "10.9.10.103", "initiator_port": 138, "responder_ip": "10.9.10.102", "responder_port": 138, "first_frame": 2635, "last_frame": 2664, "first_seen_epoch": "1631315962.250401", "last_seen_epoch": "1631315965.743002", "packets": 3, "bytes": 696, "initiator_bytes": 696, "responder_bytes": 0 }, { "flow_id": "flow-ca5b2a43e2fe9d9f0fdcdc8d", "transport": "udp", "stream": 55, "initiator_ip": "10.9.10.102", "initiator_port": 52106, "responder_ip": "10.9.10.9", "responder_port": 53, "first_frame": 2636, "last_frame": 2639, "first_seen_epoch": "1631315962.254281", "last_seen_epoch": "1631315962.343828", "packets": 4, "bytes": 400, "initiator_bytes": 184, "responder_bytes": 216 }, { "flow_id": "flow-2c7817bd8a419b8aa6d27396", "transport": "tcp", "stream": 79, "initiator_ip": "10.9.10.102", "initiator_port": 58160, "responder_ip": "10.9.10.103", "responder_port": 139, "first_frame": 2642, "last_frame": 2905, "first_seen_epoch": "1631315962.91847", "last_seen_epoch": "1631315979.126566", "packets": 25, "bytes": 3530, "initiator_bytes": 1749, "responder_bytes": 1781 }, { "flow_id": "flow-ba4198b8b719087e08587104", "transport": "tcp", "stream": 80, "initiator_ip": "10.9.10.102", "initiator_port": 58161, "responder_ip": "10.9.10.9", "responder_port": 445, "first_frame": 2666, "last_frame": 2911, "first_seen_epoch": "1631315965.806541", "last_seen_epoch": "1631315979.826683", "packets": 155, "bytes": 37417, "initiator_bytes": 20513, "responder_bytes": 16904 }, { "flow_id": "flow-32d5e9ef6df76c0a48883d9b", "transport": "tcp", "stream": 81, "initiator_ip": "10.9.10.102", "initiator_port": 58162, "responder_ip": "10.9.10.9", "responder_port": 88, "first_frame": 2673, "last_frame": 2685, "first_seen_epoch": "1631315966.445271", "last_seen_epoch": "1631315966.489527", "packets": 12, "bytes": 4221, "initiator_bytes": 2104, "responder_bytes": 2117 }, { "flow_id": "flow-61665ca2e47fbc62e2b11634", "transport": "tcp", "stream": 82, "initiator_ip": "10.9.10.102", "initiator_port": 58163, "responder_ip": "94.158.245.52", "responder_port": 443, "first_frame": 2826, "last_frame": 2871, "first_seen_epoch": "1631315967.16795", "last_seen_epoch": "1631315969.603444", "packets": 22, "bytes": 7809, "initiator_bytes": 6911, "responder_bytes": 898 }, { "flow_id": "flow-432ef83d970868608b395911", "transport": "udp", "stream": 56, "initiator_ip": "10.9.10.102", "initiator_port": 61142, "responder_ip": "10.9.10.9", "responder_port": 53, "first_frame": 2833, "last_frame": 2845, "first_seen_epoch": "1631315968.071604", "last_seen_epoch": "1631315968.236579", "packets": 3, "bytes": 383, "initiator_bytes": 176, "responder_bytes": 207 }, { "flow_id": "flow-77e58620ba38d12b2abef6d4", "transport": "udp", "stream": 57, "initiator_ip": "10.9.10.102", "initiator_port": 64302, "responder_ip": "10.9.10.9", "responder_port": 53, "first_frame": 2846, "last_frame": 2848, "first_seen_epoch": "1631315968.255718", "last_seen_epoch": "1631315968.338242", "packets": 3, "bytes": 398, "initiator_bytes": 154, "responder_bytes": 244 }, { "flow_id": "flow-7c0c5b0386b2f081ff0f695b", "transport": "udp", "stream": 58, "initiator_ip": "10.9.10.102", "initiator_port": 58191, "responder_ip": "10.9.10.9", "responder_port": 53, "first_frame": 2849, "last_frame": 2854, "first_seen_epoch": "1631315968.340842", "last_seen_epoch": "1631315968.436452", "packets": 3, "bytes": 317, "initiator_bytes": 170, "responder_bytes": 147 }, { "flow_id": "flow-cffd20fd6c67170caa54fbeb", "transport": "tcp", "stream": 83, "initiator_ip": "10.9.10.102", "initiator_port": 58164, "responder_ip": "52.109.8.22", "responder_port": 443, "first_frame": 2855, "last_frame": 2913, "first_seen_epoch": "1631315968.526833", "last_seen_epoch": "1631315985.722301", "packets": 17, "bytes": 8310, "initiator_bytes": 1339, "responder_bytes": 6971 }, { "flow_id": "flow-97f92d45e8bdd5403b2d765f", "transport": "udp", "stream": 59, "initiator_ip": "10.9.10.102", "initiator_port": 59788, "responder_ip": "10.9.10.9", "responder_port": 53, "first_frame": 2875, "last_frame": 2878, "first_seen_epoch": "1631315969.871045", "last_seen_epoch": "1631315969.971917", "packets": 3, "bytes": 335, "initiator_bytes": 180, "responder_bytes": 155 }, { "flow_id": "flow-7a071ea88aa7eae459dcdc98", "transport": "tcp", "stream": 84, "initiator_ip": "10.9.10.102", "initiator_port": 58165, "responder_ip": "52.109.76.32", "responder_port": 443, "first_frame": 2879, "last_frame": 2912, "first_seen_epoch": "1631315969.974288", "last_seen_epoch": "1631315985.7223", "packets": 17, "bytes": 8058, "initiator_bytes": 1344, "responder_bytes": 6714 }, { "flow_id": "flow-4837f6fcbb4ba2a2967d363d", "transport": "udp", "stream": 60, "initiator_ip": "10.9.10.102", "initiator_port": 55009, "responder_ip": "10.9.10.9", "responder_port": 53, "first_frame": 2941, "last_frame": 2942, "first_seen_epoch": "1631316141.268355", "last_seen_epoch": "1631316141.268718", "packets": 2, "bytes": 324, "initiator_bytes": 128, "responder_bytes": 196 }, { "flow_id": "flow-d3c5a75084949383c8cd96b5", "transport": "udp", "stream": 61, "initiator_ip": "10.9.10.102", "initiator_port": 55010, "responder_ip": "10.9.10.9", "responder_port": 389, "first_frame": 2943, "last_frame": 2944, "first_seen_epoch": "1631316141.284394", "last_seen_epoch": "1631316141.284739", "packets": 2, "bytes": 513, "initiator_bytes": 269, "responder_bytes": 244 }, { "flow_id": "flow-170e4ee13e1aa263be71e0a9", "transport": "tcp", "stream": 85, "initiator_ip": "10.9.10.102", "initiator_port": 58166, "responder_ip": "10.9.10.9", "responder_port": 135, "first_frame": 2945, "last_frame": 3019, "first_seen_epoch": "1631316141.399977", "last_seen_epoch": "1631316142.420944", "packets": 12, "bytes": 1644, "initiator_bytes": 964, "responder_bytes": 680 }, { "flow_id": "flow-158c5dc4bba12115b2ed64ee", "transport": "tcp", "stream": 86, "initiator_ip": "10.9.10.102", "initiator_port": 58167, "responder_ip": "10.9.10.9", "responder_port": 49667, "first_frame": 2952, "last_frame": 3020, "first_seen_epoch": "1631316142.004833", "last_seen_epoch": "1631316142.420945", "packets": 25, "bytes": 7145, "initiator_bytes": 4460, "responder_bytes": 2685 }, { "flow_id": "flow-92af275a9b135ea3eb7d8dca", "transport": "tcp", "stream": 87, "initiator_ip": "10.9.10.102", "initiator_port": 58168, "responder_ip": "10.9.10.9", "responder_port": 389, "first_frame": 2978, "last_frame": 3018, "first_seen_epoch": "1631316142.320948", "last_seen_epoch": "1631316142.417134", "packets": 21, "bytes": 7560, "initiator_bytes": 3481, "responder_bytes": 4079 }, { "flow_id": "flow-025d6947bee412dbe927b0b6", "transport": "tcp", "stream": 88, "initiator_ip": "10.9.10.102", "initiator_port": 58169, "responder_ip": "10.9.10.9", "responder_port": 389, "first_frame": 2997, "last_frame": 3015, "first_seen_epoch": "1631316142.375947", "last_seen_epoch": "1631316142.416886", "packets": 18, "bytes": 6974, "initiator_bytes": 2881, "responder_bytes": 4093 }, { "flow_id": "flow-815c1441f94b01ed893ad77d", "transport": "udp", "stream": 62, "initiator_ip": "10.9.10.102", "initiator_port": 52821, "responder_ip": "10.9.10.9", "responder_port": 53, "first_frame": 3025, "last_frame": 3027, "first_seen_epoch": "1631316272.878633", "last_seen_epoch": "1631316272.962978", "packets": 3, "bytes": 365, "initiator_bytes": 172, "responder_bytes": 193 }, { "flow_id": "flow-2e83bd5fe5ded0cd5f63fdb2", "transport": "tcp", "stream": 89, "initiator_ip": "10.9.10.102", "initiator_port": 58170, "responder_ip": "52.242.101.226", "responder_port": 443, "first_frame": 3028, "last_frame": 3048, "first_seen_epoch": "1631316272.969876", "last_seen_epoch": "1631316273.920116", "packets": 21, "bytes": 4875, "initiator_bytes": 1448, "responder_bytes": 3427 }, { "flow_id": "flow-ff16b27e6d250a1eed4aa595", "transport": "udp", "stream": 63, "initiator_ip": "10.9.10.102", "initiator_port": 54702, "responder_ip": "10.9.10.9", "responder_port": 53, "first_frame": 3049, "last_frame": 3050, "first_seen_epoch": "1631316274.428472", "last_seen_epoch": "1631316274.505027", "packets": 2, "bytes": 239, "initiator_bytes": 86, "responder_bytes": 153 }, { "flow_id": "flow-e5db889fb23d46ba9f0aea44", "transport": "tcp", "stream": 90, "initiator_ip": "10.9.10.102", "initiator_port": 58171, "responder_ip": "52.238.248.6", "responder_port": 443, "first_frame": 3051, "last_frame": 4021, "first_seen_epoch": "1631316274.507703", "last_seen_epoch": "1631316283.229537", "packets": 547, "bytes": 456652, "initiator_bytes": 90396, "responder_bytes": 366256 }, { "flow_id": "flow-13bd7e075e22625fe4451b00", "transport": "udp", "stream": 64, "initiator_ip": "10.9.10.102", "initiator_port": 55185, "responder_ip": "10.9.10.9", "responder_port": 53, "first_frame": 3072, "last_frame": 3073, "first_seen_epoch": "1631316275.626673", "last_seen_epoch": "1631316275.712007", "packets": 2, "bytes": 413, "initiator_bytes": 74, "responder_bytes": 339 }, { "flow_id": "flow-b0c94e626b123bbc82db7782", "transport": "tcp", "stream": 91, "initiator_ip": "10.9.10.102", "initiator_port": 58172, "responder_ip": "20.190.154.138", "responder_port": 443, "first_frame": 3074, "last_frame": 7613, "first_seen_epoch": "1631316275.718665", "last_seen_epoch": "1631316386.062631", "packets": 36, "bytes": 24811, "initiator_bytes": 6508, "responder_bytes": 18303 }, { "flow_id": "flow-a89b3347d01568ef865220d0", "transport": "udp", "stream": 65, "initiator_ip": "10.9.10.102", "initiator_port": 59477, "responder_ip": "10.9.10.9", "responder_port": 53, "first_frame": 3163, "last_frame": 3165, "first_seen_epoch": "1631316276.398273", "last_seen_epoch": "1631316276.467528", "packets": 2, "bytes": 317, "initiator_bytes": 89, "responder_bytes": 228 }, { "flow_id": "flow-cb4f9595343c8fc27fc4dcd3", "transport": "tcp", "stream": 92, "initiator_ip": "10.9.10.102", "initiator_port": 58173, "responder_ip": "104.46.162.226", "responder_port": 443, "first_frame": 3166, "last_frame": 3370, "first_seen_epoch": "1631316276.470271", "last_seen_epoch": "1631316278.027924", "packets": 18, "bytes": 8151, "initiator_bytes": 2829, "responder_bytes": 5322 }, { "flow_id": "flow-30b24ff3a811d950ecfe2091", "transport": "udp", "stream": 66, "initiator_ip": "10.9.10.102", "initiator_port": 56070, "responder_ip": "10.9.10.9", "responder_port": 53, "first_frame": 3232, "last_frame": 3233, "first_seen_epoch": "1631316276.812385", "last_seen_epoch": "1631316276.885401", "packets": 2, "bytes": 360, "initiator_bytes": 86, "responder_bytes": 274 }, { "flow_id": "flow-58ea9dbccef83587dc691825", "transport": "tcp", "stream": 93, "initiator_ip": "10.9.10.102", "initiator_port": 58174, "responder_ip": "23.1.237.200", "responder_port": 80, "first_frame": 3234, "last_frame": 3999, "first_seen_epoch": "1631316276.888503", "last_seen_epoch": "1631316282.52658", "packets": 363, "bytes": 317223, "initiator_bytes": 15711, "responder_bytes": 301512 }, { "flow_id": "flow-67b4254d0332b7907eaabbe0", "transport": "udp", "stream": 67, "initiator_ip": "10.9.10.102", "initiator_port": 65482, "responder_ip": "10.9.10.9", "responder_port": 53, "first_frame": 4022, "last_frame": 4024, "first_seen_epoch": "1631316283.545802", "last_seen_epoch": "1631316283.653453", "packets": 3, "bytes": 380, "initiator_bytes": 182, "responder_bytes": 198 }, { "flow_id": "flow-be4377af39226859e539cf30", "transport": "tcp", "stream": 94, "initiator_ip": "10.9.10.102", "initiator_port": 58175, "responder_ip": "40.125.122.151", "responder_port": 443, "first_frame": 4025, "last_frame": 4091, "first_seen_epoch": "1631316283.655992", "last_seen_epoch": "1631316285.892722", "packets": 53, "bytes": 22424, "initiator_bytes": 16543, "responder_bytes": 5881 }, { "flow_id": "flow-9d1b844e47a68d2fac8ebe96", "transport": "udp", "stream": 68, "initiator_ip": "10.9.10.102", "initiator_port": 62936, "responder_ip": "10.9.10.9", "responder_port": 53, "first_frame": 4034, "last_frame": 4044, "first_seen_epoch": "1631316284.708888", "last_seen_epoch": "1631316284.787487", "packets": 2, "bytes": 317, "initiator_bytes": 89, "responder_bytes": 228 }, { "flow_id": "flow-c993a2611f57045b5a15e677", "transport": "tcp", "stream": 95, "initiator_ip": "10.9.10.102", "initiator_port": 58176, "responder_ip": "104.46.162.226", "responder_port": 443, "first_frame": 4045, "last_frame": 4106, "first_seen_epoch": "1631316284.790132", "last_seen_epoch": "1631316286.542798", "packets": 22, "bytes": 11411, "initiator_bytes": 6030, "responder_bytes": 5381 }, { "flow_id": "flow-5f91a583c4749914a2faeaad", "transport": "udp", "stream": 69, "initiator_ip": "10.9.10.102", "initiator_port": 50706, "responder_ip": "10.9.10.9", "responder_port": 53, "first_frame": 4096, "last_frame": 4097, "first_seen_epoch": "1631316286.101929", "last_seen_epoch": "1631316286.166797", "packets": 2, "bytes": 271, "initiator_bytes": 92, "responder_bytes": 179 }, { "flow_id": "flow-f64ce9046948465bc05ebf07", "transport": "tcp", "stream": 96, "initiator_ip": "10.9.10.102", "initiator_port": 58177, "responder_ip": "52.184.217.20", "responder_port": 443, "first_frame": 4098, "last_frame": 4128, "first_seen_epoch": "1631316286.175088", "last_seen_epoch": "1631316287.161113", "packets": 21, "bytes": 5034, "initiator_bytes": 1374, "responder_bytes": 3660 }, { "flow_id": "flow-5711b3ef6d1ad1fe77ae15d4", "transport": "udp", "stream": 70, "initiator_ip": "10.9.10.102", "initiator_port": 60902, "responder_ip": "10.9.10.9", "responder_port": 53, "first_frame": 4123, "last_frame": 4124, "first_seen_epoch": "1631316286.985284", "last_seen_epoch": "1631316287.056993", "packets": 2, "bytes": 298, "initiator_bytes": 94, "responder_bytes": 204 }, { "flow_id": "flow-5b0cfd25940858c9a9805db6", "transport": "tcp", "stream": 97, "initiator_ip": "10.9.10.102", "initiator_port": 58178, "responder_ip": "104.125.253.131", "responder_port": 443, "first_frame": 4125, "last_frame": 7578, "first_seen_epoch": "1631316287.059686", "last_seen_epoch": "1631316378.878874", "packets": 25, "bytes": 9289, "initiator_bytes": 1326, "responder_bytes": 7963 }, { "flow_id": "flow-bc8a9df183e5c5f385297904", "transport": "tcp", "stream": 98, "initiator_ip": "10.9.10.102", "initiator_port": 58179, "responder_ip": "104.46.162.226", "responder_port": 443, "first_frame": 4129, "last_frame": 4336, "first_seen_epoch": "1631316287.387676", "last_seen_epoch": "1631316288.994167", "packets": 19, "bytes": 8600, "initiator_bytes": 3278, "responder_bytes": 5322 }, { "flow_id": "flow-7b5b770836f3c2d255f41255", "transport": "udp", "stream": 71, "initiator_ip": "10.9.10.102", "initiator_port": 55999, "responder_ip": "10.9.10.9", "responder_port": 53, "first_frame": 4151, "last_frame": 4159, "first_seen_epoch": "1631316287.945289", "last_seen_epoch": "1631316288.021439", "packets": 2, "bytes": 298, "initiator_bytes": 94, "responder_bytes": 204 }, { "flow_id": "flow-7f99d9be4622ef64edf74044", "transport": "tcp", "stream": 99, "initiator_ip": "10.9.10.102", "initiator_port": 58180, "responder_ip": "104.125.253.131", "responder_port": 443, "first_frame": 4160, "last_frame": 7582, "first_seen_epoch": "1631316288.02378", "last_seen_epoch": "1631316378.883553", "packets": 25, "bytes": 8771, "initiator_bytes": 1575, "responder_bytes": 7196 }, { "flow_id": "flow-aecbc76e313fd4dbde2a86e1", "transport": "udp", "stream": 72, "initiator_ip": "10.9.10.102", "initiator_port": 53070, "responder_ip": "10.9.10.9", "responder_port": 53, "first_frame": 4182, "last_frame": 4187, "first_seen_epoch": "1631316288.612396", "last_seen_epoch": "1631316288.685394", "packets": 2, "bytes": 366, "initiator_bytes": 89, "responder_bytes": 277 }, { "flow_id": "flow-b8ee7cdd3a532544ff4b549c", "transport": "tcp", "stream": 100, "initiator_ip": "10.9.10.102", "initiator_port": 58181, "responder_ip": "23.1.237.216", "responder_port": 80, "first_frame": 4188, "last_frame": 7356, "first_seen_epoch": "1631316288.69351", "last_seen_epoch": "1631316291.702775", "packets": 1116, "bytes": 1112368, "initiator_bytes": 20950, "responder_bytes": 1091418 }, { "flow_id": "flow-e9226943dd585f94c5e15124", "transport": "tcp", "stream": 101, "initiator_ip": "10.9.10.102", "initiator_port": 58182, "responder_ip": "23.1.237.225", "responder_port": 80, "first_frame": 4189, "last_frame": 7444, "first_seen_epoch": "1631316288.694885", "last_seen_epoch": "1631316319.027172", "packets": 2034, "bytes": 2087602, "initiator_bytes": 36509, "responder_bytes": 2051093 }, { "flow_id": "flow-2f5b434330fa8054efa5697b", "transport": "udp", "stream": 73, "initiator_ip": "10.9.10.102", "initiator_port": 58461, "responder_ip": "10.9.10.9", "responder_port": 53, "first_frame": 5111, "last_frame": 5113, "first_seen_epoch": "1631316289.54981", "last_seen_epoch": "1631316289.550182", "packets": 2, "bytes": 317, "initiator_bytes": 89, "responder_bytes": 228 }, { "flow_id": "flow-76961e46f1f8b6acdad857bd", "transport": "tcp", "stream": 102, "initiator_ip": "10.9.10.102", "initiator_port": 58183, "responder_ip": "104.46.162.226", "responder_port": 443, "first_frame": 5118, "last_frame": 7353, "first_seen_epoch": "1631316289.551562", "last_seen_epoch": "1631316291.340572", "packets": 18, "bytes": 8191, "initiator_bytes": 2870, "responder_bytes": 5321 }, { "flow_id": "flow-352161662676082bcf865ac0", "transport": "udp", "stream": 74, "initiator_ip": "10.9.10.102", "initiator_port": 50862, "responder_ip": "10.9.10.9", "responder_port": 53, "first_frame": 7357, "last_frame": 7358, "first_seen_epoch": "1631316292.761763", "last_seen_epoch": "1631316292.832321", "packets": 2, "bytes": 310, "initiator_bytes": 89, "responder_bytes": 221 }, { "flow_id": "flow-910cb90ff6c3d708786fc067", "transport": "tcp", "stream": 103, "initiator_ip": "10.9.10.102", "initiator_port": 58184, "responder_ip": "20.50.73.10", "responder_port": 443, "first_frame": 7359, "last_frame": 7379, "first_seen_epoch": "1631316292.834631", "last_seen_epoch": "1631316294.158226", "packets": 20, "bytes": 9005, "initiator_bytes": 3683, "responder_bytes": 5322 }, { "flow_id": "flow-8e11162a4888c2d970424b38", "transport": "tcp", "stream": 104, "initiator_ip": "10.9.10.102", "initiator_port": 58185, "responder_ip": "94.158.245.52", "responder_port": 443, "first_frame": 7378, "last_frame": 7693, "first_seen_epoch": "1631316294.158089", "last_seen_epoch": "1631316670.557265", "packets": 24, "bytes": 7618, "initiator_bytes": 4109, "responder_bytes": 3509 }, { "flow_id": "flow-037ec0904e10bb5eef34d6b1", "transport": "tcp", "stream": 105, "initiator_ip": "10.9.10.102", "initiator_port": 58186, "responder_ip": "94.158.245.52", "responder_port": 443, "first_frame": 7399, "last_frame": 7418, "first_seen_epoch": "1631316297.002503", "last_seen_epoch": "1631316299.761816", "packets": 20, "bytes": 5161, "initiator_bytes": 4263, "responder_bytes": 898 }, { "flow_id": "flow-f2b8fca12a9d90d86f70d58b", "transport": "udp", "stream": 75, "initiator_ip": "10.9.10.102", "initiator_port": 63259, "responder_ip": "10.9.10.9", "responder_port": 53, "first_frame": 7419, "last_frame": 7420, "first_seen_epoch": "1631316303.61405", "last_seen_epoch": "1631316303.686956", "packets": 2, "bytes": 310, "initiator_bytes": 89, "responder_bytes": 221 }, { "flow_id": "flow-9fb78a09c3efc3e5c265a350", "transport": "tcp", "stream": 106, "initiator_ip": "10.9.10.102", "initiator_port": 58187, "responder_ip": "20.50.73.10", "responder_port": 443, "first_frame": 7421, "last_frame": 7441, "first_seen_epoch": "1631316303.689169", "last_seen_epoch": "1631316304.969377", "packets": 19, "bytes": 8565, "initiator_bytes": 3243, "responder_bytes": 5322 }, { "flow_id": "flow-1351ae762aa6d99e7638ff2c", "transport": "udp", "stream": 76, "initiator_ip": "10.9.10.102", "initiator_port": 61055, "responder_ip": "10.9.10.9", "responder_port": 53, "first_frame": 7445, "last_frame": 7451, "first_seen_epoch": "1631316322.221973", "last_seen_epoch": "1631316326.556916", "packets": 5, "bytes": 518, "initiator_bytes": 364, "responder_bytes": 154 }, { "flow_id": "flow-e68f26a0627b4ec1477e3331", "transport": "tcp", "stream": 107, "initiator_ip": "10.9.10.102", "initiator_port": 58188, "responder_ip": "52.137.106.217", "responder_port": 443, "first_frame": 7452, "last_frame": 7476, "first_seen_epoch": "1631316326.577583", "last_seen_epoch": "1631316327.276704", "packets": 22, "bytes": 6375, "initiator_bytes": 1793, "responder_bytes": 4582 }, { "flow_id": "flow-117d8e4b6516ceaa166181ef", "transport": "tcp", "stream": 108, "initiator_ip": "10.9.10.102", "initiator_port": 58189, "responder_ip": "52.137.106.217", "responder_port": 443, "first_frame": 7474, "last_frame": 7500, "first_seen_epoch": "1631316327.180315", "last_seen_epoch": "1631316329.174856", "packets": 25, "bytes": 6753, "initiator_bytes": 2110, "responder_bytes": 4643 }, { "flow_id": "flow-2e1afbac473dacf2812217bd", "transport": "tcp", "stream": 109, "initiator_ip": "10.9.10.102", "initiator_port": 58190, "responder_ip": "52.137.106.217", "responder_port": 443, "first_frame": 7501, "last_frame": 7524, "first_seen_epoch": "1631316329.497617", "last_seen_epoch": "1631316330.574379", "packets": 22, "bytes": 5895, "initiator_bytes": 1356, "responder_bytes": 4539 }, { "flow_id": "flow-adb4ad9a5306d64ed5285fa3", "transport": "tcp", "stream": 110, "initiator_ip": "10.9.10.102", "initiator_port": 58191, "responder_ip": "52.137.106.217", "responder_port": 443, "first_frame": 7521, "last_frame": 7544, "first_seen_epoch": "1631316330.469838", "last_seen_epoch": "1631316331.509056", "packets": 22, "bytes": 6214, "initiator_bytes": 1667, "responder_bytes": 4547 }, { "flow_id": "flow-ae95a948d940d2311095649a", "transport": "udp", "stream": 77, "initiator_ip": "10.9.10.102", "initiator_port": 51813, "responder_ip": "10.9.10.9", "responder_port": 53, "first_frame": 7585, "last_frame": 7586, "first_seen_epoch": "1631316382.412743", "last_seen_epoch": "1631316382.488159", "packets": 2, "bytes": 305, "initiator_bytes": 89, "responder_bytes": 216 }, { "flow_id": "flow-6b04dab53fbcaac6b60e4b0b", "transport": "tcp", "stream": 111, "initiator_ip": "10.9.10.102", "initiator_port": 58192, "responder_ip": "20.189.173.7", "responder_port": 443, "first_frame": 7587, "last_frame": 7608, "first_seen_epoch": "1631316382.490984", "last_seen_epoch": "1631316383.263691", "packets": 22, "bytes": 9545, "initiator_bytes": 4163, "responder_bytes": 5382 }, { "flow_id": "flow-c7ebf97a87eaa439445af20f", "transport": "udp", "stream": 78, "initiator_ip": "10.9.10.102", "initiator_port": 51468, "responder_ip": "10.9.10.9", "responder_port": 53, "first_frame": 7623, "last_frame": 7624, "first_seen_epoch": "1631316392.221436", "last_seen_epoch": "1631316392.22176", "packets": 2, "bytes": 241, "initiator_bytes": 81, "responder_bytes": 160 }, { "flow_id": "flow-eeb1fe4a67d355911eae46e8", "transport": "tcp", "stream": 112, "initiator_ip": "10.9.10.102", "initiator_port": 58193, "responder_ip": "10.9.10.9", "responder_port": 445, "first_frame": 7643, "last_frame": 7667, "first_seen_epoch": "1631316645.535171", "last_seen_epoch": "1631316657.142308", "packets": 25, "bytes": 7409, "initiator_bytes": 5247, "responder_bytes": 2162 }, { "flow_id": "flow-8f450e02e4cd7f65246f50ff", "transport": "tcp", "stream": 113, "initiator_ip": "10.9.10.102", "initiator_port": 58194, "responder_ip": "94.158.245.52", "responder_port": 443, "first_frame": 7668, "last_frame": 7789, "first_seen_epoch": "1631316666.242775", "last_seen_epoch": "1631317019.163609", "packets": 27, "bytes": 8044, "initiator_bytes": 4314, "responder_bytes": 3730 }, { "flow_id": "flow-06070c05fa853763528a6dc2", "transport": "tcp", "stream": 114, "initiator_ip": "10.9.10.102", "initiator_port": 58195, "responder_ip": "94.158.245.52", "responder_port": 443, "first_frame": 7694, "last_frame": 7715, "first_seen_epoch": "1631316670.557352", "last_seen_epoch": "1631316673.994912", "packets": 20, "bytes": 5173, "initiator_bytes": 4275, "responder_bytes": 898 }, { "flow_id": "flow-3c6b915cab6f9b618f945a7b", "transport": "tcp", "stream": 115, "initiator_ip": "10.9.10.102", "initiator_port": 58196, "responder_ip": "204.79.197.200", "responder_port": 443, "first_frame": 7742, "last_frame": 7813, "first_seen_epoch": "1631316926.167893", "last_seen_epoch": "1631317053.52479", "packets": 13, "bytes": 6522, "initiator_bytes": 840, "responder_bytes": 5682 }, { "flow_id": "flow-fce011da720b1252ef601618", "transport": "udp", "stream": 79, "initiator_ip": "10.9.10.102", "initiator_port": 62507, "responder_ip": "10.9.10.9", "responder_port": 53, "first_frame": 7761, "last_frame": 7762, "first_seen_epoch": "1631316992.281374", "last_seen_epoch": "1631316992.281679", "packets": 2, "bytes": 241, "initiator_bytes": 81, "responder_bytes": 160 }, { "flow_id": "flow-04e15e51882a9ef49cc67ec7", "transport": "tcp", "stream": 116, "initiator_ip": "10.9.10.102", "initiator_port": 58197, "responder_ip": "94.158.245.52", "responder_port": 443, "first_frame": 7767, "last_frame": 7856, "first_seen_epoch": "1631317013.399121", "last_seen_epoch": "1631317326.990329", "packets": 24, "bytes": 8991, "initiator_bytes": 5462, "responder_bytes": 3529 }, { "flow_id": "flow-44594a9d3e2f246d437937f2", "transport": "tcp", "stream": 117, "initiator_ip": "10.9.10.102", "initiator_port": 58198, "responder_ip": "94.158.245.52", "responder_port": 443, "first_frame": 7790, "last_frame": 7809, "first_seen_epoch": "1631317019.163721", "last_seen_epoch": "1631317022.264595", "packets": 20, "bytes": 5153, "initiator_bytes": 4255, "responder_bytes": 898 }, { "flow_id": "flow-bf7669ebdb187f430109addb", "transport": "tcp", "stream": 118, "initiator_ip": "10.9.10.102", "initiator_port": 58199, "responder_ip": "94.158.245.52", "responder_port": 443, "first_frame": 7838, "last_frame": 7964, "first_seen_epoch": "1631317323.683558", "last_seen_epoch": "1631317835.040566", "packets": 22, "bytes": 7556, "initiator_bytes": 4045, "responder_bytes": 3511 }, { "flow_id": "flow-2acbd8bb2a3b281a75b988ad", "transport": "tcp", "stream": 119, "initiator_ip": "10.9.10.102", "initiator_port": 58200, "responder_ip": "94.158.245.52", "responder_port": 443, "first_frame": 7857, "last_frame": 7878, "first_seen_epoch": "1631317326.990443", "last_seen_epoch": "1631317333.383821", "packets": 20, "bytes": 5149, "initiator_bytes": 4251, "responder_bytes": 898 }, { "flow_id": "flow-9908fd2a77fa6c0e1e5cd856", "transport": "tcp", "stream": 120, "initiator_ip": "10.9.10.102", "initiator_port": 58201, "responder_ip": "10.9.10.9", "responder_port": 445, "first_frame": 7894, "last_frame": 7920, "first_seen_epoch": "1631317546.240547", "last_seen_epoch": "1631317557.564189", "packets": 27, "bytes": 7601, "initiator_bytes": 5373, "responder_bytes": 2228 }, { "flow_id": "flow-9b59aaa35736ad6715581cc4", "transport": "udp", "stream": 80, "initiator_ip": "10.9.10.102", "initiator_port": 64610, "responder_ip": "10.9.10.9", "responder_port": 53, "first_frame": 7921, "last_frame": 7922, "first_seen_epoch": "1631317592.283598", "last_seen_epoch": "1631317592.283915", "packets": 2, "bytes": 241, "initiator_bytes": 81, "responder_bytes": 160 }, { "flow_id": "flow-49cfb10792dc9af7db5c6233", "transport": "tcp", "stream": 121, "initiator_ip": "10.9.10.102", "initiator_port": 58202, "responder_ip": "94.158.245.52", "responder_port": 443, "first_frame": 7944, "last_frame": 8099, "first_seen_epoch": "1631317831.973048", "last_seen_epoch": "1631318196.922796", "packets": 24, "bytes": 7687, "initiator_bytes": 4111, "responder_bytes": 3576 }, { "flow_id": "flow-076396156edb5b440e016df7", "transport": "tcp", "stream": 122, "initiator_ip": "10.9.10.102", "initiator_port": 58203, "responder_ip": "94.158.245.52", "responder_port": 443, "first_frame": 7965, "last_frame": 7986, "first_seen_epoch": "1631317835.040628", "last_seen_epoch": "1631317838.090643", "packets": 20, "bytes": 5133, "initiator_bytes": 4235, "responder_bytes": 898 }, { "flow_id": "flow-11202f07e512e5b168600832", "transport": "udp", "stream": 81, "initiator_ip": "10.9.10.102", "initiator_port": 64392, "responder_ip": "10.9.10.9", "responder_port": 53, "first_frame": 7989, "last_frame": 7990, "first_seen_epoch": "1631317871.05431", "last_seen_epoch": "1631317871.122087", "packets": 2, "bytes": 289, "initiator_bytes": 96, "responder_bytes": 193 }, { "flow_id": "flow-e75ba0b570bb06cbebfa6dee", "transport": "tcp", "stream": 123, "initiator_ip": "10.9.10.102", "initiator_port": 58204, "responder_ip": "13.107.5.88", "responder_port": 443, "first_frame": 7991, "last_frame": 8070, "first_seen_epoch": "1631317871.125427", "last_seen_epoch": "1631317999.721956", "packets": 28, "bytes": 7704, "initiator_bytes": 1666, "responder_bytes": 6038 }, { "flow_id": "flow-ff6ce29d85a29ace86108837", "transport": "udp", "stream": 82, "initiator_ip": "10.9.10.102", "initiator_port": 50183, "responder_ip": "10.9.10.9", "responder_port": 53, "first_frame": 8026, "last_frame": 8027, "first_seen_epoch": "1631317927.232039", "last_seen_epoch": "1631317927.318922", "packets": 2, "bytes": 308, "initiator_bytes": 89, "responder_bytes": 219 }, { "flow_id": "flow-6799766bfe44172555c5fbea", "transport": "tcp", "stream": 124, "initiator_ip": "10.9.10.102", "initiator_port": 58205, "responder_ip": "52.182.143.208", "responder_port": 443, "first_frame": 8028, "last_frame": 8038, "first_seen_epoch": "1631317927.321531", "last_seen_epoch": "1631317942.417934", "packets": 5, "bytes": 330, "initiator_bytes": 330, "responder_bytes": 0 }, { "flow_id": "flow-cfb4a8fff10b612bfd979448", "transport": "udp", "stream": 83, "initiator_ip": "10.9.10.102", "initiator_port": 63098, "responder_ip": "10.9.10.9", "responder_port": 53, "first_frame": 8039, "last_frame": 8042, "first_seen_epoch": "1631317946.902041", "last_seen_epoch": "1631317947.000885", "packets": 4, "bytes": 336, "initiator_bytes": 152, "responder_bytes": 184 }, { "flow_id": "flow-7f473972fa7f2ed502f265b3", "transport": "udp", "stream": 84, "initiator_ip": "10.9.10.102", "initiator_port": 64400, "responder_ip": "10.9.10.9", "responder_port": 53, "first_frame": 8043, "last_frame": 8044, "first_seen_epoch": "1631317951.355779", "last_seen_epoch": "1631317951.431683", "packets": 2, "bytes": 310, "initiator_bytes": 89, "responder_bytes": 221 }, { "flow_id": "flow-cd6195a89cbe6730b6189f83", "transport": "tcp", "stream": 125, "initiator_ip": "10.9.10.102", "initiator_port": 58206, "responder_ip": "13.69.239.72", "responder_port": 443, "first_frame": 8045, "last_frame": 8063, "first_seen_epoch": "1631317951.434397", "last_seen_epoch": "1631317953.67101", "packets": 19, "bytes": 8161, "initiator_bytes": 2840, "responder_bytes": 5321 }, { "flow_id": "flow-2ac95eb5b63b01ee4a04479e", "transport": "udp", "stream": 85, "initiator_ip": "10.9.10.102", "initiator_port": 60734, "responder_ip": "10.9.10.9", "responder_port": 53, "first_frame": 8077, "last_frame": 8078, "first_seen_epoch": "1631318192.329739", "last_seen_epoch": "1631318192.330117", "packets": 2, "bytes": 241, "initiator_bytes": 81, "responder_bytes": 160 }, { "flow_id": "flow-0089125d558ba0dba868cf65", "transport": "tcp", "stream": 126, "initiator_ip": "10.9.10.102", "initiator_port": 58207, "responder_ip": "94.158.245.52", "responder_port": 443, "first_frame": 8079, "last_frame": 8226, "first_seen_epoch": "1631318193.990765", "last_seen_epoch": "1631318588.704838", "packets": 24, "bytes": 8966, "initiator_bytes": 5468, "responder_bytes": 3498 }, { "flow_id": "flow-c1a503ff99d3fb052ea0aacf", "transport": "tcp", "stream": 127, "initiator_ip": "10.9.10.102", "initiator_port": 58208, "responder_ip": "94.158.245.52", "responder_port": 443, "first_frame": 8100, "last_frame": 8128, "first_seen_epoch": "1631318196.922875", "last_seen_epoch": "1631318200.826262", "packets": 23, "bytes": 5311, "initiator_bytes": 4353, "responder_bytes": 958 }, { "flow_id": "flow-e79626e7bfcae939ccb8ce00", "transport": "tcp", "stream": 128, "initiator_ip": "10.9.10.102", "initiator_port": 58209, "responder_ip": "10.9.10.9", "responder_port": 445, "first_frame": 8151, "last_frame": 8175, "first_seen_epoch": "1631318446.476691", "last_seen_epoch": "1631318457.866581", "packets": 25, "bytes": 7409, "initiator_bytes": 5247, "responder_bytes": 2162 }, { "flow_id": "flow-ec54a03573d7abd84dd92358", "transport": "udp", "stream": 86, "initiator_ip": "10.9.10.102", "initiator_port": 52559, "responder_ip": "10.9.10.9", "responder_port": 53, "first_frame": 8178, "last_frame": 8182, "first_seen_epoch": "1631318516.031005", "last_seen_epoch": "1631318520.437836", "packets": 5, "bytes": 487, "initiator_bytes": 340, "responder_bytes": 147 }, { "flow_id": "flow-21a89e224da82f836acccd1f", "transport": "tcp", "stream": 129, "initiator_ip": "10.9.10.102", "initiator_port": 58210, "responder_ip": "52.109.8.22", "responder_port": 443, "first_frame": 8183, "last_frame": 8202, "first_seen_epoch": "1631318520.444987", "last_seen_epoch": "1631318521.277083", "packets": 18, "bytes": 9331, "initiator_bytes": 2492, "responder_bytes": 6839 }, { "flow_id": "flow-0f6a90efc1c9ce10ade6a7dc", "transport": "tcp", "stream": 130, "initiator_ip": "10.9.10.102", "initiator_port": 58211, "responder_ip": "94.158.245.52", "responder_port": 443, "first_frame": 8207, "last_frame": 8284, "first_seen_epoch": "1631318586.304538", "last_seen_epoch": "1631318781.530523", "packets": 23, "bytes": 7608, "initiator_bytes": 4073, "responder_bytes": 3535 }, { "flow_id": "flow-b86e790b666ecb5ae29fb893", "transport": "tcp", "stream": 131, "initiator_ip": "10.9.10.102", "initiator_port": 58212, "responder_ip": "94.158.245.52", "responder_port": 443, "first_frame": 8227, "last_frame": 8248, "first_seen_epoch": "1631318588.704892", "last_seen_epoch": "1631318590.45486", "packets": 20, "bytes": 5139, "initiator_bytes": 4241, "responder_bytes": 898 }, { "flow_id": "flow-b4856bff08335695a2c185fd", "transport": "tcp", "stream": 132, "initiator_ip": "10.9.10.102", "initiator_port": 58213, "responder_ip": "94.158.245.52", "responder_port": 443, "first_frame": 8268, "last_frame": 8497, "first_seen_epoch": "1631318779.609207", "last_seen_epoch": "1631319238.985217", "packets": 23, "bytes": 6069, "initiator_bytes": 4061, "responder_bytes": 2008 }, { "flow_id": "flow-363061ae697eff7c1bd655b8", "transport": "tcp", "stream": 133, "initiator_ip": "10.9.10.102", "initiator_port": 58214, "responder_ip": "94.158.245.52", "responder_port": 443, "first_frame": 8285, "last_frame": 8306, "first_seen_epoch": "1631318781.530616", "last_seen_epoch": "1631318783.761054", "packets": 20, "bytes": 5165, "initiator_bytes": 4267, "responder_bytes": 898 }, { "flow_id": "flow-239d28336c4c202c1c8ebf5d", "transport": "udp", "stream": 87, "initiator_ip": "10.9.10.102", "initiator_port": 63264, "responder_ip": "10.9.10.9", "responder_port": 53, "first_frame": 8313, "last_frame": 8316, "first_seen_epoch": "1631318792.332434", "last_seen_epoch": "1631318792.421801", "packets": 4, "bytes": 482, "initiator_bytes": 162, "responder_bytes": 320 }, { "flow_id": "flow-c972b3b78fa94dd38a44e563", "transport": "udp", "stream": 88, "initiator_ip": "10.9.10.102", "initiator_port": 54999, "responder_ip": "10.9.10.9", "responder_port": 53, "first_frame": 8336, "last_frame": 8338, "first_seen_epoch": "1631318944.952875", "last_seen_epoch": "1631318945.200916", "packets": 3, "bytes": 259, "initiator_bytes": 162, "responder_bytes": 97 }, { "flow_id": "flow-1ca698aa8d56d74ba40c425d", "transport": "tcp", "stream": 134, "initiator_ip": "10.9.10.102", "initiator_port": 58215, "responder_ip": "172.217.168.195", "responder_port": 443, "first_frame": 8339, "last_frame": 8373, "first_seen_epoch": "1631318945.43711", "last_seen_epoch": "1631318950.257507", "packets": 30, "bytes": 8415, "initiator_bytes": 2960, "responder_bytes": 5455 }, { "flow_id": "flow-77e95926ccf2d0d76f033cc3", "transport": "udp", "stream": 89, "initiator_ip": "10.9.10.102", "initiator_port": 54270, "responder_ip": "10.9.10.9", "responder_port": 53, "first_frame": 8375, "last_frame": 8376, "first_seen_epoch": "1631318967.344045", "last_seen_epoch": "1631318967.344347", "packets": 2, "bytes": 245, "initiator_bytes": 91, "responder_bytes": 154 }, { "flow_id": "flow-2a6330812e2568d04b15989b", "transport": "tcp", "stream": 135, "initiator_ip": "10.9.10.102", "initiator_port": 58216, "responder_ip": "52.137.106.217", "responder_port": 443, "first_frame": 8377, "last_frame": 8440, "first_seen_epoch": "1631318967.346791", "last_seen_epoch": "1631318977.234336", "packets": 29, "bytes": 8837, "initiator_bytes": 3841, "responder_bytes": 4996 }, { "flow_id": "flow-7da24638bf0e27c718279c6f", "transport": "udp", "stream": 90, "initiator_ip": "10.9.10.102", "initiator_port": 62545, "responder_ip": "10.9.10.9", "responder_port": 53, "first_frame": 8397, "last_frame": 8399, "first_seen_epoch": "1631318972.337134", "last_seen_epoch": "1631318972.821081", "packets": 3, "bytes": 487, "initiator_bytes": 148, "responder_bytes": 339 }, { "flow_id": "flow-5106e1b3d81b38fe67618dd0", "transport": "tcp", "stream": 136, "initiator_ip": "10.9.10.102", "initiator_port": 58217, "responder_ip": "40.126.26.135", "responder_port": 443, "first_frame": 8400, "last_frame": 8471, "first_seen_epoch": "1631318972.827993", "last_seen_epoch": "1631319083.12337", "packets": 35, "bytes": 24796, "initiator_bytes": 6469, "responder_bytes": 18327 }, { "flow_id": "flow-9576c34b3292e568a80dcfd8", "transport": "udp", "stream": 91, "initiator_ip": "10.9.10.102", "initiator_port": 64727, "responder_ip": "10.9.10.9", "responder_port": 53, "first_frame": 8441, "last_frame": 8442, "first_seen_epoch": "1631319034.384054", "last_seen_epoch": "1631319034.468756", "packets": 2, "bytes": 322, "initiator_bytes": 83, "responder_bytes": 239 }, { "flow_id": "flow-a13c0f769a5e16259c895260", "transport": "tcp", "stream": 137, "initiator_ip": "10.9.10.102", "initiator_port": 58218, "responder_ip": "23.1.237.201", "responder_port": 80, "first_frame": 8443, "last_frame": 8464, "first_seen_epoch": "1631319034.475672", "last_seen_epoch": "1631319047.478638", "packets": 16, "bytes": 2055, "initiator_bytes": 1103, "responder_bytes": 952 }, { "flow_id": "flow-e6858f26c30b962df1617066", "transport": "tcp", "stream": 138, "initiator_ip": "10.9.10.102", "initiator_port": 58219, "responder_ip": "94.158.245.52", "responder_port": 443, "first_frame": 8478, "last_frame": 8622, "first_seen_epoch": "1631319236.339675", "last_seen_epoch": "1631319595.054475", "packets": 24, "bytes": 7603, "initiator_bytes": 4161, "responder_bytes": 3442 }, { "flow_id": "flow-aa9f6c02c2e3f3aec4a751e6", "transport": "tcp", "stream": 139, "initiator_ip": "10.9.10.102", "initiator_port": 58220, "responder_ip": "94.158.245.52", "responder_port": 443, "first_frame": 8498, "last_frame": 8519, "first_seen_epoch": "1631319238.985245", "last_seen_epoch": "1631319241.4961", "packets": 20, "bytes": 5153, "initiator_bytes": 4255, "responder_bytes": 898 }, { "flow_id": "flow-75cbf77f6d3a936a947c6695", "transport": "udp", "stream": 92, "initiator_ip": "10.9.10.102", "initiator_port": 60062, "responder_ip": "10.9.10.9", "responder_port": 53, "first_frame": 8533, "last_frame": 8536, "first_seen_epoch": "1631319346.875565", "last_seen_epoch": "1631319346.962976", "packets": 4, "bytes": 400, "initiator_bytes": 184, "responder_bytes": 216 }, { "flow_id": "flow-c0b022070ab972c53672aed6", "transport": "tcp", "stream": 140, "initiator_ip": "10.9.10.102", "initiator_port": 58221, "responder_ip": "10.9.10.9", "responder_port": 445, "first_frame": 8537, "last_frame": 8563, "first_seen_epoch": "1631319346.965558", "last_seen_epoch": "1631319358.221451", "packets": 27, "bytes": 7601, "initiator_bytes": 5373, "responder_bytes": 2228 }, { "flow_id": "flow-10239e49fc6ebdb0b6c300ad", "transport": "udp", "stream": 93, "initiator_ip": "10.9.10.102", "initiator_port": 49651, "responder_ip": "10.9.10.9", "responder_port": 53, "first_frame": 8564, "last_frame": 8565, "first_seen_epoch": "1631319392.407001", "last_seen_epoch": "1631319392.40733", "packets": 2, "bytes": 241, "initiator_bytes": 81, "responder_bytes": 160 }, { "flow_id": "flow-da61a92e5288004c3fd52764", "transport": "tcp", "stream": 141, "initiator_ip": "10.9.10.102", "initiator_port": 58222, "responder_ip": "94.158.245.52", "responder_port": 443, "first_frame": 8581, "last_frame": 8604, "first_seen_epoch": "1631319587.456464", "last_seen_epoch": "1631319591.660123", "packets": 23, "bytes": 6793, "initiator_bytes": 4347, "responder_bytes": 2446 }, { "flow_id": "flow-c1ba9e84fb800b53ef7814bb", "transport": "tcp", "stream": 142, "initiator_ip": "10.9.10.102", "initiator_port": 58223, "responder_ip": "94.158.245.52", "responder_port": 443, "first_frame": 8603, "last_frame": 8786, "first_seen_epoch": "1631319591.417213", "last_seen_epoch": "1631319864.077486", "packets": 20, "bytes": 5831, "initiator_bytes": 3951, "responder_bytes": 1880 }, { "flow_id": "flow-a10528a2195ecf2265e5dfde", "transport": "tcp", "stream": 143, "initiator_ip": "10.9.10.102", "initiator_port": 58224, "responder_ip": "94.158.245.52", "responder_port": 443, "first_frame": 8623, "last_frame": 8642, "first_seen_epoch": "1631319595.054503", "last_seen_epoch": "1631319598.867438", "packets": 20, "bytes": 5181, "initiator_bytes": 4283, "responder_bytes": 898 }, { "flow_id": "flow-d501ffb0ccb6457379f89610", "transport": "udp", "stream": 94, "initiator_ip": "10.9.10.102", "initiator_port": 62827, "responder_ip": "10.9.10.9", "responder_port": 53, "first_frame": 8654, "last_frame": 8655, "first_seen_epoch": "1631319727.188018", "last_seen_epoch": "1631319727.265646", "packets": 2, "bytes": 305, "initiator_bytes": 89, "responder_bytes": 216 }, { "flow_id": "flow-0b97089d30cbf1537a86a5a6", "transport": "tcp", "stream": 144, "initiator_ip": "10.9.10.102", "initiator_port": 58225, "responder_ip": "20.42.73.25", "responder_port": 443, "first_frame": 8656, "last_frame": 8674, "first_seen_epoch": "1631319727.268302", "last_seen_epoch": "1631319728.130849", "packets": 19, "bytes": 8225, "initiator_bytes": 2903, "responder_bytes": 5322 }, { "flow_id": "flow-9c8066dce9409ca06936e5a1", "transport": "udp", "stream": 95, "initiator_ip": "10.9.10.102", "initiator_port": 63280, "responder_ip": "10.9.10.9", "responder_port": 53, "first_frame": 8681, "last_frame": 8682, "first_seen_epoch": "1631319740.661881", "last_seen_epoch": "1631319740.66221", "packets": 2, "bytes": 324, "initiator_bytes": 128, "responder_bytes": 196 }, { "flow_id": "flow-0483043b537e55a9cfbc8ce1", "transport": "udp", "stream": 96, "initiator_ip": "10.9.10.102", "initiator_port": 63281, "responder_ip": "10.9.10.9", "responder_port": 389, "first_frame": 8683, "last_frame": 8684, "first_seen_epoch": "1631319740.677794", "last_seen_epoch": "1631319740.678243", "packets": 2, "bytes": 513, "initiator_bytes": 269, "responder_bytes": 244 }, { "flow_id": "flow-e5f8f8cce367ea93c9a473bd", "transport": "tcp", "stream": 145, "initiator_ip": "10.9.10.102", "initiator_port": 58226, "responder_ip": "10.9.10.9", "responder_port": 135, "first_frame": 8685, "last_frame": 8762, "first_seen_epoch": "1631319740.801001", "last_seen_epoch": "1631319742.169287", "packets": 12, "bytes": 1644, "initiator_bytes": 964, "responder_bytes": 680 }, { "flow_id": "flow-a784598cc9172ca3aba7d0ff", "transport": "tcp", "stream": 146, "initiator_ip": "10.9.10.102", "initiator_port": 58227, "responder_ip": "10.9.10.9", "responder_port": 49667, "first_frame": 8692, "last_frame": 8763, "first_seen_epoch": "1631319741.397608", "last_seen_epoch": "1631319742.169288", "packets": 25, "bytes": 7208, "initiator_bytes": 4715, "responder_bytes": 2493 }, { "flow_id": "flow-20068816f3e12f3e397ff749", "transport": "udp", "stream": 97, "initiator_ip": "10.9.10.102", "initiator_port": 63283, "responder_ip": "10.9.10.9", "responder_port": 389, "first_frame": 8719, "last_frame": 8720, "first_seen_epoch": "1631319741.766009", "last_seen_epoch": "1631319741.766399", "packets": 2, "bytes": 513, "initiator_bytes": 269, "responder_bytes": 244 }, { "flow_id": "flow-7f7fc8fd6a5e023b505b1601", "transport": "tcp", "stream": 147, "initiator_ip": "10.9.10.102", "initiator_port": 58228, "responder_ip": "10.9.10.9", "responder_port": 389, "first_frame": 8722, "last_frame": 8761, "first_seen_epoch": "1631319741.870592", "last_seen_epoch": "1631319742.16528", "packets": 22, "bytes": 7620, "initiator_bytes": 3541, "responder_bytes": 4079 }, { "flow_id": "flow-776fbb13ef65a8670b0b7508", "transport": "tcp", "stream": 148, "initiator_ip": "10.9.10.102", "initiator_port": 58229, "responder_ip": "10.9.10.9", "responder_port": 389, "first_frame": 8739, "last_frame": 8758, "first_seen_epoch": "1631319742.109709", "last_seen_epoch": "1631319742.165104", "packets": 18, "bytes": 6974, "initiator_bytes": 2881, "responder_bytes": 4093 }, { "flow_id": "flow-e0dd5ba1a95b9f9678c74988", "transport": "tcp", "stream": 149, "initiator_ip": "10.9.10.102", "initiator_port": 58230, "responder_ip": "94.158.245.52", "responder_port": 443, "first_frame": 8770, "last_frame": 8857, "first_seen_epoch": "1631319860.74984", "last_seen_epoch": "1631320038.67876", "packets": 23, "bytes": 6008, "initiator_bytes": 3969, "responder_bytes": 2039 }, { "flow_id": "flow-56692b636626da1be74cde9a", "transport": "tcp", "stream": 150, "initiator_ip": "10.9.10.102", "initiator_port": 58231, "responder_ip": "94.158.245.52", "responder_port": 443, "first_frame": 8787, "last_frame": 8811, "first_seen_epoch": "1631319864.077487", "last_seen_epoch": "1631319870.278791", "packets": 23, "bytes": 8059, "initiator_bytes": 7075, "responder_bytes": 984 }, { "flow_id": "flow-b6ab7b41ef9d543f729561d6", "transport": "udp", "stream": 98, "initiator_ip": "10.9.10.102", "initiator_port": 58376, "responder_ip": "10.9.10.9", "responder_port": 53, "first_frame": 8825, "last_frame": 8826, "first_seen_epoch": "1631319992.455563", "last_seen_epoch": "1631319992.455953", "packets": 2, "bytes": 241, "initiator_bytes": 81, "responder_bytes": 160 }, { "flow_id": "flow-b54a16dda0f19c3e66f34a93", "transport": "tcp", "stream": 151, "initiator_ip": "10.9.10.102", "initiator_port": 58232, "responder_ip": "94.158.245.52", "responder_port": 443, "first_frame": 8834, "last_frame": 9132, "first_seen_epoch": "1631320035.024715", "last_seen_epoch": "1631320219.097287", "packets": 25, "bytes": 7913, "initiator_bytes": 4276, "responder_bytes": 3637 }, { "flow_id": "flow-e9a0e56e54c6c44e79ebf0ac", "transport": "tcp", "stream": 152, "initiator_ip": "10.9.10.102", "initiator_port": 58233, "responder_ip": "94.158.245.52", "responder_port": 443, "first_frame": 8856, "last_frame": 8879, "first_seen_epoch": "1631320038.436985", "last_seen_epoch": "1631320041.977093", "packets": 20, "bytes": 5163, "initiator_bytes": 4265, "responder_bytes": 898 }, { "flow_id": "flow-4de17a04b98a2bd068dd0c34", "transport": "tcp", "stream": 153, "initiator_ip": "10.9.10.102", "initiator_port": 58234, "responder_ip": "10.9.10.9", "responder_port": 135, "first_frame": 8882, "last_frame": 9092, "first_seen_epoch": "1631320086.120853", "last_seen_epoch": "1631320101.031612", "packets": 13, "bytes": 1548, "initiator_bytes": 748, "responder_bytes": 800 }, { "flow_id": "flow-d788e525f5727623c7b64aa5", "transport": "udp", "stream": 99, "initiator_ip": "10.9.10.102", "initiator_port": 59934, "responder_ip": "10.9.10.9", "responder_port": 53, "first_frame": 8884, "last_frame": 8887, "first_seen_epoch": "1631320086.126109", "last_seen_epoch": "1631320086.126452", "packets": 2, "bytes": 200, "initiator_bytes": 92, "responder_bytes": 108 }, { "flow_id": "flow-3e68497fe44289def9434393", "transport": "tcp", "stream": 154, "initiator_ip": "10.9.10.102", "initiator_port": 58235, "responder_ip": "10.9.10.9", "responder_port": 49667, "first_frame": 8891, "last_frame": 9105, "first_seen_epoch": "1631320086.130603", "last_seen_epoch": "1631320121.0023", "packets": 20, "bytes": 5309, "initiator_bytes": 3664, "responder_bytes": 1645 }, { "flow_id": "flow-e8739dc70c2508628f41f4ea", "transport": "tcp", "stream": 155, "initiator_ip": "10.9.10.102", "initiator_port": 58236, "responder_ip": "10.9.10.9", "responder_port": 389, "first_frame": 8909, "last_frame": 9085, "first_seen_epoch": "1631320086.429843", "last_seen_epoch": "1631320088.320131", "packets": 22, "bytes": 9165, "initiator_bytes": 3894, "responder_bytes": 5271 }, { "flow_id": "flow-3a97782b9acd29bf62e9d121", "transport": "udp", "stream": 100, "initiator_ip": "10.9.10.102", "initiator_port": 59936, "responder_ip": "10.9.10.9", "responder_port": 389, "first_frame": 8920, "last_frame": 8921, "first_seen_epoch": "1631320086.902251", "last_seen_epoch": "1631320086.902672", "packets": 2, "bytes": 556, "initiator_bytes": 312, "responder_bytes": 244 }, { "flow_id": "flow-339172e3370ae9a9dd31300a", "transport": "tcp", "stream": 156, "initiator_ip": "10.9.10.102", "initiator_port": 58237, "responder_ip": "10.9.10.9", "responder_port": 389, "first_frame": 8925, "last_frame": 9081, "first_seen_epoch": "1631320087.013575", "last_seen_epoch": "1631320088.311542", "packets": 16, "bytes": 3830, "initiator_bytes": 2902, "responder_bytes": 928 }, { "flow_id": "flow-06a8f3b760322b8a47c26edd", "transport": "tcp", "stream": 157, "initiator_ip": "10.9.10.102", "initiator_port": 58238, "responder_ip": "10.9.10.9", "responder_port": 445, "first_frame": 8941, "last_frame": 9192, "first_seen_epoch": "1631320087.396067", "last_seen_epoch": "1631320270.279797", "packets": 180, "bytes": 46539, "initiator_bytes": 24541, "responder_bytes": 21998 }, { "flow_id": "flow-4ee4ae026e0b3e797258c13c", "transport": "tcp", "stream": 158, "initiator_ip": "10.9.10.102", "initiator_port": 58239, "responder_ip": "94.158.245.52", "responder_port": 443, "first_frame": 9116, "last_frame": 9195, "first_seen_epoch": "1631320216.740236", "last_seen_epoch": "1631320284.093031", "packets": 18, "bytes": 5781, "initiator_bytes": 3835, "responder_bytes": 1946 }, { "flow_id": "flow-967f994a322f5e3ea145c4d9", "transport": "tcp", "stream": 159, "initiator_ip": "10.9.10.102", "initiator_port": 58240, "responder_ip": "94.158.245.52", "responder_port": 443, "first_frame": 9133, "last_frame": 9158, "first_seen_epoch": "1631320219.097288", "last_seen_epoch": "1631320223.284963", "packets": 24, "bytes": 5415, "initiator_bytes": 4457, "responder_bytes": 958 }, { "flow_id": "flow-5bb32ba7ae6af570333ff0e9", "transport": "udp", "stream": 101, "initiator_ip": "10.9.10.102", "initiator_port": 59775, "responder_ip": "10.9.10.9", "responder_port": 53, "first_frame": 9203, "last_frame": 9204, "first_seen_epoch": "1631320315.976739", "last_seen_epoch": "1631320316.054404", "packets": 2, "bytes": 232, "initiator_bytes": 85, "responder_bytes": 147 }, { "flow_id": "flow-fa12197b8c5671964c7ffc42", "transport": "tcp", "stream": 160, "initiator_ip": "10.9.10.102", "initiator_port": 58241, "responder_ip": "52.109.8.25", "responder_port": 443, "first_frame": 9205, "last_frame": 9221, "first_seen_epoch": "1631320316.060854", "last_seen_epoch": "1631320317.075695", "packets": 17, "bytes": 9271, "initiator_bytes": 2432, "responder_bytes": 6839 } ], "events": { "dns": [ { "event_id": "evt-e12c50e16ad17096f2347aa2", "kind": "dns", "frame_number": 18, "timestamp_epoch": "1631315709.538659000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 53124, "dst_port": 53, "tcp_stream": null, "udp_stream": 3, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.angrypoutine.com", "dns.qry.type": "1" } }, { "event_id": "evt-d0421cc1a74876793740936c", "kind": "dns", "frame_number": 19, "timestamp_epoch": "1631315709.539026000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 53, "dst_port": 53124, "tcp_stream": null, "udp_stream": 3, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.angrypoutine.com", "dns.qry.type": "1" } }, { "event_id": "evt-faac9b3099bbcb3d58bbb323", "kind": "dns", "frame_number": 22, "timestamp_epoch": "1631315709.547238000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 60310, "dst_port": 53, "tcp_stream": null, "udp_stream": 4, "fields": { "dns.flags.response": "False", "dns.qry.name": "DESKTOP-KKITB6Q.angrypoutine.com", "dns.qry.type": "6" } }, { "event_id": "evt-27bac047950cb1b9effc09f1", "kind": "dns", "frame_number": 23, "timestamp_epoch": "1631315709.547578000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 53, "dst_port": 60310, "tcp_stream": null, "udp_stream": 4, "fields": { "dns.a": "10.9.10.9", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "DESKTOP-KKITB6Q.angrypoutine.com", "dns.qry.type": "6" } }, { "event_id": "evt-2ba29e1242ed44b1e7ab69a0", "kind": "dns", "frame_number": 26, "timestamp_epoch": "1631315709.550830000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 64814, "dst_port": 53, "tcp_stream": null, "udp_stream": 5, "fields": { "dns.a": "10.9.10.102", "dns.flags.response": "False", "dns.qry.name": "angrypoutine.com", "dns.qry.type": "6" } }, { "event_id": "evt-bd112d8b8d018970dbe4b2ff", "kind": "dns", "frame_number": 30, "timestamp_epoch": "1631315709.551563000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 53, "dst_port": 64814, "tcp_stream": null, "udp_stream": 5, "fields": { "dns.a": "10.9.10.102", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "angrypoutine.com", "dns.qry.type": "6" } }, { "event_id": "evt-cf7d81712a4f4b7cca83368b", "kind": "dns", "frame_number": 39, "timestamp_epoch": "1631315711.019152000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 62920, "dst_port": 53, "tcp_stream": null, "udp_stream": 10, "fields": { "dns.flags.response": "False", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.angrypoutine.com", "dns.qry.type": "33" } }, { "event_id": "evt-a65e37aaa22502803966bdd0", "kind": "dns", "frame_number": 40, "timestamp_epoch": "1631315711.019480000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 53, "dst_port": 62920, "tcp_stream": null, "udp_stream": 10, "fields": { "dns.a": "10.9.10.9", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.angrypoutine.com", "dns.qry.type": "33" } }, { "event_id": "evt-3e3bab45dc6158c366f67bdb", "kind": "dns", "frame_number": 41, "timestamp_epoch": "1631315711.022144000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 63367, "dst_port": 53, "tcp_stream": null, "udp_stream": 11, "fields": { "dns.flags.response": "False", "dns.qry.name": "angrypoutine-dc.angrypoutine.com", "dns.qry.type": "1" } }, { "event_id": "evt-ad81f0b9cb3bc091c6933ee0", "kind": "dns", "frame_number": 42, "timestamp_epoch": "1631315711.022428000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 53, "dst_port": 63367, "tcp_stream": null, "udp_stream": 11, "fields": { "dns.a": "10.9.10.9", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "angrypoutine-dc.angrypoutine.com", "dns.qry.type": "1" } }, { "event_id": "evt-041f231eb3be6184badc9d6f", "kind": "dns", "frame_number": 44, "timestamp_epoch": "1631315711.117649000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 63367, "dst_port": 53, "tcp_stream": null, "udp_stream": 11, "fields": { "dns.flags.response": "False", "dns.qry.name": "angrypoutine-dc.angrypoutine.com", "dns.qry.type": "1" } }, { "event_id": "evt-7ade863234a3bc0595fef192", "kind": "dns", "frame_number": 45, "timestamp_epoch": "1631315711.117830000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 53, "dst_port": 63367, "tcp_stream": null, "udp_stream": 11, "fields": { "dns.a": "10.9.10.9", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "angrypoutine-dc.angrypoutine.com", "dns.qry.type": "1" } }, { "event_id": "evt-2b1df593210c4935b8382047", "kind": "dns", "frame_number": 62, "timestamp_epoch": "1631315714.160252000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 55937, "dst_port": 53, "tcp_stream": null, "udp_stream": 15, "fields": { "dns.flags.response": "False", "dns.qry.name": "www.msftncsi.com", "dns.qry.type": "1" } }, { "event_id": "evt-7d6c144e9c7c80b1daa96505", "kind": "dns", "frame_number": 63, "timestamp_epoch": "1631315714.217547000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 64956, "dst_port": 53, "tcp_stream": null, "udp_stream": 16, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.angrypoutine.com", "dns.qry.type": "1" } }, { "event_id": "evt-e81e92f881b6529b88c6f9cb", "kind": "dns", "frame_number": 64, "timestamp_epoch": "1631315714.217859000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 53, "dst_port": 64956, "tcp_stream": null, "udp_stream": 16, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.angrypoutine.com", "dns.qry.type": "1" } }, { "event_id": "evt-b989c3651532ca7da0397295", "kind": "dns", "frame_number": 65, "timestamp_epoch": "1631315714.230509000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 53, "dst_port": 55937, "tcp_stream": null, "udp_stream": 15, "fields": { "dns.a": "96.17.68.66,96.17.68.83", "dns.cname": "www.msftncsi.com.edgesuite.net,a1961.g2.akamai.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "www.msftncsi.com", "dns.qry.type": "1" } }, { "event_id": "evt-0b4459b3099f542e404b7f98", "kind": "dns", "frame_number": 133, "timestamp_epoch": "1631315732.216866000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 58038, "dst_port": 53, "tcp_stream": null, "udp_stream": 17, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.angrypoutine.com", "dns.qry.type": "1" } }, { "event_id": "evt-5c4dea3c84f88e9a2868f2e1", "kind": "dns", "frame_number": 134, "timestamp_epoch": "1631315732.217241000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 53, "dst_port": 58038, "tcp_stream": null, "udp_stream": 17, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.angrypoutine.com", "dns.qry.type": "1" } }, { "event_id": "evt-62b55bc54b0e7a899060e52a", "kind": "dns", "frame_number": 167, "timestamp_epoch": "1631315792.232266000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 59690, "dst_port": 53, "tcp_stream": null, "udp_stream": 19, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.angrypoutine.com", "dns.qry.type": "1" } }, { "event_id": "evt-08171499a1ffc03026a69128", "kind": "dns", "frame_number": 168, "timestamp_epoch": "1631315792.232631000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 53, "dst_port": 59690, "tcp_stream": null, "udp_stream": 19, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.angrypoutine.com", "dns.qry.type": "1" } }, { "event_id": "evt-4d1c3e98dd48607144a5efdb", "kind": "dns", "frame_number": 218, "timestamp_epoch": "1631315797.993791000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 50665, "dst_port": 53, "tcp_stream": null, "udp_stream": 20, "fields": { "dns.flags.response": "False", "dns.qry.name": "fs.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-7aa082642725e4b61bdcc569", "kind": "dns", "frame_number": 219, "timestamp_epoch": "1631315798.069599000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 53, "dst_port": 50665, "tcp_stream": null, "udp_stream": 20, "fields": { "dns.a": "23.3.84.67", "dns.cname": "prod.fs.microsoft.com.akadns.net,fs-wildcard.microsoft.com.edgekey.net,fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net,e1723.g.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "fs.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-3174de1ce300a0f4e3a025c4", "kind": "dns", "frame_number": 510, "timestamp_epoch": "1631315817.470608000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 61056, "dst_port": 53, "tcp_stream": null, "udp_stream": 22, "fields": { "dns.flags.response": "False", "dns.qry.name": "cdn.onenote.net", "dns.qry.type": "1" } }, { "event_id": "evt-ae2569eabf801e2a26d586fe", "kind": "dns", "frame_number": 511, "timestamp_epoch": "1631315817.545292000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 53, "dst_port": 61056, "tcp_stream": null, "udp_stream": 22, "fields": { "dns.a": "184.85.229.68", "dns.cname": "cdn.onenote.net.edgekey.net,e1553.dspg.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "cdn.onenote.net", "dns.qry.type": "1" } }, { "event_id": "evt-f3172c8adfe375a9c6767cf0", "kind": "dns", "frame_number": 555, "timestamp_epoch": "1631315818.320206000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 63203, "dst_port": 53, "tcp_stream": null, "udp_stream": 23, "fields": { "dns.flags.response": "False", "dns.qry.name": "api.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-6ea2a62a238e1b16bec15bad", "kind": "dns", "frame_number": 556, "timestamp_epoch": "1631315818.394540000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 53, "dst_port": 63203, "tcp_stream": null, "udp_stream": 23, "fields": { "dns.a": "204.79.197.203", "dns.cname": "api-msn-com.a-0003.a-msedge.net,a-0003.a-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "api.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-31f08996ec041a7a4e04c739", "kind": "dns", "frame_number": 577, "timestamp_epoch": "1631315821.607731000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 63317, "dst_port": 53, "tcp_stream": null, "udp_stream": 24, "fields": { "dns.flags.response": "False", "dns.qry.name": "www.bing.com", "dns.qry.type": "1" } }, { "event_id": "evt-7d2a5494fc877c63837dc941", "kind": "dns", "frame_number": 578, "timestamp_epoch": "1631315821.609487000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 59335, "dst_port": 53, "tcp_stream": null, "udp_stream": 25, "fields": { "dns.flags.response": "False", "dns.qry.name": "f005cab8a8840abf6ab35152a071b205.clo.footprintdns.com", "dns.qry.type": "1" } }, { "event_id": "evt-336bff01760efc33943b01d7", "kind": "dns", "frame_number": 579, "timestamp_epoch": "1631315821.612358000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 59612, "dst_port": 53, "tcp_stream": null, "udp_stream": 26, "fields": { "dns.flags.response": "False", "dns.qry.name": "moiafdazure.clo.footprintdns.com", "dns.qry.type": "1" } }, { "event_id": "evt-9977e7335baebaadd345625c", "kind": "dns", "frame_number": 581, "timestamp_epoch": "1631315821.615606000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 50928, "dst_port": 53, "tcp_stream": null, "udp_stream": 27, "fields": { "dns.flags.response": "False", "dns.qry.name": "q-ring.msedge.net", "dns.qry.type": "1" } }, { "event_id": "evt-7261a3119b33ea818fba8f36", "kind": "dns", "frame_number": 582, "timestamp_epoch": "1631315821.618106000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 59983, "dst_port": 53, "tcp_stream": null, "udp_stream": 28, "fields": { "dns.flags.response": "False", "dns.qry.name": "fp-afd.azurefd.us", "dns.qry.type": "1" } }, { "event_id": "evt-712630d08d19f05eed578d4a", "kind": "dns", "frame_number": 583, "timestamp_epoch": "1631315821.620987000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 51910, "dst_port": 53, "tcp_stream": null, "udp_stream": 29, "fields": { "dns.flags.response": "False", "dns.qry.name": "68091d435f184f9c8d6273bdb538ff4b.clo.footprintdns.com", "dns.qry.type": "1" } }, { "event_id": "evt-625a2244a3d15443758d824a", "kind": "dns", "frame_number": 584, "timestamp_epoch": "1631315821.686441000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 53, "dst_port": 59612, "tcp_stream": null, "udp_stream": 26, "fields": { "dns.a": "13.107.246.254", "dns.cname": "t-ring.msedge.net,t-ring.t-9999.t-msedge.net,t-9999.t-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "moiafdazure.clo.footprintdns.com", "dns.qry.type": "1" } }, { "event_id": "evt-58f9450a477d8597fd6c530c", "kind": "dns", "frame_number": 586, "timestamp_epoch": "1631315821.687509000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 53, "dst_port": 50928, "tcp_stream": null, "udp_stream": 27, "fields": { "dns.a": "13.107.49.254", "dns.cname": "q-ring.q-9999.q-msedge.net,q-9999.q-msedge.net,q-9999.q.dns.azurefd.net,q-9999.standard.q-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "q-ring.msedge.net", "dns.qry.type": "1" } }, { "event_id": "evt-d3b240af53a952826a95fc00", "kind": "dns", "frame_number": 587, "timestamp_epoch": "1631315821.687583000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 53, "dst_port": 59335, "tcp_stream": null, "udp_stream": 25, "fields": { "dns.a": "51.137.102.183", "dns.cname": "am2prdapp01-canary.cloudapp.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "f005cab8a8840abf6ab35152a071b205.clo.footprintdns.com", "dns.qry.type": "1" } }, { "event_id": "evt-673952b8ca4a8a7b907506a4", "kind": "dns", "frame_number": 590, "timestamp_epoch": "1631315821.689446000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 53, "dst_port": 63317, "tcp_stream": null, "udp_stream": 24, "fields": { "dns.a": "204.79.197.200,13.107.21.200", "dns.cname": "a-0001.a-afdentry.net.trafficmanager.net,www-bing-com.dual-a-0001.a-msedge.net,dual-a-0001.a-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "www.bing.com", "dns.qry.type": "1" } }, { "event_id": "evt-9d4df4adf2af30f51d7a0bdf", "kind": "dns", "frame_number": 595, "timestamp_epoch": "1631315821.695636000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 51031, "dst_port": 53, "tcp_stream": null, "udp_stream": 30, "fields": { "dns.flags.response": "False", "dns.qry.name": "t-ring.msedge.net", "dns.qry.type": "1" } }, { "event_id": "evt-b0ca113be0f911d578072b4c", "kind": "dns", "frame_number": 596, "timestamp_epoch": "1631315821.695989000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 53, "dst_port": 51031, "tcp_stream": null, "udp_stream": 30, "fields": { "dns.a": "13.107.246.254", "dns.cname": "t-ring.t-9999.t-msedge.net,t-9999.t-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "t-ring.msedge.net", "dns.qry.type": "1" } }, { "event_id": "evt-1cf46b5afe840e01ef7d177c", "kind": "dns", "frame_number": 597, "timestamp_epoch": "1631315821.698728000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 56838, "dst_port": 53, "tcp_stream": null, "udp_stream": 31, "fields": { "dns.flags.response": "False", "dns.qry.name": "s-ring.msedge.net", "dns.qry.type": "1" } }, { "event_id": "evt-4f00c015dd2a31a82a223613", "kind": "dns", "frame_number": 599, "timestamp_epoch": "1631315821.701103000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 52993, "dst_port": 53, "tcp_stream": null, "udp_stream": 32, "fields": { "dns.flags.response": "False", "dns.qry.name": "teams-ring.msedge.net", "dns.qry.type": "1" } }, { "event_id": "evt-ed5e41696d4766734180afac", "kind": "dns", "frame_number": 600, "timestamp_epoch": "1631315821.703853000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 51512, "dst_port": 53, "tcp_stream": null, "udp_stream": 33, "fields": { "dns.flags.response": "False", "dns.qry.name": "k-ring.msedge.net", "dns.qry.type": "1" } }, { "event_id": "evt-36f8ec63668e77ef36a3d1a9", "kind": "dns", "frame_number": 601, "timestamp_epoch": "1631315821.704192000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 53, "dst_port": 51910, "tcp_stream": null, "udp_stream": 29, "fields": { "dns.a": "23.100.36.182", "dns.cname": "canary.trafficmanager.net,by1prdapp01-canary.cloudapp.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "68091d435f184f9c8d6273bdb538ff4b.clo.footprintdns.com", "dns.qry.type": "1" } }, { "event_id": "evt-ee0b7491b3f36ee73fd1e4d1", "kind": "dns", "frame_number": 602, "timestamp_epoch": "1631315821.707229000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 59867, "dst_port": 53, "tcp_stream": null, "udp_stream": 34, "fields": { "dns.flags.response": "False", "dns.qry.name": "fp-vs-nocache.azureedge.net", "dns.qry.type": "1" } }, { "event_id": "evt-af995c46962fb0d5a8a4666e", "kind": "dns", "frame_number": 604, "timestamp_epoch": "1631315821.711728000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 57496, "dst_port": 53, "tcp_stream": null, "udp_stream": 35, "fields": { "dns.flags.response": "False", "dns.qry.name": "spo-ring.msedge.net", "dns.qry.type": "1" } }, { "event_id": "evt-9f2ec1f9f2b50e25377ed1b3", "kind": "dns", "frame_number": 605, "timestamp_epoch": "1631315821.718228000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 59983, "dst_port": 53, "tcp_stream": null, "udp_stream": 28, "fields": { "dns.flags.response": "False", "dns.qry.name": "fp-afd.azurefd.us", "dns.qry.type": "1" } }, { "event_id": "evt-d0caf61ce280dd6057868188", "kind": "dns", "frame_number": 617, "timestamp_epoch": "1631315821.775660000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 53, "dst_port": 56838, "tcp_stream": null, "udp_stream": 31, "fields": { "dns.a": "13.107.3.254", "dns.cname": "s-ring.s-9999.s-msedge.net,s-9999.s-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "s-ring.msedge.net", "dns.qry.type": "1" } }, { "event_id": "evt-c1df70254823bf0bb30f9e4b", "kind": "dns", "frame_number": 618, "timestamp_epoch": "1631315821.775735000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 53, "dst_port": 51512, "tcp_stream": null, "udp_stream": 33, "fields": { "dns.a": "13.107.18.254", "dns.cname": "k-ring.k-9999.k-msedge.net,k-9999.k-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "k-ring.msedge.net", "dns.qry.type": "1" } }, { "event_id": "evt-f1b9f056dda2040791205726", "kind": "dns", "frame_number": 619, "timestamp_epoch": "1631315821.775938000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 53, "dst_port": 52993, "tcp_stream": null, "udp_stream": 32, "fields": { "dns.a": "52.113.196.254", "dns.cname": "teams-ring.teams-9999.teams-msedge.net,teams-9999.teams-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "teams-ring.msedge.net", "dns.qry.type": "1" } }, { "event_id": "evt-acfa0df379d152d3349d5936", "kind": "dns", "frame_number": 625, "timestamp_epoch": "1631315821.777719000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 53, "dst_port": 59867, "tcp_stream": null, "udp_stream": 34, "fields": { "dns.a": "72.21.81.200", "dns.cname": "fp-vs-nocache.ec.azureedge.net,cs9.wpc.v0cdn.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "fp-vs-nocache.azureedge.net", "dns.qry.type": "1" } }, { "event_id": "evt-b017629b830f3b67b81301ee", "kind": "dns", "frame_number": 632, "timestamp_epoch": "1631315821.783225000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 58243, "dst_port": 53, "tcp_stream": null, "udp_stream": 36, "fields": { "dns.flags.response": "False", "dns.qry.name": "a-ring.msedge.net", "dns.qry.type": "1" } }, { "event_id": "evt-19c56c026138724411b74486", "kind": "dns", "frame_number": 633, "timestamp_epoch": "1631315821.787724000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 56716, "dst_port": 53, "tcp_stream": null, "udp_stream": 37, "fields": { "dns.flags.response": "False", "dns.qry.name": "fp.msedge.net", "dns.qry.type": "1" } }, { "event_id": "evt-5d488d4dc483b260d566fc79", "kind": "dns", "frame_number": 634, "timestamp_epoch": "1631315821.790476000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 57627, "dst_port": 53, "tcp_stream": null, "udp_stream": 38, "fields": { "dns.flags.response": "False", "dns.qry.name": "fp-afd.azureedge.us", "dns.qry.type": "1" } }, { "event_id": "evt-39ebdc2d6213273ca4a772e5", "kind": "dns", "frame_number": 637, "timestamp_epoch": "1631315821.791996000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 53, "dst_port": 57496, "tcp_stream": null, "udp_stream": 35, "fields": { "dns.a": "13.107.136.254", "dns.cname": "spo-ring.spo-9999.spo-msedge.net,spo-9999.spo-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "spo-ring.msedge.net", "dns.qry.type": "1" } }, { "event_id": "evt-ea3f663e4e2502883ded458e", "kind": "dns", "frame_number": 642, "timestamp_epoch": "1631315821.811473000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 60501, "dst_port": 53, "tcp_stream": null, "udp_stream": 39, "fields": { "dns.flags.response": "False", "dns.qry.name": "login.live.com", "dns.qry.type": "1" } }, { "event_id": "evt-4fd7da30aa6af8ab9d6a9e0e", "kind": "dns", "frame_number": 671, "timestamp_epoch": "1631315821.855931000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 53, "dst_port": 58243, "tcp_stream": null, "udp_stream": 36, "fields": { "dns.a": "204.79.197.254", "dns.cname": "a-ring.a-9999.a-msedge.net,a-9999.a-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "a-ring.msedge.net", "dns.qry.type": "1" } }, { "event_id": "evt-e33a409caddbcc8162da8bce", "kind": "dns", "frame_number": 672, "timestamp_epoch": "1631315821.856019000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 53, "dst_port": 56716, "tcp_stream": null, "udp_stream": 37, "fields": { "dns.a": "204.79.197.222", "dns.cname": "1.perf.msedge.net,a-0019.a-msedge.net,a-0019.a.dns.azurefd.net,a-0019.standard.a-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "fp.msedge.net", "dns.qry.type": "1" } }, { "event_id": "evt-3e973bba2ae854d25e50c5de", "kind": "dns", "frame_number": 706, "timestamp_epoch": "1631315821.887347000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 57627, "dst_port": 53, "tcp_stream": null, "udp_stream": 38, "fields": { "dns.flags.response": "False", "dns.qry.name": "fp-afd.azureedge.us", "dns.qry.type": "1" } }, { "event_id": "evt-8f8b8a01688649286b661e83", "kind": "dns", "frame_number": 707, "timestamp_epoch": "1631315821.891636000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 53, "dst_port": 60501, "tcp_stream": null, "udp_stream": 39, "fields": { "dns.a": "20.190.151.131,20.190.151.134,20.190.151.69,20.190.151.68,20.190.151.9,20.190.151.6,20.190.151.133,20.190.151.132", "dns.cname": "login.msa.msidentity.com,www.tm.lg.prod.aadmsa.akadns.net,prda.aadg.msidentity.com,www.tm.a.prd.aadg.akadns.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "login.live.com", "dns.qry.type": "1" } }, { "event_id": "evt-a0b2c45c6f16cff99198637a", "kind": "dns", "frame_number": 712, "timestamp_epoch": "1631315821.917378000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 53, "dst_port": 57627, "tcp_stream": null, "udp_stream": 38, "fields": { "dns.a": "20.140.48.71", "dns.cname": "fp-afd.afd.azureedge.us,afd.msedge.azure.us,t-0001.msedge.azure.us,eafd-defaultvips-3p-gov.usgovtrafficmanager.net,eafd-ffgov-phx01.elasticafd.msedge.azure.us", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "fp-afd.azureedge.us", "dns.qry.type": "1" } }, { "event_id": "evt-67cdb6635ac4fe37e6bc6426", "kind": "dns", "frame_number": 960, "timestamp_epoch": "1631315822.720072000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 59983, "dst_port": 53, "tcp_stream": null, "udp_stream": 28, "fields": { "dns.flags.response": "False", "dns.qry.name": "fp-afd.azurefd.us", "dns.qry.type": "1" } }, { "event_id": "evt-2341b97c403baecfb6bd7900", "kind": "dns", "frame_number": 1006, "timestamp_epoch": "1631315824.734259000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 59983, "dst_port": 53, "tcp_stream": null, "udp_stream": 28, "fields": { "dns.flags.response": "False", "dns.qry.name": "fp-afd.azurefd.us", "dns.qry.type": "1" } }, { "event_id": "evt-005cc9f72afc214962d85663", "kind": "dns", "frame_number": 1007, "timestamp_epoch": "1631315825.758203000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 53, "dst_port": 59983, "tcp_stream": null, "udp_stream": 28, "fields": { "dns.a": "20.140.48.71", "dns.cname": "t-0001.msedge.azure.us,eafd-defaultvips-3p-gov.usgovtrafficmanager.net,eafd-ffgov-phx01.elasticafd.msedge.azure.us", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "fp-afd.azurefd.us", "dns.qry.type": "1" } }, { "event_id": "evt-317ae709d971b4ac68d3fb7e", "kind": "dns", "frame_number": 1086, "timestamp_epoch": "1631315834.099848000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 57414, "dst_port": 53, "tcp_stream": null, "udp_stream": 40, "fields": { "dns.flags.response": "False", "dns.qry.name": "settings-win.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-9324d2f0033eff3fd996f59f", "kind": "dns", "frame_number": 1087, "timestamp_epoch": "1631315834.189719000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 57414, "dst_port": 53, "tcp_stream": null, "udp_stream": 40, "fields": { "dns.flags.response": "False", "dns.qry.name": "settings-win.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-49e9b05692ddb5c486301653", "kind": "dns", "frame_number": 1088, "timestamp_epoch": "1631315834.196449000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 53, "dst_port": 57414, "tcp_stream": null, "udp_stream": 40, "fields": { "dns.a": "52.137.106.217", "dns.cname": "settingsfd-geo.trafficmanager.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "settings-win.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-657e4ad3e8802f4b3f2e6b84", "kind": "dns", "frame_number": 1143, "timestamp_epoch": "1631315840.425780000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 52570, "dst_port": 53, "tcp_stream": null, "udp_stream": 41, "fields": { "dns.flags.response": "False", "dns.qry.name": "office15client.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-cb8ff63e9c70f61239a458e5", "kind": "dns", "frame_number": 1144, "timestamp_epoch": "1631315840.502907000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 53, "dst_port": 52570, "tcp_stream": null, "udp_stream": 41, "fields": { "dns.a": "52.109.20.75", "dns.cname": "config.officeapps.live.com,prod.configsvc1.live.com.akadns.net,us.configsvc1.live.com.akadns.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "office15client.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-cef6214175c1b33c266af5de", "kind": "dns", "frame_number": 1145, "timestamp_epoch": "1631315840.524648000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 60803, "dst_port": 53, "tcp_stream": null, "udp_stream": 42, "fields": { "dns.flags.response": "False", "dns.qry.name": "www.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-7489a5f0a03f8ab6f5e84c7d", "kind": "dns", "frame_number": 1146, "timestamp_epoch": "1631315840.596048000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 53, "dst_port": 60803, "tcp_stream": null, "udp_stream": 42, "fields": { "dns.a": "23.3.85.234", "dns.cname": "www.microsoft.com-c-3.edgekey.net,www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net,e13678.dscb.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "www.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-e9a1a8fff877b69aaa0e1fd6", "kind": "dns", "frame_number": 1180, "timestamp_epoch": "1631315847.020323000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 57667, "dst_port": 53, "tcp_stream": null, "udp_stream": 43, "fields": { "dns.flags.response": "False", "dns.qry.name": "simpsonsavingss.com", "dns.qry.type": "1" } }, { "event_id": "evt-0407ecc443c31a0fb59a6047", "kind": "dns", "frame_number": 1181, "timestamp_epoch": "1631315847.100529000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 57667, "dst_port": 53, "tcp_stream": null, "udp_stream": 43, "fields": { "dns.flags.response": "False", "dns.qry.name": "simpsonsavingss.com", "dns.qry.type": "1" } }, { "event_id": "evt-cadba9f248f8073dc0d33ea7", "kind": "dns", "frame_number": 1182, "timestamp_epoch": "1631315847.253809000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 53, "dst_port": 57667, "tcp_stream": null, "udp_stream": 43, "fields": { "dns.a": "194.62.42.206", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "simpsonsavingss.com", "dns.qry.type": "1" } }, { "event_id": "evt-39d7f6ccd6dc3d6cd020b8bb", "kind": "dns", "frame_number": 1478, "timestamp_epoch": "1631315851.802675000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 49543, "dst_port": 53, "tcp_stream": null, "udp_stream": 44, "fields": { "dns.flags.response": "False", "dns.qry.name": "microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-dd483ee378011010586d09dd", "kind": "dns", "frame_number": 1480, "timestamp_epoch": "1631315851.872188000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 53, "dst_port": 49543, "tcp_stream": null, "udp_stream": 44, "fields": { "dns.a": "104.215.148.63,40.76.4.15,40.112.72.205,40.113.200.201,13.77.161.179", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-ab01dd479fbf80ac139587c9", "kind": "dns", "frame_number": 1932, "timestamp_epoch": "1631315872.895782000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 50440, "dst_port": 53, "tcp_stream": null, "udp_stream": 45, "fields": { "dns.flags.response": "False", "dns.qry.name": "storeedgefd.dsx.mp.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-6fee6b9e1564076f6d73caef", "kind": "dns", "frame_number": 1933, "timestamp_epoch": "1631315872.987404000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 50440, "dst_port": 53, "tcp_stream": null, "udp_stream": 45, "fields": { "dns.flags.response": "False", "dns.qry.name": "storeedgefd.dsx.mp.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-bc6cbfe5cf0155b2bed7698b", "kind": "dns", "frame_number": 1936, "timestamp_epoch": "1631315874.002873000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 50440, "dst_port": 53, "tcp_stream": null, "udp_stream": 45, "fields": { "dns.flags.response": "False", "dns.qry.name": "storeedgefd.dsx.mp.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-e8c50fa87a62646ec0e6f628", "kind": "dns", "frame_number": 1945, "timestamp_epoch": "1631315876.005564000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 50440, "dst_port": 53, "tcp_stream": null, "udp_stream": 45, "fields": { "dns.flags.response": "False", "dns.qry.name": "storeedgefd.dsx.mp.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-8ab57d1195808ca43a5915db", "kind": "dns", "frame_number": 1946, "timestamp_epoch": "1631315876.496286000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 53, "dst_port": 50440, "tcp_stream": null, "udp_stream": 45, "fields": { "dns.a": "23.3.86.10", "dns.cname": "storeedgefd.xbetservices.akadns.net,storeedgefd.dsx.mp.microsoft.com.edgekey.net,storeedgefd.dsx.mp.microsoft.com.edgekey.net.globalredir.akadns.net,e16646.dscg.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "storeedgefd.dsx.mp.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-6b7172318ab61968e21b9e16", "kind": "dns", "frame_number": 2014, "timestamp_epoch": "1631315876.832668000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 57207, "dst_port": 53, "tcp_stream": null, "udp_stream": 46, "fields": { "dns.flags.response": "False", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.angrypoutine.com", "dns.qry.type": "33" } }, { "event_id": "evt-f345f433ab23dcbd0c30b820", "kind": "dns", "frame_number": 2015, "timestamp_epoch": "1631315876.832971000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 53, "dst_port": 57207, "tcp_stream": null, "udp_stream": 46, "fields": { "dns.a": "10.9.10.9", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.angrypoutine.com", "dns.qry.type": "33" } }, { "event_id": "evt-03a7c1944eb19020f300179a", "kind": "dns", "frame_number": 2295, "timestamp_epoch": "1631315877.448892000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 54756, "dst_port": 53, "tcp_stream": null, "udp_stream": 48, "fields": { "dns.flags.response": "False", "dns.qry.name": "store-images.s-microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-5cb5744522675b2b126ee0e9", "kind": "dns", "frame_number": 2305, "timestamp_epoch": "1631315877.533889000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 54756, "dst_port": 53, "tcp_stream": null, "udp_stream": 48, "fields": { "dns.flags.response": "False", "dns.qry.name": "store-images.s-microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-018429cad07c13429d79f943", "kind": "dns", "frame_number": 2306, "timestamp_epoch": "1631315877.614309000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 53, "dst_port": 54756, "tcp_stream": null, "udp_stream": 48, "fields": { "dns.a": "23.3.85.202", "dns.cname": "store-images.s-microsoft.com-c.edgekey.net,e12564.dspb.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "store-images.s-microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-13a3c9ac5ce0be92a175baaa", "kind": "dns", "frame_number": 2328, "timestamp_epoch": "1631315877.761881000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 63034, "dst_port": 53, "tcp_stream": null, "udp_stream": 49, "fields": { "dns.flags.response": "False", "dns.qry.name": "gameplayapi.intel.com", "dns.qry.type": "1" } }, { "event_id": "evt-ea768d75f6b2518edfbef475", "kind": "dns", "frame_number": 2329, "timestamp_epoch": "1631315877.846253000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 63034, "dst_port": 53, "tcp_stream": null, "udp_stream": 49, "fields": { "dns.flags.response": "False", "dns.qry.name": "gameplayapi.intel.com", "dns.qry.type": "1" } }, { "event_id": "evt-70abb49809292986b6184e34", "kind": "dns", "frame_number": 2370, "timestamp_epoch": "1631315877.905601000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 53, "dst_port": 63034, "tcp_stream": null, "udp_stream": 49, "fields": { "dns.a": "23.3.6.28", "dns.cname": "intel11.edgekey.net,e11.dsca.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "gameplayapi.intel.com", "dns.qry.type": "1" } }, { "event_id": "evt-af6257fc4632c3e46fd84733", "kind": "dns", "frame_number": 2603, "timestamp_epoch": "1631315961.509438000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 64980, "dst_port": 53, "tcp_stream": null, "udp_stream": 50, "fields": { "dns.flags.response": "False", "dns.qry.name": "myexternalip.com", "dns.qry.type": "1" } }, { "event_id": "evt-d354fcdc8827a13d5059e734", "kind": "dns", "frame_number": 2604, "timestamp_epoch": "1631315961.580572000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 53, "dst_port": 64980, "tcp_stream": null, "udp_stream": 50, "fields": { "dns.a": "34.117.59.81", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "myexternalip.com", "dns.qry.type": "1" } }, { "event_id": "evt-c1a4b86804dbb3ec1224a71a", "kind": "dns", "frame_number": 2605, "timestamp_epoch": "1631315961.591549000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 64980, "dst_port": 53, "tcp_stream": null, "udp_stream": 50, "fields": { "dns.flags.response": "False", "dns.qry.name": "myexternalip.com", "dns.qry.type": "1" } }, { "event_id": "evt-551051835c104761cb54dec4", "kind": "dns", "frame_number": 2606, "timestamp_epoch": "1631315961.591822000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 53, "dst_port": 64980, "tcp_stream": null, "udp_stream": 50, "fields": { "dns.a": "34.117.59.81", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "myexternalip.com", "dns.qry.type": "1" } }, { "event_id": "evt-4fe088e2e8ebc1d1cef8f098", "kind": "dns", "frame_number": 2636, "timestamp_epoch": "1631315962.254281000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 52106, "dst_port": 53, "tcp_stream": null, "udp_stream": 55, "fields": { "dns.flags.response": "False", "dns.qry.name": "DESKTOP-MUYEYV7.angrypoutine.com", "dns.qry.type": "1" } }, { "event_id": "evt-45c697771d75a3d63f3e667a", "kind": "dns", "frame_number": 2637, "timestamp_epoch": "1631315962.254530000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 53, "dst_port": 52106, "tcp_stream": null, "udp_stream": 55, "fields": { "dns.a": "10.9.10.103", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "DESKTOP-MUYEYV7.angrypoutine.com", "dns.qry.type": "1" } }, { "event_id": "evt-3356fbbc56a3d870d5ff16d9", "kind": "dns", "frame_number": 2638, "timestamp_epoch": "1631315962.343653000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 52106, "dst_port": 53, "tcp_stream": null, "udp_stream": 55, "fields": { "dns.flags.response": "False", "dns.qry.name": "DESKTOP-MUYEYV7.angrypoutine.com", "dns.qry.type": "1" } }, { "event_id": "evt-2be07f61ce437696ccd755ae", "kind": "dns", "frame_number": 2639, "timestamp_epoch": "1631315962.343828000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 53, "dst_port": 52106, "tcp_stream": null, "udp_stream": 55, "fields": { "dns.a": "10.9.10.103", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "DESKTOP-MUYEYV7.angrypoutine.com", "dns.qry.type": "1" } }, { "event_id": "evt-779678531879aee099597561", "kind": "dns", "frame_number": 2833, "timestamp_epoch": "1631315968.071604000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 61142, "dst_port": 53, "tcp_stream": null, "udp_stream": 56, "fields": { "dns.flags.response": "False", "dns.qry.name": "office15client.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-8fc2323c8e014647cd50366f", "kind": "dns", "frame_number": 2844, "timestamp_epoch": "1631315968.163473000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 61142, "dst_port": 53, "tcp_stream": null, "udp_stream": 56, "fields": { "dns.flags.response": "False", "dns.qry.name": "office15client.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-d475e93299760e5e964d5f88", "kind": "dns", "frame_number": 2845, "timestamp_epoch": "1631315968.236579000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 53, "dst_port": 61142, "tcp_stream": null, "udp_stream": 56, "fields": { "dns.a": "52.109.20.75", "dns.cname": "config.officeapps.live.com,prod.configsvc1.live.com.akadns.net,us.configsvc1.live.com.akadns.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "office15client.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-e50c36dc0d3af63aba21fa3a", "kind": "dns", "frame_number": 2846, "timestamp_epoch": "1631315968.255718000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 64302, "dst_port": 53, "tcp_stream": null, "udp_stream": 57, "fields": { "dns.flags.response": "False", "dns.qry.name": "www.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-8b905f408a9de5b5d8390d8d", "kind": "dns", "frame_number": 2847, "timestamp_epoch": "1631315968.335091000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 64302, "dst_port": 53, "tcp_stream": null, "udp_stream": 57, "fields": { "dns.flags.response": "False", "dns.qry.name": "www.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-c16556f6d9b2f739c4d1aac3", "kind": "dns", "frame_number": 2848, "timestamp_epoch": "1631315968.338242000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 53, "dst_port": 64302, "tcp_stream": null, "udp_stream": 57, "fields": { "dns.a": "23.3.85.234", "dns.cname": "www.microsoft.com-c-3.edgekey.net,www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net,e13678.dscb.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "www.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-7a9bbb61a71e9a3b76aca146", "kind": "dns", "frame_number": 2849, "timestamp_epoch": "1631315968.340842000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 58191, "dst_port": 53, "tcp_stream": null, "udp_stream": 58, "fields": { "dns.flags.response": "False", "dns.qry.name": "nexus.officeapps.live.com", "dns.qry.type": "1" } }, { "event_id": "evt-02f1daf85021548eca2b2941", "kind": "dns", "frame_number": 2853, "timestamp_epoch": "1631315968.428839000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 58191, "dst_port": 53, "tcp_stream": null, "udp_stream": 58, "fields": { "dns.flags.response": "False", "dns.qry.name": "nexus.officeapps.live.com", "dns.qry.type": "1" } }, { "event_id": "evt-f3b0e7269f24601acb99d159", "kind": "dns", "frame_number": 2854, "timestamp_epoch": "1631315968.436452000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 53, "dst_port": 58191, "tcp_stream": null, "udp_stream": 58, "fields": { "dns.a": "52.109.8.22", "dns.cname": "prod-w.nexus.live.com.akadns.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "nexus.officeapps.live.com", "dns.qry.type": "1" } }, { "event_id": "evt-858e33e7f960e96d95b8579e", "kind": "dns", "frame_number": 2875, "timestamp_epoch": "1631315969.871045000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 59788, "dst_port": 53, "tcp_stream": null, "udp_stream": 59, "fields": { "dns.flags.response": "False", "dns.qry.name": "nexusrules.officeapps.live.com", "dns.qry.type": "1" } }, { "event_id": "evt-9fa8690d6be6a8e512379bf3", "kind": "dns", "frame_number": 2877, "timestamp_epoch": "1631315969.959548000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 59788, "dst_port": 53, "tcp_stream": null, "udp_stream": 59, "fields": { "dns.flags.response": "False", "dns.qry.name": "nexusrules.officeapps.live.com", "dns.qry.type": "1" } }, { "event_id": "evt-1800b2d0048e7f152537be24", "kind": "dns", "frame_number": 2878, "timestamp_epoch": "1631315969.971917000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 53, "dst_port": 59788, "tcp_stream": null, "udp_stream": 59, "fields": { "dns.a": "52.109.76.32", "dns.cname": "prod.nexusrules.live.com.akadns.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "nexusrules.officeapps.live.com", "dns.qry.type": "1" } }, { "event_id": "evt-9e55771885eb1b598b0852f4", "kind": "dns", "frame_number": 2941, "timestamp_epoch": "1631316141.268355000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 55009, "dst_port": 53, "tcp_stream": null, "udp_stream": 60, "fields": { "dns.flags.response": "False", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.angrypoutine.com", "dns.qry.type": "33" } }, { "event_id": "evt-fe82c2f5369c04e4e1091ddb", "kind": "dns", "frame_number": 2942, "timestamp_epoch": "1631316141.268718000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 53, "dst_port": 55009, "tcp_stream": null, "udp_stream": 60, "fields": { "dns.a": "10.9.10.9", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.angrypoutine.com", "dns.qry.type": "33" } }, { "event_id": "evt-40e2a8d2d73284a7b3f9dc37", "kind": "dns", "frame_number": 3025, "timestamp_epoch": "1631316272.878633000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 52821, "dst_port": 53, "tcp_stream": null, "udp_stream": 62, "fields": { "dns.flags.response": "False", "dns.qry.name": "slscr.update.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-c0c33047f62a9142c4ac8f94", "kind": "dns", "frame_number": 3026, "timestamp_epoch": "1631316272.958756000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 52821, "dst_port": 53, "tcp_stream": null, "udp_stream": 62, "fields": { "dns.flags.response": "False", "dns.qry.name": "slscr.update.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-98bb25d8d1076f0892a14a22", "kind": "dns", "frame_number": 3027, "timestamp_epoch": "1631316272.962978000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 53, "dst_port": 52821, "tcp_stream": null, "udp_stream": 62, "fields": { "dns.a": "52.242.101.226", "dns.cname": "slscr.update.microsoft.com.akadns.net,sls.update.microsoft.com.akadns.net,sls.row.update.microsoft.com.akadns.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "slscr.update.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-d00235c7cea24bb12ec2464f", "kind": "dns", "frame_number": 3049, "timestamp_epoch": "1631316274.428472000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 54702, "dst_port": 53, "tcp_stream": null, "udp_stream": 63, "fields": { "dns.flags.response": "False", "dns.qry.name": "fe2cr.update.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-52eae3234f7604d035d910fc", "kind": "dns", "frame_number": 3050, "timestamp_epoch": "1631316274.505027000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 53, "dst_port": 54702, "tcp_stream": null, "udp_stream": 63, "fields": { "dns.a": "52.238.248.6", "dns.cname": "fe2cr.update.microsoft.com.akadns.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "fe2cr.update.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-e4c7d5ee751e343c74e309e2", "kind": "dns", "frame_number": 3072, "timestamp_epoch": "1631316275.626673000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 55185, "dst_port": 53, "tcp_stream": null, "udp_stream": 64, "fields": { "dns.flags.response": "False", "dns.qry.name": "login.live.com", "dns.qry.type": "1" } }, { "event_id": "evt-971698b4e29c73a77754b5f4", "kind": "dns", "frame_number": 3073, "timestamp_epoch": "1631316275.712007000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 53, "dst_port": 55185, "tcp_stream": null, "udp_stream": 64, "fields": { "dns.a": "20.190.154.138,20.190.154.139,20.190.154.17,40.126.26.132,40.126.26.134,20.190.154.136,20.190.154.16,20.190.154.18", "dns.cname": "login.msa.msidentity.com,www.tm.lg.prod.aadmsa.akadns.net,prda.aadg.msidentity.com,www.tm.a.prd.aadg.akadns.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "login.live.com", "dns.qry.type": "1" } }, { "event_id": "evt-01a3c8522014355e6115e6e4", "kind": "dns", "frame_number": 3163, "timestamp_epoch": "1631316276.398273000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 59477, "dst_port": 53, "tcp_stream": null, "udp_stream": 65, "fields": { "dns.flags.response": "False", "dns.qry.name": "v10.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-931c7e70f861eda5f85af132", "kind": "dns", "frame_number": 3165, "timestamp_epoch": "1631316276.467528000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 53, "dst_port": 59477, "tcp_stream": null, "udp_stream": 65, "fields": { "dns.a": "104.46.162.226", "dns.cname": "global.asimov.events.data.trafficmanager.net,onedscolprdaus02.australiasoutheast.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "v10.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-476abe83999023161371e466", "kind": "dns", "frame_number": 3232, "timestamp_epoch": "1631316276.812385000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 56070, "dst_port": 53, "tcp_stream": null, "udp_stream": 66, "fields": { "dns.flags.response": "False", "dns.qry.name": "download.windowsupdate.com", "dns.qry.type": "1" } }, { "event_id": "evt-e84487bc9d0be1cda5f65dd9", "kind": "dns", "frame_number": 3233, "timestamp_epoch": "1631316276.885401000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 53, "dst_port": 56070, "tcp_stream": null, "udp_stream": 66, "fields": { "dns.a": "23.1.237.200,23.1.237.216,23.1.237.225,23.1.237.209", "dns.cname": "wu-shim.trafficmanager.net,download.windowsupdate.com.edgesuite.net,a767.dspw65.akamai.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "download.windowsupdate.com", "dns.qry.type": "1" } }, { "event_id": "evt-e49be876de4bce8a0f884262", "kind": "dns", "frame_number": 4022, "timestamp_epoch": "1631316283.545802000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 65482, "dst_port": 53, "tcp_stream": null, "udp_stream": 67, "fields": { "dns.flags.response": "False", "dns.qry.name": "fe3cr.delivery.mp.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-5e8644c11a959fcd84eb6424", "kind": "dns", "frame_number": 4023, "timestamp_epoch": "1631316283.633425000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 65482, "dst_port": 53, "tcp_stream": null, "udp_stream": 67, "fields": { "dns.flags.response": "False", "dns.qry.name": "fe3cr.delivery.mp.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-20a08374322de2a0494fc174", "kind": "dns", "frame_number": 4024, "timestamp_epoch": "1631316283.653453000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 53, "dst_port": 65482, "tcp_stream": null, "udp_stream": 67, "fields": { "dns.a": "40.125.122.151,52.242.97.97", "dns.cname": "fe3.delivery.mp.microsoft.com,fe3.delivery.dsp.mp.microsoft.com.nsatc.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "fe3cr.delivery.mp.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-8a91cc091edf784f3e8129b6", "kind": "dns", "frame_number": 4034, "timestamp_epoch": "1631316284.708888000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 62936, "dst_port": 53, "tcp_stream": null, "udp_stream": 68, "fields": { "dns.flags.response": "False", "dns.qry.name": "v10.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-9d53425455c6b9a667a14741", "kind": "dns", "frame_number": 4044, "timestamp_epoch": "1631316284.787487000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 53, "dst_port": 62936, "tcp_stream": null, "udp_stream": 68, "fields": { "dns.a": "104.46.162.226", "dns.cname": "global.asimov.events.data.trafficmanager.net,onedscolprdaus02.australiasoutheast.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "v10.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-0113a32671820ac62d486ca0", "kind": "dns", "frame_number": 4096, "timestamp_epoch": "1631316286.101929000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 50706, "dst_port": 53, "tcp_stream": null, "udp_stream": 69, "fields": { "dns.flags.response": "False", "dns.qry.name": "geo.prod.do.dsp.mp.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-141fc7b33540b3687b5a5ef5", "kind": "dns", "frame_number": 4097, "timestamp_epoch": "1631316286.166797000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 53, "dst_port": 50706, "tcp_stream": null, "udp_stream": 69, "fields": { "dns.a": "52.184.217.20", "dns.cname": "geo.prod.do.dsp.trafficmanager.net,array507.prod.do.dsp.mp.microsoft.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "geo.prod.do.dsp.mp.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-b623ad65990ef5ee2d85f3f3", "kind": "dns", "frame_number": 4123, "timestamp_epoch": "1631316286.985284000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 60902, "dst_port": 53, "tcp_stream": null, "udp_stream": 70, "fields": { "dns.flags.response": "False", "dns.qry.name": "kv601.prod.do.dsp.mp.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-e36573f3e40b774dd5c51cf9", "kind": "dns", "frame_number": 4124, "timestamp_epoch": "1631316287.056993000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 53, "dst_port": 60902, "tcp_stream": null, "udp_stream": 70, "fields": { "dns.a": "104.125.253.131", "dns.cname": "kv601.prod.do.dsp.mp.microsoft.com.edgekey.net,e12358.g.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "kv601.prod.do.dsp.mp.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-5230c4964504dae46c1dadd0", "kind": "dns", "frame_number": 4151, "timestamp_epoch": "1631316287.945289000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 55999, "dst_port": 53, "tcp_stream": null, "udp_stream": 71, "fields": { "dns.flags.response": "False", "dns.qry.name": "cp601.prod.do.dsp.mp.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-933a12352594332549f578ee", "kind": "dns", "frame_number": 4159, "timestamp_epoch": "1631316288.021439000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 53, "dst_port": 55999, "tcp_stream": null, "udp_stream": 71, "fields": { "dns.a": "104.125.253.131", "dns.cname": "cp601.prod.do.dsp.mp.microsoft.com.edgekey.net,e12358.g.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "cp601.prod.do.dsp.mp.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-078404dc74fecb796f2f4d59", "kind": "dns", "frame_number": 4182, "timestamp_epoch": "1631316288.612396000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 53070, "dst_port": 53, "tcp_stream": null, "udp_stream": 72, "fields": { "dns.flags.response": "False", "dns.qry.name": "au.download.windowsupdate.com", "dns.qry.type": "1" } }, { "event_id": "evt-a5a4a1182b9e9dca2b2736d7", "kind": "dns", "frame_number": 4187, "timestamp_epoch": "1631316288.685394000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 53, "dst_port": 53070, "tcp_stream": null, "udp_stream": 72, "fields": { "dns.a": "23.1.237.216,23.1.237.225,23.1.237.209,23.1.237.200", "dns.cname": "wu-shim.trafficmanager.net,download.windowsupdate.com.edgesuite.net,a767.dspw65.akamai.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "au.download.windowsupdate.com", "dns.qry.type": "1" } }, { "event_id": "evt-4a8e14b2d08f5e2e4da2e6da", "kind": "dns", "frame_number": 5111, "timestamp_epoch": "1631316289.549810000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 58461, "dst_port": 53, "tcp_stream": null, "udp_stream": 73, "fields": { "dns.flags.response": "False", "dns.qry.name": "v10.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-669ef365de3ee7560857f07e", "kind": "dns", "frame_number": 5113, "timestamp_epoch": "1631316289.550182000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 53, "dst_port": 58461, "tcp_stream": null, "udp_stream": 73, "fields": { "dns.a": "104.46.162.226", "dns.cname": "global.asimov.events.data.trafficmanager.net,onedscolprdaus02.australiasoutheast.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "v10.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-021fcf10bca94f813882882d", "kind": "dns", "frame_number": 7357, "timestamp_epoch": "1631316292.761763000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 50862, "dst_port": 53, "tcp_stream": null, "udp_stream": 74, "fields": { "dns.flags.response": "False", "dns.qry.name": "v10.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-bf88539fe5d2003e9fc75920", "kind": "dns", "frame_number": 7358, "timestamp_epoch": "1631316292.832321000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 53, "dst_port": 50862, "tcp_stream": null, "udp_stream": 74, "fields": { "dns.a": "20.50.73.10", "dns.cname": "global.asimov.events.data.trafficmanager.net,onedscolprdneu04.northeurope.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "v10.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-ef3405c58c69223cd6e5be57", "kind": "dns", "frame_number": 7419, "timestamp_epoch": "1631316303.614050000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 63259, "dst_port": 53, "tcp_stream": null, "udp_stream": 75, "fields": { "dns.flags.response": "False", "dns.qry.name": "v10.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-05e341f926f73e34a733237c", "kind": "dns", "frame_number": 7420, "timestamp_epoch": "1631316303.686956000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 53, "dst_port": 63259, "tcp_stream": null, "udp_stream": 75, "fields": { "dns.a": "20.50.73.10", "dns.cname": "global.asimov.events.data.trafficmanager.net,onedscolprdneu04.northeurope.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "v10.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-e4eb4d1cc983fbfc2f7cb193", "kind": "dns", "frame_number": 7445, "timestamp_epoch": "1631316322.221973000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 61055, "dst_port": 53, "tcp_stream": null, "udp_stream": 76, "fields": { "dns.flags.response": "False", "dns.qry.name": "settings-win.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-5a9b677731915b5f98aebf2e", "kind": "dns", "frame_number": 7446, "timestamp_epoch": "1631316322.309220000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 61055, "dst_port": 53, "tcp_stream": null, "udp_stream": 76, "fields": { "dns.flags.response": "False", "dns.qry.name": "settings-win.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-c8a8fbd341d73409092b29d5", "kind": "dns", "frame_number": 7447, "timestamp_epoch": "1631316323.324567000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 61055, "dst_port": 53, "tcp_stream": null, "udp_stream": 76, "fields": { "dns.flags.response": "False", "dns.qry.name": "settings-win.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-97bae932d6b0ee49a64d8bdb", "kind": "dns", "frame_number": 7450, "timestamp_epoch": "1631316325.339628000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 61055, "dst_port": 53, "tcp_stream": null, "udp_stream": 76, "fields": { "dns.flags.response": "False", "dns.qry.name": "settings-win.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-684535823fa8564c1af8af51", "kind": "dns", "frame_number": 7451, "timestamp_epoch": "1631316326.556916000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 53, "dst_port": 61055, "tcp_stream": null, "udp_stream": 76, "fields": { "dns.a": "52.137.106.217", "dns.cname": "settingsfd-geo.trafficmanager.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "settings-win.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-9d0fea56e6867d183dfa7ba1", "kind": "dns", "frame_number": 7585, "timestamp_epoch": "1631316382.412743000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 51813, "dst_port": 53, "tcp_stream": null, "udp_stream": 77, "fields": { "dns.flags.response": "False", "dns.qry.name": "v10.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-1c42bc7dbd4d855f8a0f319f", "kind": "dns", "frame_number": 7586, "timestamp_epoch": "1631316382.488159000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 53, "dst_port": 51813, "tcp_stream": null, "udp_stream": 77, "fields": { "dns.a": "20.189.173.7", "dns.cname": "global.asimov.events.data.trafficmanager.net,onedscolprdwus06.westus.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "v10.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-b78d156e406cb572dfba33dd", "kind": "dns", "frame_number": 7623, "timestamp_epoch": "1631316392.221436000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 51468, "dst_port": 53, "tcp_stream": null, "udp_stream": 78, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.angrypoutine.com", "dns.qry.type": "1" } }, { "event_id": "evt-a24fc4bbb42397232dde6de5", "kind": "dns", "frame_number": 7624, "timestamp_epoch": "1631316392.221760000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 53, "dst_port": 51468, "tcp_stream": null, "udp_stream": 78, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.angrypoutine.com", "dns.qry.type": "1" } }, { "event_id": "evt-5cd628c7466880eaca6ba4bc", "kind": "dns", "frame_number": 7761, "timestamp_epoch": "1631316992.281374000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 62507, "dst_port": 53, "tcp_stream": null, "udp_stream": 79, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.angrypoutine.com", "dns.qry.type": "1" } }, { "event_id": "evt-1f61c24f2e67722846cddcd1", "kind": "dns", "frame_number": 7762, "timestamp_epoch": "1631316992.281679000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 53, "dst_port": 62507, "tcp_stream": null, "udp_stream": 79, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.angrypoutine.com", "dns.qry.type": "1" } }, { "event_id": "evt-a767959e796c7464501755e8", "kind": "dns", "frame_number": 7921, "timestamp_epoch": "1631317592.283598000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 64610, "dst_port": 53, "tcp_stream": null, "udp_stream": 80, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.angrypoutine.com", "dns.qry.type": "1" } }, { "event_id": "evt-40b6fdf31202f5c45bc0d7da", "kind": "dns", "frame_number": 7922, "timestamp_epoch": "1631317592.283915000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 53, "dst_port": 64610, "tcp_stream": null, "udp_stream": 80, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.angrypoutine.com", "dns.qry.type": "1" } }, { "event_id": "evt-e8ab0954542021ea37e983d7", "kind": "dns", "frame_number": 7989, "timestamp_epoch": "1631317871.054310000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 64392, "dst_port": 53, "tcp_stream": null, "udp_stream": 81, "fields": { "dns.flags.response": "False", "dns.qry.name": "evoke-windowsservices-tas.msedge.net", "dns.qry.type": "1" } }, { "event_id": "evt-c774765ebf1864186ce6e9fa", "kind": "dns", "frame_number": 7990, "timestamp_epoch": "1631317871.122087000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 53, "dst_port": 64392, "tcp_stream": null, "udp_stream": 81, "fields": { "dns.a": "13.107.5.88", "dns.cname": "evoke-windowsservices-tas-msedge-net.e-0009.e-msedge.net,e-0009.e-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "evoke-windowsservices-tas.msedge.net", "dns.qry.type": "1" } }, { "event_id": "evt-c029ffdd32ff67128d07e929", "kind": "dns", "frame_number": 8026, "timestamp_epoch": "1631317927.232039000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 50183, "dst_port": 53, "tcp_stream": null, "udp_stream": 82, "fields": { "dns.flags.response": "False", "dns.qry.name": "v10.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-57bb547ea53c0f274881d63a", "kind": "dns", "frame_number": 8027, "timestamp_epoch": "1631317927.318922000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 53, "dst_port": 50183, "tcp_stream": null, "udp_stream": 82, "fields": { "dns.a": "52.182.143.208", "dns.cname": "global.asimov.events.data.trafficmanager.net,onedscolprdcus04.centralus.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "v10.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-77d1514691a796fadad3fb5b", "kind": "dns", "frame_number": 8039, "timestamp_epoch": "1631317946.902041000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 63098, "dst_port": 53, "tcp_stream": null, "udp_stream": 83, "fields": { "dns.flags.response": "False", "dns.qry.name": "dns.msftncsi.com", "dns.qry.type": "1" } }, { "event_id": "evt-2c2ca899fdb2842528ce2333", "kind": "dns", "frame_number": 8040, "timestamp_epoch": "1631317946.978854000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 53, "dst_port": 63098, "tcp_stream": null, "udp_stream": 83, "fields": { "dns.a": "131.107.255.255", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "dns.msftncsi.com", "dns.qry.type": "1" } }, { "event_id": "evt-4e8964fd5f66c8a1cce8f3df", "kind": "dns", "frame_number": 8041, "timestamp_epoch": "1631317947.000663000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 63098, "dst_port": 53, "tcp_stream": null, "udp_stream": 83, "fields": { "dns.flags.response": "False", "dns.qry.name": "dns.msftncsi.com", "dns.qry.type": "1" } }, { "event_id": "evt-50b6bf1739c799fb2e859c78", "kind": "dns", "frame_number": 8042, "timestamp_epoch": "1631317947.000885000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 53, "dst_port": 63098, "tcp_stream": null, "udp_stream": 83, "fields": { "dns.a": "131.107.255.255", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "dns.msftncsi.com", "dns.qry.type": "1" } }, { "event_id": "evt-b3814a90e20f5994ccd865af", "kind": "dns", "frame_number": 8043, "timestamp_epoch": "1631317951.355779000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 64400, "dst_port": 53, "tcp_stream": null, "udp_stream": 84, "fields": { "dns.flags.response": "False", "dns.qry.name": "v10.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-bbec3c2b5015214995b9ccbc", "kind": "dns", "frame_number": 8044, "timestamp_epoch": "1631317951.431683000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 53, "dst_port": 64400, "tcp_stream": null, "udp_stream": 84, "fields": { "dns.a": "13.69.239.72", "dns.cname": "global.asimov.events.data.trafficmanager.net,onedscolprdneu00.northeurope.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "v10.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-50bc2fd51875dcd76925f162", "kind": "dns", "frame_number": 8077, "timestamp_epoch": "1631318192.329739000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 60734, "dst_port": 53, "tcp_stream": null, "udp_stream": 85, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.angrypoutine.com", "dns.qry.type": "1" } }, { "event_id": "evt-63d966356291caaac7ac499d", "kind": "dns", "frame_number": 8078, "timestamp_epoch": "1631318192.330117000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 53, "dst_port": 60734, "tcp_stream": null, "udp_stream": 85, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.angrypoutine.com", "dns.qry.type": "1" } }, { "event_id": "evt-b934bf84b7cb94bb23d8eea9", "kind": "dns", "frame_number": 8178, "timestamp_epoch": "1631318516.031005000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 52559, "dst_port": 53, "tcp_stream": null, "udp_stream": 86, "fields": { "dns.flags.response": "False", "dns.qry.name": "nexus.officeapps.live.com", "dns.qry.type": "1" } }, { "event_id": "evt-3af16d9ff13df4cba5545929", "kind": "dns", "frame_number": 8179, "timestamp_epoch": "1631318516.120081000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 52559, "dst_port": 53, "tcp_stream": null, "udp_stream": 86, "fields": { "dns.flags.response": "False", "dns.qry.name": "nexus.officeapps.live.com", "dns.qry.type": "1" } }, { "event_id": "evt-dbee4016ad10f3141abdc1f7", "kind": "dns", "frame_number": 8180, "timestamp_epoch": "1631318517.132973000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 52559, "dst_port": 53, "tcp_stream": null, "udp_stream": 86, "fields": { "dns.flags.response": "False", "dns.qry.name": "nexus.officeapps.live.com", "dns.qry.type": "1" } }, { "event_id": "evt-526a34a1eeb4ee9849b0df9d", "kind": "dns", "frame_number": 8181, "timestamp_epoch": "1631318519.137285000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 52559, "dst_port": 53, "tcp_stream": null, "udp_stream": 86, "fields": { "dns.flags.response": "False", "dns.qry.name": "nexus.officeapps.live.com", "dns.qry.type": "1" } }, { "event_id": "evt-4e035e1c0f3c3e0ff425cf54", "kind": "dns", "frame_number": 8182, "timestamp_epoch": "1631318520.437836000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 53, "dst_port": 52559, "tcp_stream": null, "udp_stream": 86, "fields": { "dns.a": "52.109.8.22", "dns.cname": "prod-w.nexus.live.com.akadns.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "nexus.officeapps.live.com", "dns.qry.type": "1" } }, { "event_id": "evt-4918d63a6c7c5c5b1b874501", "kind": "dns", "frame_number": 8313, "timestamp_epoch": "1631318792.332434000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 63264, "dst_port": 53, "tcp_stream": null, "udp_stream": 87, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.angrypoutine.com", "dns.qry.type": "1" } }, { "event_id": "evt-8a64aff14effefd99ac4736b", "kind": "dns", "frame_number": 8314, "timestamp_epoch": "1631318792.332716000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 53, "dst_port": 63264, "tcp_stream": null, "udp_stream": 87, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.angrypoutine.com", "dns.qry.type": "1" } }, { "event_id": "evt-d55c6b6956abbe593826af40", "kind": "dns", "frame_number": 8315, "timestamp_epoch": "1631318792.421558000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 63264, "dst_port": 53, "tcp_stream": null, "udp_stream": 87, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.angrypoutine.com", "dns.qry.type": "1" } }, { "event_id": "evt-029a65f6a03c5f4914e75e97", "kind": "dns", "frame_number": 8316, "timestamp_epoch": "1631318792.421801000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 53, "dst_port": 63264, "tcp_stream": null, "udp_stream": 87, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.angrypoutine.com", "dns.qry.type": "1" } }, { "event_id": "evt-dc8034db55bb8193ff47853a", "kind": "dns", "frame_number": 8336, "timestamp_epoch": "1631318944.952875000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 54999, "dst_port": 53, "tcp_stream": null, "udp_stream": 88, "fields": { "dns.flags.response": "False", "dns.qry.name": "update.googleapis.com", "dns.qry.type": "1" } }, { "event_id": "evt-671d0932eb58bea53f459af2", "kind": "dns", "frame_number": 8337, "timestamp_epoch": "1631318945.033622000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 54999, "dst_port": 53, "tcp_stream": null, "udp_stream": 88, "fields": { "dns.flags.response": "False", "dns.qry.name": "update.googleapis.com", "dns.qry.type": "1" } }, { "event_id": "evt-4163a77ca23812bcbb6a5d1e", "kind": "dns", "frame_number": 8338, "timestamp_epoch": "1631318945.200916000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 53, "dst_port": 54999, "tcp_stream": null, "udp_stream": 88, "fields": { "dns.a": "172.217.168.195", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "update.googleapis.com", "dns.qry.type": "1" } }, { "event_id": "evt-a80a012eb029393f1ad74031", "kind": "dns", "frame_number": 8375, "timestamp_epoch": "1631318967.344045000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 54270, "dst_port": 53, "tcp_stream": null, "udp_stream": 89, "fields": { "dns.flags.response": "False", "dns.qry.name": "settings-win.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-a65de46b039d449e658c524e", "kind": "dns", "frame_number": 8376, "timestamp_epoch": "1631318967.344347000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 53, "dst_port": 54270, "tcp_stream": null, "udp_stream": 89, "fields": { "dns.a": "52.137.106.217", "dns.cname": "settingsfd-geo.trafficmanager.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "settings-win.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-873860372526f91bd08974ff", "kind": "dns", "frame_number": 8397, "timestamp_epoch": "1631318972.337134000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 62545, "dst_port": 53, "tcp_stream": null, "udp_stream": 90, "fields": { "dns.flags.response": "False", "dns.qry.name": "login.live.com", "dns.qry.type": "1" } }, { "event_id": "evt-8443dedf680faed6e35a97f7", "kind": "dns", "frame_number": 8398, "timestamp_epoch": "1631318972.424007000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 62545, "dst_port": 53, "tcp_stream": null, "udp_stream": 90, "fields": { "dns.flags.response": "False", "dns.qry.name": "login.live.com", "dns.qry.type": "1" } }, { "event_id": "evt-c206fe20e4ae2606829c824e", "kind": "dns", "frame_number": 8399, "timestamp_epoch": "1631318972.821081000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 53, "dst_port": 62545, "tcp_stream": null, "udp_stream": 90, "fields": { "dns.a": "40.126.26.135,20.190.154.136,20.190.154.138,20.190.154.19,20.190.154.17,20.190.154.139,20.190.154.18,20.190.154.16", "dns.cname": "login.msa.msidentity.com,www.tm.lg.prod.aadmsa.akadns.net,prda.aadg.msidentity.com,www.tm.a.prd.aadg.akadns.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "login.live.com", "dns.qry.type": "1" } }, { "event_id": "evt-1215b04d49e7e041e35eadbe", "kind": "dns", "frame_number": 8441, "timestamp_epoch": "1631319034.384054000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 64727, "dst_port": 53, "tcp_stream": null, "udp_stream": 91, "fields": { "dns.flags.response": "False", "dns.qry.name": "ctldl.windowsupdate.com", "dns.qry.type": "1" } }, { "event_id": "evt-6182b907d037e5e108ba905c", "kind": "dns", "frame_number": 8442, "timestamp_epoch": "1631319034.468756000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 53, "dst_port": 64727, "tcp_stream": null, "udp_stream": 91, "fields": { "dns.a": "23.1.237.201,23.1.237.200", "dns.cname": "wu-shim.trafficmanager.net,download.windowsupdate.com.edgesuite.net,a767.dspw65.akamai.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "ctldl.windowsupdate.com", "dns.qry.type": "1" } }, { "event_id": "evt-a38de69dcf30c5a370f14e41", "kind": "dns", "frame_number": 8533, "timestamp_epoch": "1631319346.875565000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 60062, "dst_port": 53, "tcp_stream": null, "udp_stream": 92, "fields": { "dns.flags.response": "False", "dns.qry.name": "ANGRYPOUTINE-DC.angrypoutine.com", "dns.qry.type": "1" } }, { "event_id": "evt-7e20c4531c36dc214acc25ff", "kind": "dns", "frame_number": 8534, "timestamp_epoch": "1631319346.875848000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 53, "dst_port": 60062, "tcp_stream": null, "udp_stream": 92, "fields": { "dns.a": "10.9.10.9", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "ANGRYPOUTINE-DC.angrypoutine.com", "dns.qry.type": "1" } }, { "event_id": "evt-1bab6d2b5aec98a1cd39b1f6", "kind": "dns", "frame_number": 8535, "timestamp_epoch": "1631319346.962698000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 60062, "dst_port": 53, "tcp_stream": null, "udp_stream": 92, "fields": { "dns.flags.response": "False", "dns.qry.name": "ANGRYPOUTINE-DC.angrypoutine.com", "dns.qry.type": "1" } }, { "event_id": "evt-6300f2d3477074d44c2c066c", "kind": "dns", "frame_number": 8536, "timestamp_epoch": "1631319346.962976000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 53, "dst_port": 60062, "tcp_stream": null, "udp_stream": 92, "fields": { "dns.a": "10.9.10.9", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "ANGRYPOUTINE-DC.angrypoutine.com", "dns.qry.type": "1" } }, { "event_id": "evt-f78f6615e077d417602c026a", "kind": "dns", "frame_number": 8564, "timestamp_epoch": "1631319392.407001000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 49651, "dst_port": 53, "tcp_stream": null, "udp_stream": 93, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.angrypoutine.com", "dns.qry.type": "1" } }, { "event_id": "evt-e77aa0404ec5f32b41ab54a7", "kind": "dns", "frame_number": 8565, "timestamp_epoch": "1631319392.407330000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 53, "dst_port": 49651, "tcp_stream": null, "udp_stream": 93, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.angrypoutine.com", "dns.qry.type": "1" } }, { "event_id": "evt-40e4d2d56b39e233c9dd7ccf", "kind": "dns", "frame_number": 8654, "timestamp_epoch": "1631319727.188018000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 62827, "dst_port": 53, "tcp_stream": null, "udp_stream": 94, "fields": { "dns.flags.response": "False", "dns.qry.name": "v10.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-96fb011d77a8d2d0c1e020cc", "kind": "dns", "frame_number": 8655, "timestamp_epoch": "1631319727.265646000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 53, "dst_port": 62827, "tcp_stream": null, "udp_stream": 94, "fields": { "dns.a": "20.42.73.25", "dns.cname": "global.asimov.events.data.trafficmanager.net,onedscolprdeus06.eastus.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "v10.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-59cf71de0009dbc250aa30a3", "kind": "dns", "frame_number": 8681, "timestamp_epoch": "1631319740.661881000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 63280, "dst_port": 53, "tcp_stream": null, "udp_stream": 95, "fields": { "dns.flags.response": "False", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.angrypoutine.com", "dns.qry.type": "33" } }, { "event_id": "evt-074bd40a6274fb299de7d340", "kind": "dns", "frame_number": 8682, "timestamp_epoch": "1631319740.662210000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 53, "dst_port": 63280, "tcp_stream": null, "udp_stream": 95, "fields": { "dns.a": "10.9.10.9", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.angrypoutine.com", "dns.qry.type": "33" } }, { "event_id": "evt-14ec63b1e0e31bc219ef0def", "kind": "dns", "frame_number": 8825, "timestamp_epoch": "1631319992.455563000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 58376, "dst_port": 53, "tcp_stream": null, "udp_stream": 98, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.angrypoutine.com", "dns.qry.type": "1" } }, { "event_id": "evt-b93dc3a6225c4aa147b82b76", "kind": "dns", "frame_number": 8826, "timestamp_epoch": "1631319992.455953000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 53, "dst_port": 58376, "tcp_stream": null, "udp_stream": 98, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.angrypoutine.com", "dns.qry.type": "1" } }, { "event_id": "evt-587585e8b1fdd9c4c1a87b94", "kind": "dns", "frame_number": 8884, "timestamp_epoch": "1631320086.126109000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 59934, "dst_port": 53, "tcp_stream": null, "udp_stream": 99, "fields": { "dns.flags.response": "False", "dns.qry.name": "ANGRYPOUTINE-DC.angrypoutine.com", "dns.qry.type": "1" } }, { "event_id": "evt-8fd9f6fb960ecc837c50bbde", "kind": "dns", "frame_number": 8887, "timestamp_epoch": "1631320086.126452000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 53, "dst_port": 59934, "tcp_stream": null, "udp_stream": 99, "fields": { "dns.a": "10.9.10.9", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "ANGRYPOUTINE-DC.angrypoutine.com", "dns.qry.type": "1" } }, { "event_id": "evt-6e0e1928bee8219e9fc27a5f", "kind": "dns", "frame_number": 9203, "timestamp_epoch": "1631320315.976739000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 59775, "dst_port": 53, "tcp_stream": null, "udp_stream": 101, "fields": { "dns.flags.response": "False", "dns.qry.name": "nexus.officeapps.live.com", "dns.qry.type": "1" } }, { "event_id": "evt-22bf40a5987194ccaf559f7b", "kind": "dns", "frame_number": 9204, "timestamp_epoch": "1631320316.054404000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 53, "dst_port": 59775, "tcp_stream": null, "udp_stream": 101, "fields": { "dns.a": "52.109.8.25", "dns.cname": "prod-w.nexus.live.com.akadns.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "nexus.officeapps.live.com", "dns.qry.type": "1" } } ], "http_request": [ { "event_id": "evt-b6e1eeb620c1417ece0dc929", "kind": "http_request", "frame_number": 32, "timestamp_epoch": "1631315709.778075000", "src_ip": "10.9.10.102", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*" } }, { "event_id": "evt-2741c5bbc740c3c3f4825542", "kind": "http_request", "frame_number": 56, "timestamp_epoch": "1631315712.778108000", "src_ip": "10.9.10.102", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*" } }, { "event_id": "evt-8d1025c0c2a651eab4096e01", "kind": "http_request", "frame_number": 75, "timestamp_epoch": "1631315714.886095000", "src_ip": "10.9.10.102", "dst_ip": "96.17.68.66", "src_port": 58079, "dst_port": 80, "tcp_stream": 0, "udp_stream": null, "fields": { "http.host": "www.msftncsi.com", "http.request.full_uri": "http://www.msftncsi.com/ncsi.txt", "http.request.method": "GET", "http.request.uri": "/ncsi.txt", "http.response_in": "88", "http.user_agent": "Microsoft NCSI" } }, { "event_id": "evt-1bf1a49dbd8826f9f1d97689", "kind": "http_request", "frame_number": 93, "timestamp_epoch": "1631315715.057664000", "src_ip": "10.9.10.102", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*" } }, { "event_id": "evt-d4a460849baa5d0895ece1a2", "kind": "http_request", "frame_number": 106, "timestamp_epoch": "1631315715.781766000", "src_ip": "10.9.10.102", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*" } }, { "event_id": "evt-c3e745ab301b8ee9a54e8201", "kind": "http_request", "frame_number": 122, "timestamp_epoch": "1631315718.071278000", "src_ip": "10.9.10.102", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*" } }, { "event_id": "evt-91c4331d6acf4c55cf1f1f37", "kind": "http_request", "frame_number": 124, "timestamp_epoch": "1631315718.794423000", "src_ip": "10.9.10.102", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*" } }, { "event_id": "evt-50765db0a1ab0bd8316d8bb1", "kind": "http_request", "frame_number": 130, "timestamp_epoch": "1631315721.802832000", "src_ip": "10.9.10.102", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*" } }, { "event_id": "evt-7d0f4c4ed0bed47549d633ab", "kind": "http_request", "frame_number": 169, "timestamp_epoch": "1631315792.881017000", "src_ip": "10.9.10.102", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*" } }, { "event_id": "evt-873232c083de6207dafc6b0a", "kind": "http_request", "frame_number": 170, "timestamp_epoch": "1631315795.874381000", "src_ip": "10.9.10.102", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*" } }, { "event_id": "evt-a17771623403d716e2cd3457", "kind": "http_request", "frame_number": 234, "timestamp_epoch": "1631315798.880079000", "src_ip": "10.9.10.102", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*" } }, { "event_id": "evt-98b39b8cc63c8327d167d1b1", "kind": "http_request", "frame_number": 1189, "timestamp_epoch": "1631315847.822861000", "src_ip": "10.9.10.102", "dst_ip": "194.62.42.206", "src_port": 58131, "dst_port": 80, "tcp_stream": 50, "udp_stream": null, "fields": { "http.host": "simpsonsavingss.com", "http.request.full_uri": "http://simpsonsavingss.com/bmdff/BhoHsCtZ/MLdmpfjaX/5uFG3Dz7yt/date1?BNLv65=pAAS", "http.request.method": "GET", "http.request.uri": "/bmdff/BhoHsCtZ/MLdmpfjaX/5uFG3Dz7yt/date1?BNLv65=pAAS", "http.response_in": "1475", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)" } }, { "event_id": "evt-05a19eae14eb24effe92b8b1", "kind": "http_request", "frame_number": 2316, "timestamp_epoch": "1631315877.719270000", "src_ip": "10.9.10.102", "dst_ip": "23.3.85.202", "src_port": 58151, "dst_port": 80, "tcp_stream": 70, "udp_stream": null, "fields": { "http.host": "store-images.s-microsoft.com", "http.request.full_uri": "http://store-images.s-microsoft.com/image/apps.28261.13798539581762600.abe1643f-1704-4a4d-a61b-47ccc25da012.ada314ec-db8e-49bb-a756-60487526418e?w=150&h=150", "http.request.method": "GET", "http.request.uri": "/image/apps.28261.13798539581762600.abe1643f-1704-4a4d-a61b-47ccc25da012.ada314ec-db8e-49bb-a756-60487526418e?w=150&h=150", "http.response_in": "2333", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19043" } }, { "event_id": "evt-73e3b661205590b9bc4dba4d", "kind": "http_request", "frame_number": 2317, "timestamp_epoch": "1631315877.719308000", "src_ip": "10.9.10.102", "dst_ip": "23.3.85.202", "src_port": 58153, "dst_port": 80, "tcp_stream": 71, "udp_stream": null, "fields": { "http.host": "store-images.s-microsoft.com", "http.request.full_uri": "http://store-images.s-microsoft.com/image/apps.16525.14618985536919905.4b30e4f3-f7a1-4421-840c-2cc97b10e8e0.13409c3f-0e0f-40dd-b458-b324f658c185?w=150&h=150", "http.request.method": "GET", "http.request.uri": "/image/apps.16525.14618985536919905.4b30e4f3-f7a1-4421-840c-2cc97b10e8e0.13409c3f-0e0f-40dd-b458-b324f658c185?w=150&h=150", "http.response_in": "2395", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19043" } }, { "event_id": "evt-27b52f48065da5914fdc1353", "kind": "http_request", "frame_number": 2324, "timestamp_epoch": "1631315877.730580000", "src_ip": "10.9.10.102", "dst_ip": "23.3.85.202", "src_port": 58154, "dst_port": 80, "tcp_stream": 74, "udp_stream": null, "fields": { "http.host": "store-images.s-microsoft.com", "http.request.full_uri": "http://store-images.s-microsoft.com/image/apps.31617.13655054093851568.f2bf9430-60d7-4569-a50d-0f21c9ade6b3.c563d383-997d-4da1-9def-d7200e3547f8?w=150&h=150", "http.request.method": "GET", "http.request.uri": "/image/apps.31617.13655054093851568.f2bf9430-60d7-4569-a50d-0f21c9ade6b3.c563d383-997d-4da1-9def-d7200e3547f8?w=150&h=150", "http.response_in": "2403", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19043" } }, { "event_id": "evt-df5fee4af4223a7e06848d38", "kind": "http_request", "frame_number": 2325, "timestamp_epoch": "1631315877.731332000", "src_ip": "10.9.10.102", "dst_ip": "23.3.85.202", "src_port": 58155, "dst_port": 80, "tcp_stream": 73, "udp_stream": null, "fields": { "http.host": "store-images.s-microsoft.com", "http.request.full_uri": "http://store-images.s-microsoft.com/image/apps.11608.14255546098955437.c2922c50-eb00-4f80-b393-4e513d9f81c7.4345eb8f-f893-40a2-aec5-20f4758af165?w=150&h=150", "http.request.method": "GET", "http.request.uri": "/image/apps.11608.14255546098955437.c2922c50-eb00-4f80-b393-4e513d9f81c7.4345eb8f-f893-40a2-aec5-20f4758af165?w=150&h=150", "http.response_in": "2427", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19043" } }, { "event_id": "evt-c52150bc209b33a17265ac65", "kind": "http_request", "frame_number": 2327, "timestamp_epoch": "1631315877.731972000", "src_ip": "10.9.10.102", "dst_ip": "23.3.85.202", "src_port": 58152, "dst_port": 80, "tcp_stream": 72, "udp_stream": null, "fields": { "http.host": "store-images.s-microsoft.com", "http.request.full_uri": "http://store-images.s-microsoft.com/image/apps.40518.14127333176902609.7be7b901-15fe-4c27-863c-7c0dbfc26c5c.5c278f58-912b-4af9-88f8-a65fff2da477?w=150&h=150", "http.request.method": "GET", "http.request.uri": "/image/apps.40518.14127333176902609.7be7b901-15fe-4c27-863c-7c0dbfc26c5c.5c278f58-912b-4af9-88f8-a65fff2da477?w=150&h=150", "http.response_in": "2454", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19043" } }, { "event_id": "evt-d318ba06dfcd17bd2ef4cdb9", "kind": "http_request", "frame_number": 2353, "timestamp_epoch": "1631315877.886858000", "src_ip": "10.9.10.102", "dst_ip": "23.3.85.202", "src_port": 58156, "dst_port": 80, "tcp_stream": 75, "udp_stream": null, "fields": { "http.host": "store-images.s-microsoft.com", "http.request.full_uri": "http://store-images.s-microsoft.com/image/apps.16999.13510798885065391.a43a9782-6060-4560-b391-7f6f188559d0.dc15b6ee-644d-41e3-8d76-67c8c9dac9e9?w=150&h=225", "http.request.method": "GET", "http.request.uri": "/image/apps.16999.13510798885065391.a43a9782-6060-4560-b391-7f6f188559d0.dc15b6ee-644d-41e3-8d76-67c8c9dac9e9?w=150&h=225", "http.response_in": "2453", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19043" } }, { "event_id": "evt-133bf41e0a4b434610234ca7", "kind": "http_request", "frame_number": 3241, "timestamp_epoch": "1631316277.088208000", "src_ip": "10.9.10.102", "dst_ip": "23.1.237.200", "src_port": 58174, "dst_port": 80, "tcp_stream": 93, "udp_stream": null, "fields": { "http.host": "download.windowsupdate.com", "http.request.full_uri": "http://download.windowsupdate.com/c/msdownload/update/others/2021/09/35095402_3a3af9d09b295d5cad27c058b669144408fd1987.cab", "http.request.method": "GET", "http.request.uri": "/c/msdownload/update/others/2021/09/35095402_3a3af9d09b295d5cad27c058b669144408fd1987.cab", "http.response_in": "3252", "http.user_agent": "Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.32" } }, { "event_id": "evt-ce68399d0431628fc866c863", "kind": "http_request", "frame_number": 3254, "timestamp_epoch": "1631316277.171165000", "src_ip": "10.9.10.102", "dst_ip": "23.1.237.200", "src_port": 58174, "dst_port": 80, "tcp_stream": 93, "udp_stream": null, "fields": { "http.host": "download.windowsupdate.com", "http.request.full_uri": "http://download.windowsupdate.com/c/msdownload/update/others/2021/09/35095401_461f0f3035a629e02f33b5439ab5d58c4e45c62f.cab", "http.request.method": "GET", "http.request.uri": "/c/msdownload/update/others/2021/09/35095401_461f0f3035a629e02f33b5439ab5d58c4e45c62f.cab", "http.response_in": "3261", "http.user_agent": "Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.32" } }, { "event_id": "evt-3d810fcaaeb0dc3256c29a9a", "kind": "http_request", "frame_number": 3263, "timestamp_epoch": "1631316277.250235000", "src_ip": "10.9.10.102", "dst_ip": "23.1.237.200", "src_port": 58174, "dst_port": 80, "tcp_stream": 93, "udp_stream": null, "fields": { "http.host": "download.windowsupdate.com", "http.request.full_uri": "http://download.windowsupdate.com/c/msdownload/update/others/2021/09/35095042_571a24bf1c59b2fc66012aba76936bc63860b918.cab", "http.request.method": "GET", "http.request.uri": "/c/msdownload/update/others/2021/09/35095042_571a24bf1c59b2fc66012aba76936bc63860b918.cab", "http.response_in": "3270", "http.user_agent": "Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.32" } }, { "event_id": "evt-757cf6011e62c181a7d9b34d", "kind": "http_request", "frame_number": 3272, "timestamp_epoch": "1631316277.331910000", "src_ip": "10.9.10.102", "dst_ip": "23.1.237.200", "src_port": 58174, "dst_port": 80, "tcp_stream": 93, "udp_stream": null, "fields": { "http.host": "download.windowsupdate.com", "http.request.full_uri": "http://download.windowsupdate.com/c/msdownload/update/others/2021/09/35095041_d6fbe7dcab58bad491f97a8fb16f67acdd9c5880.cab", "http.request.method": "GET", "http.request.uri": "/c/msdownload/update/others/2021/09/35095041_d6fbe7dcab58bad491f97a8fb16f67acdd9c5880.cab", "http.response_in": "3282", "http.user_agent": "Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.32" } }, { "event_id": "evt-f1ce49d4451115b359a6fcf1", "kind": "http_request", "frame_number": 3284, "timestamp_epoch": "1631316277.422407000", "src_ip": "10.9.10.102", "dst_ip": "23.1.237.200", "src_port": 58174, "dst_port": 80, "tcp_stream": 93, "udp_stream": null, "fields": { "http.host": "download.windowsupdate.com", "http.request.full_uri": "http://download.windowsupdate.com/c/msdownload/update/others/2021/09/35094711_e3993b23840c0d600179f647e9ac08158269c095.cab", "http.request.method": "GET", "http.request.uri": "/c/msdownload/update/others/2021/09/35094711_e3993b23840c0d600179f647e9ac08158269c095.cab", "http.response_in": "3292", "http.user_agent": "Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.32" } }, { "event_id": "evt-ed29dce774b7ede9e7485a8d", "kind": "http_request", "frame_number": 3294, "timestamp_epoch": "1631316277.503154000", "src_ip": "10.9.10.102", "dst_ip": "23.1.237.200", "src_port": 58174, "dst_port": 80, "tcp_stream": 93, "udp_stream": null, "fields": { "http.host": "download.windowsupdate.com", "http.request.full_uri": "http://download.windowsupdate.com/c/msdownload/update/others/2021/09/35094710_046a1ec2fc584f3c2f6653542576b125ec45b91b.cab", "http.request.method": "GET", "http.request.uri": "/c/msdownload/update/others/2021/09/35094710_046a1ec2fc584f3c2f6653542576b125ec45b91b.cab", "http.response_in": "3301", "http.user_agent": "Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.32" } }, { "event_id": "evt-3b8ff1525724fc6d9d41d3a6", "kind": "http_request", "frame_number": 3303, "timestamp_epoch": "1631316277.580403000", "src_ip": "10.9.10.102", "dst_ip": "23.1.237.200", "src_port": 58174, "dst_port": 80, "tcp_stream": 93, "udp_stream": null, "fields": { "http.host": "download.windowsupdate.com", "http.request.full_uri": "http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35098229_d9a668acd9af16621c688b823ada2c10de963ca4.cab", "http.request.method": "GET", "http.request.uri": "/d/msdownload/update/others/2021/09/35098229_d9a668acd9af16621c688b823ada2c10de963ca4.cab", "http.response_in": "3318", "http.user_agent": "Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.32" } }, { "event_id": "evt-b138d54e0b5ef451cc62330d", "kind": "http_request", "frame_number": 3320, "timestamp_epoch": "1631316277.672274000", "src_ip": "10.9.10.102", "dst_ip": "23.1.237.200", "src_port": 58174, "dst_port": 80, "tcp_stream": 93, "udp_stream": null, "fields": { "http.host": "download.windowsupdate.com", "http.request.full_uri": "http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35097869_11f02196bd92ebd3ff0745749654d98eb8ddd58c.cab", "http.request.method": "GET", "http.request.uri": "/d/msdownload/update/others/2021/09/35097869_11f02196bd92ebd3ff0745749654d98eb8ddd58c.cab", "http.response_in": "3334", "http.user_agent": "Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.32" } }, { "event_id": "evt-6226f4a2c97336ec9e9fa791", "kind": "http_request", "frame_number": 3336, "timestamp_epoch": "1631316277.754272000", "src_ip": "10.9.10.102", "dst_ip": "23.1.237.200", "src_port": 58174, "dst_port": 80, "tcp_stream": 93, "udp_stream": null, "fields": { "http.host": "download.windowsupdate.com", "http.request.full_uri": "http://download.windowsupdate.com/c/msdownload/update/others/2021/09/35097541_59453a64ae1a0f59447d0c4e4bae68350827ad3f.cab", "http.request.method": "GET", "http.request.uri": "/c/msdownload/update/others/2021/09/35097541_59453a64ae1a0f59447d0c4e4bae68350827ad3f.cab", "http.response_in": "3350", "http.user_agent": "Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.32" } }, { "event_id": "evt-acf99ee32f6db99263d10dda", "kind": "http_request", "frame_number": 3351, "timestamp_epoch": "1631316277.844148000", "src_ip": "10.9.10.102", "dst_ip": "23.1.237.200", "src_port": 58174, "dst_port": 80, "tcp_stream": 93, "udp_stream": null, "fields": { "http.host": "download.windowsupdate.com", "http.request.full_uri": "http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35097188_47bf5b9e41cf731eeaf7b93672b38948c413df0b.cab", "http.request.method": "GET", "http.request.uri": "/d/msdownload/update/others/2021/09/35097188_47bf5b9e41cf731eeaf7b93672b38948c413df0b.cab", "http.response_in": "3365", "http.user_agent": "Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.32" } }, { "event_id": "evt-fa49d04114c978aea5f40bfe", "kind": "http_request", "frame_number": 3366, "timestamp_epoch": "1631316277.936391000", "src_ip": "10.9.10.102", "dst_ip": "23.1.237.200", "src_port": 58174, "dst_port": 80, "tcp_stream": 93, "udp_stream": null, "fields": { "http.host": "download.windowsupdate.com", "http.request.full_uri": "http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35096864_51f3f34383a28a4d5d63528d9978515e66a6806e.cab", "http.request.method": "GET", "http.request.uri": "/d/msdownload/update/others/2021/09/35096864_51f3f34383a28a4d5d63528d9978515e66a6806e.cab", "http.response_in": "3380", "http.user_agent": "Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.32" } }, { "event_id": "evt-74159f4376270d00dbd8ac30", "kind": "http_request", "frame_number": 3381, "timestamp_epoch": "1631316278.041138000", "src_ip": "10.9.10.102", "dst_ip": "23.1.237.200", "src_port": 58174, "dst_port": 80, "tcp_stream": 93, "udp_stream": null, "fields": { "http.host": "download.windowsupdate.com", "http.request.full_uri": "http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35096518_246960552fd8974bcfe0af13e362f8d00f0c6046.cab", "http.request.method": "GET", "http.request.uri": "/d/msdownload/update/others/2021/09/35096518_246960552fd8974bcfe0af13e362f8d00f0c6046.cab", "http.response_in": "3393", "http.user_agent": "Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.32" } }, { "event_id": "evt-10c01f64bd1d44d19091da24", "kind": "http_request", "frame_number": 3394, "timestamp_epoch": "1631316278.130092000", "src_ip": "10.9.10.102", "dst_ip": "23.1.237.200", "src_port": 58174, "dst_port": 80, "tcp_stream": 93, "udp_stream": null, "fields": { "http.host": "download.windowsupdate.com", "http.request.full_uri": "http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35096188_49a74f42962e10ef9cfa9492f2c1955c24967958.cab", "http.request.method": "GET", "http.request.uri": "/d/msdownload/update/others/2021/09/35096188_49a74f42962e10ef9cfa9492f2c1955c24967958.cab", "http.response_in": "3405", "http.user_agent": "Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.32" } }, { "event_id": "evt-211788c34d7653f781ccfa6a", "kind": "http_request", "frame_number": 3407, "timestamp_epoch": "1631316278.212132000", "src_ip": "10.9.10.102", "dst_ip": "23.1.237.200", "src_port": 58174, "dst_port": 80, "tcp_stream": 93, "udp_stream": null, "fields": { "http.host": "download.windowsupdate.com", "http.request.full_uri": "http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35095828_d42aac61fe6047b9b6b654db9d5c9ae957613125.cab", "http.request.method": "GET", "http.request.uri": "/d/msdownload/update/others/2021/09/35095828_d42aac61fe6047b9b6b654db9d5c9ae957613125.cab", "http.response_in": "3419", "http.user_agent": "Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.32" } }, { "event_id": "evt-cbee6f2f9a4ff5f6c112df60", "kind": "http_request", "frame_number": 3421, "timestamp_epoch": "1631316278.664748000", "src_ip": "10.9.10.102", "dst_ip": "23.1.237.200", "src_port": 58174, "dst_port": 80, "tcp_stream": 93, "udp_stream": null, "fields": { "http.host": "download.windowsupdate.com", "http.request.full_uri": "http://download.windowsupdate.com/c/msdownload/update/others/2021/09/35095511_08bd8b8ea97b82600094601b9451b7fa9b028927.cab", "http.request.method": "GET", "http.request.uri": "/c/msdownload/update/others/2021/09/35095511_08bd8b8ea97b82600094601b9451b7fa9b028927.cab", "http.response_in": "3434", "http.user_agent": "Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.32" } }, { "event_id": "evt-d98bb03781f5a89d97a18a01", "kind": "http_request", "frame_number": 3435, "timestamp_epoch": "1631316278.755365000", "src_ip": "10.9.10.102", "dst_ip": "23.1.237.200", "src_port": 58174, "dst_port": 80, "tcp_stream": 93, "udp_stream": null, "fields": { "http.host": "download.windowsupdate.com", "http.request.full_uri": "http://download.windowsupdate.com/c/msdownload/update/others/2021/09/35095158_9a369166024cd2046a41b3fcf5a7d5743d20b1f8.cab", "http.request.method": "GET", "http.request.uri": "/c/msdownload/update/others/2021/09/35095158_9a369166024cd2046a41b3fcf5a7d5743d20b1f8.cab", "http.response_in": "3447", "http.user_agent": "Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.32" } }, { "event_id": "evt-c446d06fb018a8feeb23740d", "kind": "http_request", "frame_number": 3448, "timestamp_epoch": "1631316278.843113000", "src_ip": "10.9.10.102", "dst_ip": "23.1.237.200", "src_port": 58174, "dst_port": 80, "tcp_stream": 93, "udp_stream": null, "fields": { "http.host": "download.windowsupdate.com", "http.request.full_uri": "http://download.windowsupdate.com/c/msdownload/update/others/2021/09/35094827_769ef074432ee9d2982132709c97d7a039b1441d.cab", "http.request.method": "GET", "http.request.uri": "/c/msdownload/update/others/2021/09/35094827_769ef074432ee9d2982132709c97d7a039b1441d.cab", "http.response_in": "3460", "http.user_agent": "Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.32" } }, { "event_id": "evt-a4f797c08637bff7d1c77cae", "kind": "http_request", "frame_number": 3560, "timestamp_epoch": "1631316279.506042000", "src_ip": "10.9.10.102", "dst_ip": "23.1.237.200", "src_port": 58174, "dst_port": 80, "tcp_stream": 93, "udp_stream": null, "fields": { "http.host": "download.windowsupdate.com", "http.request.full_uri": "http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35096402_83d0bc9d8970cab311753b171496293c4e0588b8.cab", "http.request.method": "GET", "http.request.uri": "/d/msdownload/update/others/2021/09/35096402_83d0bc9d8970cab311753b171496293c4e0588b8.cab", "http.response_in": "3567", "http.user_agent": "Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.32" } }, { "event_id": "evt-36985a9754b159dc98c52a3b", "kind": "http_request", "frame_number": 3570, "timestamp_epoch": "1631316279.596839000", "src_ip": "10.9.10.102", "dst_ip": "23.1.237.200", "src_port": 58174, "dst_port": 80, "tcp_stream": 93, "udp_stream": null, "fields": { "http.host": "download.windowsupdate.com", "http.request.full_uri": "http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35096401_980e49644362fb40897606d01fddd1ef79c6702a.cab", "http.request.method": "GET", "http.request.uri": "/d/msdownload/update/others/2021/09/35096401_980e49644362fb40897606d01fddd1ef79c6702a.cab", "http.response_in": "3578", "http.user_agent": "Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.32" } }, { "event_id": "evt-d1fbf33fcac2d54cb5c0eb7f", "kind": "http_request", "frame_number": 3580, "timestamp_epoch": "1631316279.689712000", "src_ip": "10.9.10.102", "dst_ip": "23.1.237.200", "src_port": 58174, "dst_port": 80, "tcp_stream": 93, "udp_stream": null, "fields": { "http.host": "download.windowsupdate.com", "http.request.full_uri": "http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35096072_5331372f4a198d80f7a5602f73259ff77d004730.cab", "http.request.method": "GET", "http.request.uri": "/d/msdownload/update/others/2021/09/35096072_5331372f4a198d80f7a5602f73259ff77d004730.cab", "http.response_in": "3587", "http.user_agent": "Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.32" } }, { "event_id": "evt-2f91d28cc17de35e91527465", "kind": "http_request", "frame_number": 3590, "timestamp_epoch": "1631316279.787458000", "src_ip": "10.9.10.102", "dst_ip": "23.1.237.200", "src_port": 58174, "dst_port": 80, "tcp_stream": 93, "udp_stream": null, "fields": { "http.host": "download.windowsupdate.com", "http.request.full_uri": "http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35096071_6f89138c772d9cca2cda43656eecab96a5cd44fc.cab", "http.request.method": "GET", "http.request.uri": "/d/msdownload/update/others/2021/09/35096071_6f89138c772d9cca2cda43656eecab96a5cd44fc.cab", "http.response_in": "3597", "http.user_agent": "Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.32" } }, { "event_id": "evt-c1043cee94fca24a23984e34", "kind": "http_request", "frame_number": 3599, "timestamp_epoch": "1631316279.862456000", "src_ip": "10.9.10.102", "dst_ip": "23.1.237.200", "src_port": 58174, "dst_port": 80, "tcp_stream": 93, "udp_stream": null, "fields": { "http.host": "download.windowsupdate.com", "http.request.full_uri": "http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35095719_bb98167530418ae8aa387c077bca2d54e52a227b.cab", "http.request.method": "GET", "http.request.uri": "/d/msdownload/update/others/2021/09/35095719_bb98167530418ae8aa387c077bca2d54e52a227b.cab", "http.response_in": "3606", "http.user_agent": "Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.32" } }, { "event_id": "evt-08876d783916f61c2ac5b827", "kind": "http_request", "frame_number": 3608, "timestamp_epoch": "1631316279.948828000", "src_ip": "10.9.10.102", "dst_ip": "23.1.237.200", "src_port": 58174, "dst_port": 80, "tcp_stream": 93, "udp_stream": null, "fields": { "http.host": "download.windowsupdate.com", "http.request.full_uri": "http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35095718_d6052d2a18efec5d0584f7d9db0c6df36c871e5e.cab", "http.request.method": "GET", "http.request.uri": "/d/msdownload/update/others/2021/09/35095718_d6052d2a18efec5d0584f7d9db0c6df36c871e5e.cab", "http.response_in": "3615", "http.user_agent": "Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.32" } }, { "event_id": "evt-cdbe2064390b7d0409b72dfd", "kind": "http_request", "frame_number": 3712, "timestamp_epoch": "1631316280.475562000", "src_ip": "10.9.10.102", "dst_ip": "23.1.237.200", "src_port": 58174, "dst_port": 80, "tcp_stream": 93, "udp_stream": null, "fields": { "http.host": "download.windowsupdate.com", "http.request.full_uri": "http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35097072_9c18abaa0dd4f3355c05cb1e0ac0d0a1da10552a.cab", "http.request.method": "GET", "http.request.uri": "/d/msdownload/update/others/2021/09/35097072_9c18abaa0dd4f3355c05cb1e0ac0d0a1da10552a.cab", "http.response_in": "3719", "http.user_agent": "Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.32" } }, { "event_id": "evt-cee7c9886490707b0361d7d7", "kind": "http_request", "frame_number": 3721, "timestamp_epoch": "1631316280.553685000", "src_ip": "10.9.10.102", "dst_ip": "23.1.237.200", "src_port": 58174, "dst_port": 80, "tcp_stream": 93, "udp_stream": null, "fields": { "http.host": "download.windowsupdate.com", "http.request.full_uri": "http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35097071_01580b64b700158e52507faa6223a4cb41c43f05.cab", "http.request.method": "GET", "http.request.uri": "/d/msdownload/update/others/2021/09/35097071_01580b64b700158e52507faa6223a4cb41c43f05.cab", "http.response_in": "3728", "http.user_agent": "Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.32" } }, { "event_id": "evt-81c7ab0bf598703cdc9770a5", "kind": "http_request", "frame_number": 3730, "timestamp_epoch": "1631316280.648306000", "src_ip": "10.9.10.102", "dst_ip": "23.1.237.200", "src_port": 58174, "dst_port": 80, "tcp_stream": 93, "udp_stream": null, "fields": { "http.host": "download.windowsupdate.com", "http.request.full_uri": "http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35096748_a533dd985a0175649c16855a9c628da8f21d78da.cab", "http.request.method": "GET", "http.request.uri": "/d/msdownload/update/others/2021/09/35096748_a533dd985a0175649c16855a9c628da8f21d78da.cab", "http.response_in": "3737", "http.user_agent": "Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.32" } }, { "event_id": "evt-46447fa0bfb62c8dfe9938c2", "kind": "http_request", "frame_number": 3739, "timestamp_epoch": "1631316280.730429000", "src_ip": "10.9.10.102", "dst_ip": "23.1.237.200", "src_port": 58174, "dst_port": 80, "tcp_stream": 93, "udp_stream": null, "fields": { "http.host": "download.windowsupdate.com", "http.request.full_uri": "http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35096747_f2ef0a3546df9b0fe01091e8cf6244c2b18ad27a.cab", "http.request.method": "GET", "http.request.uri": "/d/msdownload/update/others/2021/09/35096747_f2ef0a3546df9b0fe01091e8cf6244c2b18ad27a.cab", "http.response_in": "3746", "http.user_agent": "Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.32" } }, { "event_id": "evt-831545ed524978b4f84cf57b", "kind": "http_request", "frame_number": 3849, "timestamp_epoch": "1631316281.299411000", "src_ip": "10.9.10.102", "dst_ip": "23.1.237.200", "src_port": 58174, "dst_port": 80, "tcp_stream": 93, "udp_stream": null, "fields": { "http.host": "download.windowsupdate.com", "http.request.full_uri": "http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35098113_ea9c1c8bf8003ad3b08ee004e09ae3bbf5fb1456.cab", "http.request.method": "GET", "http.request.uri": "/d/msdownload/update/others/2021/09/35098113_ea9c1c8bf8003ad3b08ee004e09ae3bbf5fb1456.cab", "http.response_in": "3856", "http.user_agent": "Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.32" } }, { "event_id": "evt-5ae84b19e08a3be4bd0ebf58", "kind": "http_request", "frame_number": 3858, "timestamp_epoch": "1631316281.384283000", "src_ip": "10.9.10.102", "dst_ip": "23.1.237.200", "src_port": 58174, "dst_port": 80, "tcp_stream": 93, "udp_stream": null, "fields": { "http.host": "download.windowsupdate.com", "http.request.full_uri": "http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35098112_e6ce21ecdf7d899a6a8671574b68871ce853efe6.cab", "http.request.method": "GET", "http.request.uri": "/d/msdownload/update/others/2021/09/35098112_e6ce21ecdf7d899a6a8671574b68871ce853efe6.cab", "http.response_in": "3866", "http.user_agent": "Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.32" } }, { "event_id": "evt-d7be675dceb01d22ec8d0b7f", "kind": "http_request", "frame_number": 3868, "timestamp_epoch": "1631316281.470656000", "src_ip": "10.9.10.102", "dst_ip": "23.1.237.200", "src_port": 58174, "dst_port": 80, "tcp_stream": 93, "udp_stream": null, "fields": { "http.host": "download.windowsupdate.com", "http.request.full_uri": "http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35097760_94afc464b79c1922edc5d9f1aa46b8bbdafcac27.cab", "http.request.method": "GET", "http.request.uri": "/d/msdownload/update/others/2021/09/35097760_94afc464b79c1922edc5d9f1aa46b8bbdafcac27.cab", "http.response_in": "3875", "http.user_agent": "Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.32" } }, { "event_id": "evt-c81f4d47032b6988491546e6", "kind": "http_request", "frame_number": 3878, "timestamp_epoch": "1631316281.553403000", "src_ip": "10.9.10.102", "dst_ip": "23.1.237.200", "src_port": 58174, "dst_port": 80, "tcp_stream": 93, "udp_stream": null, "fields": { "http.host": "download.windowsupdate.com", "http.request.full_uri": "http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35097759_f51781226900f2c3a24cac0d25d7e32ce4232b12.cab", "http.request.method": "GET", "http.request.uri": "/d/msdownload/update/others/2021/09/35097759_f51781226900f2c3a24cac0d25d7e32ce4232b12.cab", "http.response_in": "3886", "http.user_agent": "Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.32" } }, { "event_id": "evt-433b1ceb7dd824880cf675a7", "kind": "http_request", "frame_number": 3888, "timestamp_epoch": "1631316281.632651000", "src_ip": "10.9.10.102", "dst_ip": "23.1.237.200", "src_port": 58174, "dst_port": 80, "tcp_stream": 93, "udp_stream": null, "fields": { "http.host": "download.windowsupdate.com", "http.request.full_uri": "http://download.windowsupdate.com/c/msdownload/update/others/2021/09/35097432_b4cbace49a072b37958e15b9d3daadf28c89f361.cab", "http.request.method": "GET", "http.request.uri": "/c/msdownload/update/others/2021/09/35097432_b4cbace49a072b37958e15b9d3daadf28c89f361.cab", "http.response_in": "3896", "http.user_agent": "Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.32" } }, { "event_id": "evt-985500b065385a1eb7d59511", "kind": "http_request", "frame_number": 3898, "timestamp_epoch": "1631316281.715475000", "src_ip": "10.9.10.102", "dst_ip": "23.1.237.200", "src_port": 58174, "dst_port": 80, "tcp_stream": 93, "udp_stream": null, "fields": { "http.host": "download.windowsupdate.com", "http.request.full_uri": "http://download.windowsupdate.com/c/msdownload/update/others/2021/09/35097431_5695ed6029065d034bdbaa6edef143ec73f43570.cab", "http.request.method": "GET", "http.request.uri": "/c/msdownload/update/others/2021/09/35097431_5695ed6029065d034bdbaa6edef143ec73f43570.cab", "http.response_in": "3905", "http.user_agent": "Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.32" } }, { "event_id": "evt-27e3697267801148b884f264", "kind": "http_request", "frame_number": 4193, "timestamp_epoch": "1631316288.773365000", "src_ip": "10.9.10.102", "dst_ip": "23.1.237.216", "src_port": 58181, "dst_port": 80, "tcp_stream": 100, "udp_stream": null, "fields": { "http.content_length": "0", "http.host": "au.download.windowsupdate.com", "http.request.full_uri": "http://au.download.windowsupdate.com/d/msdownload/update/software/defu/2021/09/am_delta_patch_1.349.439.0_dcf977cccce1b58289d270f71f8151b3acc1566b.exe", "http.request.method": "GET", "http.request.uri": "/d/msdownload/update/software/defu/2021/09/am_delta_patch_1.349.439.0_dcf977cccce1b58289d270f71f8151b3acc1566b.exe", "http.response_in": "4198", "http.user_agent": "Microsoft-Delivery-Optimization/10.0" } }, { "event_id": "evt-42cb4eecc10541c1271ac812", "kind": "http_request", "frame_number": 4195, "timestamp_epoch": "1631316288.774253000", "src_ip": "10.9.10.102", "dst_ip": "23.1.237.225", "src_port": 58182, "dst_port": 80, "tcp_stream": 101, "udp_stream": null, "fields": { "http.content_length": "0", "http.host": "au.download.windowsupdate.com", "http.request.full_uri": "http://au.download.windowsupdate.com/d/msdownload/update/software/defu/2021/09/am_delta_patch_1.349.439.0_dcf977cccce1b58289d270f71f8151b3acc1566b.exe", "http.request.method": "GET", "http.request.uri": "/d/msdownload/update/software/defu/2021/09/am_delta_patch_1.349.439.0_dcf977cccce1b58289d270f71f8151b3acc1566b.exe", "http.response_in": "4199", "http.user_agent": "Microsoft-Delivery-Optimization/10.0" } }, { "event_id": "evt-7474a5edd29a4ff9f7dc87cf", "kind": "http_request", "frame_number": 4200, "timestamp_epoch": "1631316288.853317000", "src_ip": "10.9.10.102", "dst_ip": "23.1.237.216", "src_port": 58181, "dst_port": 80, "tcp_stream": 100, "udp_stream": null, "fields": { "http.content_length": "0", "http.host": "au.download.windowsupdate.com", "http.request.full_uri": "http://au.download.windowsupdate.com/d/msdownload/update/software/defu/2021/09/am_delta_patch_1.349.439.0_dcf977cccce1b58289d270f71f8151b3acc1566b.exe", "http.request.method": "GET", "http.request.uri": "/d/msdownload/update/software/defu/2021/09/am_delta_patch_1.349.439.0_dcf977cccce1b58289d270f71f8151b3acc1566b.exe", "http.response_in": "6404", "http.user_agent": "Microsoft-Delivery-Optimization/10.0" } }, { "event_id": "evt-af5b397153cec8107d3ea8ae", "kind": "http_request", "frame_number": 4201, "timestamp_epoch": "1631316288.853479000", "src_ip": "10.9.10.102", "dst_ip": "23.1.237.225", "src_port": 58182, "dst_port": 80, "tcp_stream": 101, "udp_stream": null, "fields": { "http.content_length": "0", "http.host": "au.download.windowsupdate.com", "http.request.full_uri": "http://au.download.windowsupdate.com/d/msdownload/update/software/defu/2021/09/am_delta_patch_1.349.439.0_dcf977cccce1b58289d270f71f8151b3acc1566b.exe", "http.request.method": "GET", "http.request.uri": "/d/msdownload/update/software/defu/2021/09/am_delta_patch_1.349.439.0_dcf977cccce1b58289d270f71f8151b3acc1566b.exe", "http.response_in": "6356", "http.user_agent": "Microsoft-Delivery-Optimization/10.0" } }, { "event_id": "evt-8289bb39e5827fd4252a16e5", "kind": "http_request", "frame_number": 6371, "timestamp_epoch": "1631316290.377646000", "src_ip": "10.9.10.102", "dst_ip": "23.1.237.225", "src_port": 58182, "dst_port": 80, "tcp_stream": 101, "udp_stream": null, "fields": { "http.content_length": "0", "http.host": "au.download.windowsupdate.com", "http.request.full_uri": "http://au.download.windowsupdate.com/d/msdownload/update/software/defu/2021/09/am_delta_patch_1.349.439.0_dcf977cccce1b58289d270f71f8151b3acc1566b.exe", "http.request.method": "GET", "http.request.uri": "/d/msdownload/update/software/defu/2021/09/am_delta_patch_1.349.439.0_dcf977cccce1b58289d270f71f8151b3acc1566b.exe", "http.response_in": "7346", "http.user_agent": "Microsoft-Delivery-Optimization/10.0" } }, { "event_id": "evt-adbda130b1802899cd5ebea3", "kind": "http_request", "frame_number": 8446, "timestamp_epoch": "1631319034.703114000", "src_ip": "10.9.10.102", "dst_ip": "23.1.237.201", "src_port": 58218, "dst_port": 80, "tcp_stream": 137, "udp_stream": null, "fields": { "http.host": "ctldl.windowsupdate.com", "http.request.full_uri": "http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?8afe60e61b27f828", "http.request.method": "GET", "http.request.uri": "/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?8afe60e61b27f828", "http.response_in": "8448", "http.user_agent": "Microsoft-CryptoAPI/10.0" } }, { "event_id": "evt-a87d19e5a814df713a0531fe", "kind": "http_request", "frame_number": 8449, "timestamp_epoch": "1631319034.835713000", "src_ip": "10.9.10.102", "dst_ip": "23.1.237.201", "src_port": 58218, "dst_port": 80, "tcp_stream": 137, "udp_stream": null, "fields": { "http.host": "ctldl.windowsupdate.com", "http.request.full_uri": "http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/pinrulesstl.cab?22c230ae05c29e0f", "http.request.method": "GET", "http.request.uri": "/msdownload/update/v3/static/trustedr/en/pinrulesstl.cab?22c230ae05c29e0f", "http.response_in": "8450", "http.user_agent": "Microsoft-CryptoAPI/10.0" } } ], "http_response": [ { "event_id": "evt-fc0b9290d911069e947ed832", "kind": "http_response", "frame_number": 88, "timestamp_epoch": "1631315714.964194000", "src_ip": "96.17.68.66", "dst_ip": "10.9.10.102", "src_port": 80, "dst_port": 58079, "tcp_stream": 0, "udp_stream": null, "fields": { "http.content_length": "14", "http.content_type": "text/plain", "http.request_in": "75", "http.response.code": "200" } }, { "event_id": "evt-a2b8841ec12b0e51636de0b3", "kind": "http_response", "frame_number": 1475, "timestamp_epoch": "1631315849.963314000", "src_ip": "194.62.42.206", "dst_ip": "10.9.10.102", "src_port": 80, "dst_port": 58131, "tcp_stream": 50, "udp_stream": null, "fields": { "http.content_length": "284816", "http.content_type": "application/octet-stream", "http.request_in": "1189", "http.response.code": "200" } }, { "event_id": "evt-8cbec68e5b205a9d6f6f4994", "kind": "http_response", "frame_number": 2333, "timestamp_epoch": "1631315877.864556000", "src_ip": "23.3.85.202", "dst_ip": "10.9.10.102", "src_port": 80, "dst_port": 58151, "tcp_stream": 70, "udp_stream": null, "fields": { "http.content_length": "2222", "http.content_type": "image/png", "http.request_in": "2316", "http.response.code": "200" } }, { "event_id": "evt-5334d361d56acfdf77e18a38", "kind": "http_response", "frame_number": 2395, "timestamp_epoch": "1631315877.909647000", "src_ip": "23.3.85.202", "dst_ip": "10.9.10.102", "src_port": 80, "dst_port": 58153, "tcp_stream": 71, "udp_stream": null, "fields": { "http.content_length": "19230", "http.content_type": "image/png", "http.request_in": "2317", "http.response.code": "200" } }, { "event_id": "evt-d7cd7e2835297560dae2a84f", "kind": "http_response", "frame_number": 2403, "timestamp_epoch": "1631315877.911123000", "src_ip": "23.3.85.202", "dst_ip": "10.9.10.102", "src_port": 80, "dst_port": 58154, "tcp_stream": 74, "udp_stream": null, "fields": { "http.content_length": "17906", "http.content_type": "image/png", "http.request_in": "2324", "http.response.code": "200" } }, { "event_id": "evt-42ab19bb3ff55d79b32cf17f", "kind": "http_response", "frame_number": 2427, "timestamp_epoch": "1631315877.935648000", "src_ip": "23.3.85.202", "dst_ip": "10.9.10.102", "src_port": 80, "dst_port": 58155, "tcp_stream": 73, "udp_stream": null, "fields": { "http.content_length": "13972", "http.content_type": "image/png", "http.request_in": "2325", "http.response.code": "200" } }, { "event_id": "evt-ff505222286bc0757892f96d", "kind": "http_response", "frame_number": 2453, "timestamp_epoch": "1631315877.998069000", "src_ip": "23.3.85.202", "dst_ip": "10.9.10.102", "src_port": 80, "dst_port": 58156, "tcp_stream": 75, "udp_stream": null, "fields": { "http.content_length": "16870", "http.content_type": "image/jpeg", "http.request_in": "2353", "http.response.code": "200" } }, { "event_id": "evt-40080f71b92e1036952a3fbd", "kind": "http_response", "frame_number": 2454, "timestamp_epoch": "1631315877.998481000", "src_ip": "23.3.85.202", "dst_ip": "10.9.10.102", "src_port": 80, "dst_port": 58152, "tcp_stream": 72, "udp_stream": null, "fields": { "http.content_length": "24101", "http.content_type": "image/png", "http.request_in": "2327", "http.response.code": "200" } }, { "event_id": "evt-969dc4825827b5ab9c27d7fe", "kind": "http_response", "frame_number": 3252, "timestamp_epoch": "1631316277.166258000", "src_ip": "23.1.237.200", "dst_ip": "10.9.10.102", "src_port": 80, "dst_port": 58174, "tcp_stream": 93, "udp_stream": null, "fields": { "http.content_length": "7267", "http.content_type": "application/vnd.ms-cab-compressed", "http.request_in": "3241", "http.response.code": "200" } }, { "event_id": "evt-ed3db7500662efa3655b674b", "kind": "http_response", "frame_number": 3261, "timestamp_epoch": "1631316277.248052000", "src_ip": "23.1.237.200", "dst_ip": "10.9.10.102", "src_port": 80, "dst_port": 58174, "tcp_stream": 93, "udp_stream": null, "fields": { "http.content_length": "7261", "http.content_type": "application/vnd.ms-cab-compressed", "http.request_in": "3254", "http.response.code": "200" } }, { "event_id": "evt-7442a8f6618e64429a8c93ad", "kind": "http_response", "frame_number": 3270, "timestamp_epoch": "1631316277.329355000", "src_ip": "23.1.237.200", "dst_ip": "10.9.10.102", "src_port": 80, "dst_port": 58174, "tcp_stream": 93, "udp_stream": null, "fields": { "http.content_length": "7181", "http.content_type": "application/vnd.ms-cab-compressed", "http.request_in": "3263", "http.response.code": "200" } }, { "event_id": "evt-fabef41c398db8c9d19e4d05", "kind": "http_response", "frame_number": 3282, "timestamp_epoch": "1631316277.420058000", "src_ip": "23.1.237.200", "dst_ip": "10.9.10.102", "src_port": 80, "dst_port": 58174, "tcp_stream": 93, "udp_stream": null, "fields": { "http.content_length": "7171", "http.content_type": "application/vnd.ms-cab-compressed", "http.request_in": "3272", "http.response.code": "200" } }, { "event_id": "evt-fc764579e1c5444053dfa9b6", "kind": "http_response", "frame_number": 3292, "timestamp_epoch": "1631316277.500304000", "src_ip": "23.1.237.200", "dst_ip": "10.9.10.102", "src_port": 80, "dst_port": 58174, "tcp_stream": 93, "udp_stream": null, "fields": { "http.content_length": "7275", "http.content_type": "application/vnd.ms-cab-compressed", "http.request_in": "3284", "http.response.code": "200" } }, { "event_id": "evt-23fd4cb653257d214fe701a9", "kind": "http_response", "frame_number": 3301, "timestamp_epoch": "1631316277.578282000", "src_ip": "23.1.237.200", "dst_ip": "10.9.10.102", "src_port": 80, "dst_port": 58174, "tcp_stream": 93, "udp_stream": null, "fields": { "http.content_length": "7277", "http.content_type": "application/vnd.ms-cab-compressed", "http.request_in": "3294", "http.response.code": "200" } }, { "event_id": "evt-aef553e55e2bd2f49954f31e", "kind": "http_response", "frame_number": 3318, "timestamp_epoch": "1631316277.669070000", "src_ip": "23.1.237.200", "dst_ip": "10.9.10.102", "src_port": 80, "dst_port": 58174, "tcp_stream": 93, "udp_stream": null, "fields": { "http.content_length": "10821", "http.content_type": "application/vnd.ms-cab-compressed", "http.request_in": "3303", "http.response.code": "200" } }, { "event_id": "evt-b68e8ffdf3ca3b0abba01984", "kind": "http_response", "frame_number": 3334, "timestamp_epoch": "1631316277.751043000", "src_ip": "23.1.237.200", "dst_ip": "10.9.10.102", "src_port": 80, "dst_port": 58174, "tcp_stream": 93, "udp_stream": null, "fields": { "http.content_length": "10589", "http.content_type": "application/vnd.ms-cab-compressed", "http.request_in": "3320", "http.response.code": "200" } }, { "event_id": "evt-8c61f0772651d7cde489248b", "kind": "http_response", "frame_number": 3350, "timestamp_epoch": "1631316277.840771000", "src_ip": "23.1.237.200", "dst_ip": "10.9.10.102", "src_port": 80, "dst_port": 58174, "tcp_stream": 93, "udp_stream": null, "fields": { "http.content_length": "10621", "http.content_type": "application/vnd.ms-cab-compressed", "http.request_in": "3336", "http.response.code": "200" } }, { "event_id": "evt-f9974c1d6b61e543f07db5da", "kind": "http_response", "frame_number": 3365, "timestamp_epoch": "1631316277.932904000", "src_ip": "23.1.237.200", "dst_ip": "10.9.10.102", "src_port": 80, "dst_port": 58174, "tcp_stream": 93, "udp_stream": null, "fields": { "http.content_length": "10763", "http.content_type": "application/vnd.ms-cab-compressed", "http.request_in": "3351", "http.response.code": "200" } }, { "event_id": "evt-2f070688efb0c9c44bb7e891", "kind": "http_response", "frame_number": 3380, "timestamp_epoch": "1631316278.037589000", "src_ip": "23.1.237.200", "dst_ip": "10.9.10.102", "src_port": 80, "dst_port": 58174, "tcp_stream": 93, "udp_stream": null, "fields": { "http.content_length": "10789", "http.content_type": "application/vnd.ms-cab-compressed", "http.request_in": "3366", "http.response.code": "200" } }, { "event_id": "evt-0e09e350bba9c5ccb009421b", "kind": "http_response", "frame_number": 3393, "timestamp_epoch": "1631316278.126746000", "src_ip": "23.1.237.200", "dst_ip": "10.9.10.102", "src_port": 80, "dst_port": 58174, "tcp_stream": 93, "udp_stream": null, "fields": { "http.content_length": "10767", "http.content_type": "application/vnd.ms-cab-compressed", "http.request_in": "3381", "http.response.code": "200" } }, { "event_id": "evt-b76e94b33e380f092b22aacc", "kind": "http_response", "frame_number": 3405, "timestamp_epoch": "1631316278.209725000", "src_ip": "23.1.237.200", "dst_ip": "10.9.10.102", "src_port": 80, "dst_port": 58174, "tcp_stream": 93, "udp_stream": null, "fields": { "http.content_length": "10781", "http.content_type": "application/vnd.ms-cab-compressed", "http.request_in": "3394", "http.response.code": "200" } }, { "event_id": "evt-215f84f5a04a3a810532507e", "kind": "http_response", "frame_number": 3419, "timestamp_epoch": "1631316278.296502000", "src_ip": "23.1.237.200", "dst_ip": "10.9.10.102", "src_port": 80, "dst_port": 58174, "tcp_stream": 93, "udp_stream": null, "fields": { "http.content_length": "10593", "http.content_type": "application/vnd.ms-cab-compressed", "http.request_in": "3407", "http.response.code": "200" } }, { "event_id": "evt-02e5581c3d56b82938e3b8fb", "kind": "http_response", "frame_number": 3434, "timestamp_epoch": "1631316278.751955000", "src_ip": "23.1.237.200", "dst_ip": "10.9.10.102", "src_port": 80, "dst_port": 58174, "tcp_stream": 93, "udp_stream": null, "fields": { "http.content_length": "10623", "http.content_type": "application/vnd.ms-cab-compressed", "http.request_in": "3421", "http.response.code": "200" } }, { "event_id": "evt-e6b841a7c6f5c67fb66046a1", "kind": "http_response", "frame_number": 3447, "timestamp_epoch": "1631316278.839623000", "src_ip": "23.1.237.200", "dst_ip": "10.9.10.102", "src_port": 80, "dst_port": 58174, "tcp_stream": 93, "udp_stream": null, "fields": { "http.content_length": "10765", "http.content_type": "application/vnd.ms-cab-compressed", "http.request_in": "3435", "http.response.code": "200" } }, { "event_id": "evt-d3ca3619349825f1c64f1f4b", "kind": "http_response", "frame_number": 3460, "timestamp_epoch": "1631316278.931479000", "src_ip": "23.1.237.200", "dst_ip": "10.9.10.102", "src_port": 80, "dst_port": 58174, "tcp_stream": 93, "udp_stream": null, "fields": { "http.content_length": "10791", "http.content_type": "application/vnd.ms-cab-compressed", "http.request_in": "3448", "http.response.code": "200" } }, { "event_id": "evt-0e27d7f22fa842047cd2a132", "kind": "http_response", "frame_number": 3567, "timestamp_epoch": "1631316279.593763000", "src_ip": "23.1.237.200", "dst_ip": "10.9.10.102", "src_port": 80, "dst_port": 58174, "tcp_stream": 93, "udp_stream": null, "fields": { "http.content_length": "7181", "http.content_type": "application/vnd.ms-cab-compressed", "http.request_in": "3560", "http.response.code": "200" } }, { "event_id": "evt-438f5292c8dd1114b09a0f42", "kind": "http_response", "frame_number": 3578, "timestamp_epoch": "1631316279.686734000", "src_ip": "23.1.237.200", "dst_ip": "10.9.10.102", "src_port": 80, "dst_port": 58174, "tcp_stream": 93, "udp_stream": null, "fields": { "http.content_length": "7183", "http.content_type": "application/vnd.ms-cab-compressed", "http.request_in": "3570", "http.response.code": "200" } }, { "event_id": "evt-f0a6a29d320825bf9c6230aa", "kind": "http_response", "frame_number": 3587, "timestamp_epoch": "1631316279.784283000", "src_ip": "23.1.237.200", "dst_ip": "10.9.10.102", "src_port": 80, "dst_port": 58174, "tcp_stream": 93, "udp_stream": null, "fields": { "http.content_length": "7283", "http.content_type": "application/vnd.ms-cab-compressed", "http.request_in": "3580", "http.response.code": "200" } }, { "event_id": "evt-1cbaa06b5d8b7ae88b28bbd7", "kind": "http_response", "frame_number": 3597, "timestamp_epoch": "1631316279.860077000", "src_ip": "23.1.237.200", "dst_ip": "10.9.10.102", "src_port": 80, "dst_port": 58174, "tcp_stream": 93, "udp_stream": null, "fields": { "http.content_length": "7275", "http.content_type": "application/vnd.ms-cab-compressed", "http.request_in": "3590", "http.response.code": "200" } }, { "event_id": "evt-30b86afe3c93ffb61dbfc082", "kind": "http_response", "frame_number": 3606, "timestamp_epoch": "1631316279.946357000", "src_ip": "23.1.237.200", "dst_ip": "10.9.10.102", "src_port": 80, "dst_port": 58174, "tcp_stream": 93, "udp_stream": null, "fields": { "http.content_length": "7171", "http.content_type": "application/vnd.ms-cab-compressed", "http.request_in": "3599", "http.response.code": "200" } }, { "event_id": "evt-70591e3c6ab73fb6e019b8d2", "kind": "http_response", "frame_number": 3615, "timestamp_epoch": "1631316280.028467000", "src_ip": "23.1.237.200", "dst_ip": "10.9.10.102", "src_port": 80, "dst_port": 58174, "tcp_stream": 93, "udp_stream": null, "fields": { "http.content_length": "7171", "http.content_type": "application/vnd.ms-cab-compressed", "http.request_in": "3608", "http.response.code": "200" } }, { "event_id": "evt-f35a556f3550aaf4f1550007", "kind": "http_response", "frame_number": 3719, "timestamp_epoch": "1631316280.551049000", "src_ip": "23.1.237.200", "dst_ip": "10.9.10.102", "src_port": 80, "dst_port": 58174, "tcp_stream": 93, "udp_stream": null, "fields": { "http.content_length": "7189", "http.content_type": "application/vnd.ms-cab-compressed", "http.request_in": "3712", "http.response.code": "200" } }, { "event_id": "evt-cbc954af4c60b9751a942e3a", "kind": "http_response", "frame_number": 3728, "timestamp_epoch": "1631316280.646096000", "src_ip": "23.1.237.200", "dst_ip": "10.9.10.102", "src_port": 80, "dst_port": 58174, "tcp_stream": 93, "udp_stream": null, "fields": { "http.content_length": "7185", "http.content_type": "application/vnd.ms-cab-compressed", "http.request_in": "3721", "http.response.code": "200" } }, { "event_id": "evt-cbe325fb10fb95be954171e8", "kind": "http_response", "frame_number": 3737, "timestamp_epoch": "1631316280.727600000", "src_ip": "23.1.237.200", "dst_ip": "10.9.10.102", "src_port": 80, "dst_port": 58174, "tcp_stream": 93, "udp_stream": null, "fields": { "http.content_length": "7287", "http.content_type": "application/vnd.ms-cab-compressed", "http.request_in": "3730", "http.response.code": "200" } }, { "event_id": "evt-4c7415d0cfb2ac4fac074d9e", "kind": "http_response", "frame_number": 3746, "timestamp_epoch": "1631316280.810066000", "src_ip": "23.1.237.200", "dst_ip": "10.9.10.102", "src_port": 80, "dst_port": 58174, "tcp_stream": 93, "udp_stream": null, "fields": { "http.content_length": "7285", "http.content_type": "application/vnd.ms-cab-compressed", "http.request_in": "3739", "http.response.code": "200" } }, { "event_id": "evt-660a187142df076adb4ed166", "kind": "http_response", "frame_number": 3856, "timestamp_epoch": "1631316281.381764000", "src_ip": "23.1.237.200", "dst_ip": "10.9.10.102", "src_port": 80, "dst_port": 58174, "tcp_stream": 93, "udp_stream": null, "fields": { "http.content_length": "7285", "http.content_type": "application/vnd.ms-cab-compressed", "http.request_in": "3849", "http.response.code": "200" } }, { "event_id": "evt-8577d3d935399af076cbb755", "kind": "http_response", "frame_number": 3866, "timestamp_epoch": "1631316281.467633000", "src_ip": "23.1.237.200", "dst_ip": "10.9.10.102", "src_port": 80, "dst_port": 58174, "tcp_stream": 93, "udp_stream": null, "fields": { "http.content_length": "7277", "http.content_type": "application/vnd.ms-cab-compressed", "http.request_in": "3858", "http.response.code": "200" } }, { "event_id": "evt-5aece4b360b0a6762dbe85d4", "kind": "http_response", "frame_number": 3875, "timestamp_epoch": "1631316281.550217000", "src_ip": "23.1.237.200", "dst_ip": "10.9.10.102", "src_port": 80, "dst_port": 58174, "tcp_stream": 93, "udp_stream": null, "fields": { "http.content_length": "7175", "http.content_type": "application/vnd.ms-cab-compressed", "http.request_in": "3868", "http.response.code": "200" } }, { "event_id": "evt-7b70a1233083064690151b3e", "kind": "http_response", "frame_number": 3886, "timestamp_epoch": "1631316281.629629000", "src_ip": "23.1.237.200", "dst_ip": "10.9.10.102", "src_port": 80, "dst_port": 58174, "tcp_stream": 93, "udp_stream": null, "fields": { "http.content_length": "7175", "http.content_type": "application/vnd.ms-cab-compressed", "http.request_in": "3878", "http.response.code": "200" } }, { "event_id": "evt-0d92f31e03bb16f19c651f1b", "kind": "http_response", "frame_number": 3896, "timestamp_epoch": "1631316281.712900000", "src_ip": "23.1.237.200", "dst_ip": "10.9.10.102", "src_port": 80, "dst_port": 58174, "tcp_stream": 93, "udp_stream": null, "fields": { "http.content_length": "7275", "http.content_type": "application/vnd.ms-cab-compressed", "http.request_in": "3888", "http.response.code": "200" } }, { "event_id": "evt-3f2d98fe7b1fdf38bdde4faf", "kind": "http_response", "frame_number": 3905, "timestamp_epoch": "1631316281.793352000", "src_ip": "23.1.237.200", "dst_ip": "10.9.10.102", "src_port": 80, "dst_port": 58174, "tcp_stream": 93, "udp_stream": null, "fields": { "http.content_length": "7273", "http.content_type": "application/vnd.ms-cab-compressed", "http.request_in": "3898", "http.response.code": "200" } }, { "event_id": "evt-5082fae08f8bc753f401ad7d", "kind": "http_response", "frame_number": 4198, "timestamp_epoch": "1631316288.847386000", "src_ip": "23.1.237.216", "dst_ip": "10.9.10.102", "src_port": 80, "dst_port": 58181, "tcp_stream": 100, "udp_stream": null, "fields": { "http.content_length": "2", "http.content_type": "application/octet-stream", "http.request_in": "4193", "http.response.code": "206" } }, { "event_id": "evt-102ab2a85217d063a03b666c", "kind": "http_response", "frame_number": 4199, "timestamp_epoch": "1631316288.850212000", "src_ip": "23.1.237.225", "dst_ip": "10.9.10.102", "src_port": 80, "dst_port": 58182, "tcp_stream": 101, "udp_stream": null, "fields": { "http.content_length": "2", "http.content_type": "application/octet-stream", "http.request_in": "4195", "http.response.code": "206" } }, { "event_id": "evt-f1e9c42c77c844d21b68f389", "kind": "http_response", "frame_number": 6356, "timestamp_epoch": "1631316290.372399000", "src_ip": "23.1.237.225", "dst_ip": "10.9.10.102", "src_port": 80, "dst_port": 58182, "tcp_stream": 101, "udp_stream": null, "fields": { "http.content_length": "1048576", "http.content_type": "application/octet-stream", "http.request_in": "4201", "http.response.code": "206" } }, { "event_id": "evt-d511767f23c76ea33cac97b4", "kind": "http_response", "frame_number": 6404, "timestamp_epoch": "1631316290.461273000", "src_ip": "23.1.237.216", "dst_ip": "10.9.10.102", "src_port": 80, "dst_port": 58181, "tcp_stream": 100, "udp_stream": null, "fields": { "http.content_length": "1048576", "http.content_type": "application/octet-stream", "http.request_in": "4200", "http.response.code": "206" } }, { "event_id": "evt-faacfac3aa5584899d887565", "kind": "http_response", "frame_number": 7346, "timestamp_epoch": "1631316291.098090000", "src_ip": "23.1.237.225", "dst_ip": "10.9.10.102", "src_port": 80, "dst_port": 58182, "tcp_stream": 101, "udp_stream": null, "fields": { "http.content_length": "922056", "http.content_type": "application/octet-stream", "http.request_in": "6371", "http.response.code": "206" } }, { "event_id": "evt-a89c0e64ae0a275a954f410b", "kind": "http_response", "frame_number": 8448, "timestamp_epoch": "1631319034.823060000", "src_ip": "23.1.237.201", "dst_ip": "10.9.10.102", "src_port": 80, "dst_port": 58218, "tcp_stream": 137, "udp_stream": null, "fields": { "http.content_type": "application/vnd.ms-cab-compressed", "http.request_in": "8446", "http.response.code": "304" } }, { "event_id": "evt-e6469a09f27d2113de0027ae", "kind": "http_response", "frame_number": 8450, "timestamp_epoch": "1631319035.057267000", "src_ip": "23.1.237.201", "dst_ip": "10.9.10.102", "src_port": 80, "dst_port": 58218, "tcp_stream": 137, "udp_stream": null, "fields": { "http.content_type": "application/vnd.ms-cab-compressed", "http.request_in": "8449", "http.response.code": "304" } } ], "tls_client_hello": [ { "event_id": "evt-0ca773e97235d2faae8e00c1", "kind": "tls_client_hello", "frame_number": 97, "timestamp_epoch": "1631315715.609283000", "src_ip": "10.9.10.102", "dst_ip": "40.83.240.146", "src_port": 58081, "dst_port": 443, "tcp_stream": 2, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "client.wns.windows.com", "tls.handshake.ja3": "3b5074b1b5d032e5620f69f9f700ff0e" } }, { "event_id": "evt-4f19dcd7318700fd12327b5d", "kind": "tls_client_hello", "frame_number": 223, "timestamp_epoch": "1631315798.694974000", "src_ip": "10.9.10.102", "dst_ip": "23.3.84.67", "src_port": 58089, "dst_port": 443, "tcp_stream": 8, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "fs.microsoft.com", "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4" } }, { "event_id": "evt-53670e89f6cda83517c15e26", "kind": "tls_client_hello", "frame_number": 244, "timestamp_epoch": "1631315799.393702000", "src_ip": "10.9.10.102", "dst_ip": "23.3.84.67", "src_port": 58090, "dst_port": 443, "tcp_stream": 9, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "fs.microsoft.com", "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4" } }, { "event_id": "evt-00ffcb00d3e3a57587accf9b", "kind": "tls_client_hello", "frame_number": 264, "timestamp_epoch": "1631315800.094805000", "src_ip": "10.9.10.102", "dst_ip": "23.3.84.67", "src_port": 58091, "dst_port": 443, "tcp_stream": 10, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "fs.microsoft.com", "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4" } }, { "event_id": "evt-6c74abce08647853f7ee08d1", "kind": "tls_client_hello", "frame_number": 518, "timestamp_epoch": "1631315817.663508000", "src_ip": "10.9.10.102", "dst_ip": "184.85.229.68", "src_port": 58106, "dst_port": 443, "tcp_stream": 25, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "cdn.onenote.net", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-570ab31a5941e5729f2b0b91", "kind": "tls_client_hello", "frame_number": 519, "timestamp_epoch": "1631315817.663510000", "src_ip": "10.9.10.102", "dst_ip": "184.85.229.68", "src_port": 58105, "dst_port": 443, "tcp_stream": 24, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "cdn.onenote.net", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-979494fab5396d2253c6d762", "kind": "tls_client_hello", "frame_number": 560, "timestamp_epoch": "1631315818.563237000", "src_ip": "10.9.10.102", "dst_ip": "204.79.197.203", "src_port": 58107, "dst_port": 443, "tcp_stream": 26, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "api.msn.com", "tls.handshake.ja3": "37f463bf4616ecd445d4a1937da06e19" } }, { "event_id": "evt-7e3a89db7b4955df1fcc5100", "kind": "tls_client_hello", "frame_number": 594, "timestamp_epoch": "1631315821.695634000", "src_ip": "10.9.10.102", "dst_ip": "13.107.21.200", "src_port": 58108, "dst_port": 443, "tcp_stream": 27, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "bing.com", "tls.handshake.ja3": "6271f898ce5be7dd52b0fc260d0662b3" } }, { "event_id": "evt-103d7eb0b588fa065bccc957", "kind": "tls_client_hello", "frame_number": 613, "timestamp_epoch": "1631315821.771792000", "src_ip": "10.9.10.102", "dst_ip": "13.107.246.254", "src_port": 58109, "dst_port": 443, "tcp_stream": 28, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "moiafdazure.clo.footprintdns.com", "tls.handshake.ja3": "6271f898ce5be7dd52b0fc260d0662b3" } }, { "event_id": "evt-1b0330fb96f5e170ea58b752", "kind": "tls_client_hello", "frame_number": 624, "timestamp_epoch": "1631315821.776922000", "src_ip": "10.9.10.102", "dst_ip": "204.79.197.200", "src_port": 58112, "dst_port": 443, "tcp_stream": 31, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "www.bing.com", "tls.handshake.ja3": "6271f898ce5be7dd52b0fc260d0662b3" } }, { "event_id": "evt-c9fd3bbe2fd05a58f46019cb", "kind": "tls_client_hello", "frame_number": 627, "timestamp_epoch": "1631315821.778012000", "src_ip": "10.9.10.102", "dst_ip": "13.107.246.254", "src_port": 58113, "dst_port": 443, "tcp_stream": 32, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "t-ring.msedge.net", "tls.handshake.ja3": "6271f898ce5be7dd52b0fc260d0662b3" } }, { "event_id": "evt-6aceeaa1333285e6b1bc90b1", "kind": "tls_client_hello", "frame_number": 628, "timestamp_epoch": "1631315821.778069000", "src_ip": "10.9.10.102", "dst_ip": "13.107.49.254", "src_port": 58111, "dst_port": 443, "tcp_stream": 30, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "q-ring.msedge.net", "tls.handshake.ja3": "6271f898ce5be7dd52b0fc260d0662b3" } }, { "event_id": "evt-a7101762a4952f0b72b657fd", "kind": "tls_client_hello", "frame_number": 641, "timestamp_epoch": "1631315821.798138000", "src_ip": "10.9.10.102", "dst_ip": "23.100.36.182", "src_port": 58114, "dst_port": 443, "tcp_stream": 33, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "68091d435f184f9c8d6273bdb538ff4b.clo.footprintdns.com", "tls.handshake.ja3": "6271f898ce5be7dd52b0fc260d0662b3" } }, { "event_id": "evt-a5cea21920a9bf745b2da58e", "kind": "tls_client_hello", "frame_number": 657, "timestamp_epoch": "1631315821.848001000", "src_ip": "10.9.10.102", "dst_ip": "13.107.3.254", "src_port": 58115, "dst_port": 443, "tcp_stream": 34, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "s-ring.msedge.net", "tls.handshake.ja3": "6271f898ce5be7dd52b0fc260d0662b3" } }, { "event_id": "evt-fe8de950773c0ab96a00322b", "kind": "tls_client_hello", "frame_number": 682, "timestamp_epoch": "1631315821.860007000", "src_ip": "10.9.10.102", "dst_ip": "72.21.81.200", "src_port": 58118, "dst_port": 443, "tcp_stream": 37, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "fp-vs-nocache.azureedge.net", "tls.handshake.ja3": "6271f898ce5be7dd52b0fc260d0662b3" } }, { "event_id": "evt-f7baf0898db54ffc5f2c7f14", "kind": "tls_client_hello", "frame_number": 683, "timestamp_epoch": "1631315821.860172000", "src_ip": "10.9.10.102", "dst_ip": "52.113.196.254", "src_port": 58117, "dst_port": 443, "tcp_stream": 36, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "teams-ring.msedge.net", "tls.handshake.ja3": "6271f898ce5be7dd52b0fc260d0662b3" } }, { "event_id": "evt-377096c8ece15ef2e4c7fb29", "kind": "tls_client_hello", "frame_number": 684, "timestamp_epoch": "1631315821.860644000", "src_ip": "10.9.10.102", "dst_ip": "13.107.18.254", "src_port": 58116, "dst_port": 443, "tcp_stream": 35, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "k-ring.msedge.net", "tls.handshake.ja3": "6271f898ce5be7dd52b0fc260d0662b3" } }, { "event_id": "evt-6a60e76f37204b587b37c544", "kind": "tls_client_hello", "frame_number": 700, "timestamp_epoch": "1631315821.875754000", "src_ip": "10.9.10.102", "dst_ip": "13.107.136.254", "src_port": 58119, "dst_port": 443, "tcp_stream": 38, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "spo-ring.msedge.net", "tls.handshake.ja3": "6271f898ce5be7dd52b0fc260d0662b3" } }, { "event_id": "evt-e36c5530c079de919b7db679", "kind": "tls_client_hello", "frame_number": 714, "timestamp_epoch": "1631315821.918599000", "src_ip": "10.9.10.102", "dst_ip": "51.137.102.183", "src_port": 58110, "dst_port": 443, "tcp_stream": 29, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "f005cab8a8840abf6ab35152a071b205.clo.footprintdns.com", "tls.handshake.ja3": "6271f898ce5be7dd52b0fc260d0662b3" } }, { "event_id": "evt-5c78242a04571bbe61c7c788", "kind": "tls_client_hello", "frame_number": 768, "timestamp_epoch": "1631315821.944743000", "src_ip": "10.9.10.102", "dst_ip": "204.79.197.222", "src_port": 58120, "dst_port": 443, "tcp_stream": 40, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "fp.msedge.net", "tls.handshake.ja3": "6271f898ce5be7dd52b0fc260d0662b3" } }, { "event_id": "evt-b42df146fa8c49abfc03bcee", "kind": "tls_client_hello", "frame_number": 769, "timestamp_epoch": "1631315821.944764000", "src_ip": "10.9.10.102", "dst_ip": "204.79.197.254", "src_port": 58121, "dst_port": 443, "tcp_stream": 39, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "a-ring.msedge.net", "tls.handshake.ja3": "6271f898ce5be7dd52b0fc260d0662b3" } }, { "event_id": "evt-df89843704be7f443da486dd", "kind": "tls_client_hello", "frame_number": 822, "timestamp_epoch": "1631315822.024638000", "src_ip": "10.9.10.102", "dst_ip": "20.190.151.131", "src_port": 58122, "dst_port": 443, "tcp_stream": 41, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "login.live.com", "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4" } }, { "event_id": "evt-2cb078e3c0b76eed257820a9", "kind": "tls_client_hello", "frame_number": 870, "timestamp_epoch": "1631315822.087964000", "src_ip": "10.9.10.102", "dst_ip": "20.140.48.71", "src_port": 58123, "dst_port": 443, "tcp_stream": 42, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "fp-afd.azureedge.us", "tls.handshake.ja3": "6271f898ce5be7dd52b0fc260d0662b3" } }, { "event_id": "evt-dc1a6bdb63a5f04da2218750", "kind": "tls_client_hello", "frame_number": 970, "timestamp_epoch": "1631315823.927190000", "src_ip": "10.9.10.102", "dst_ip": "204.79.197.203", "src_port": 58124, "dst_port": 443, "tcp_stream": 43, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "api.msn.com", "tls.handshake.ja3": "6271f898ce5be7dd52b0fc260d0662b3" } }, { "event_id": "evt-985d75494b2c883492b9b53b", "kind": "tls_client_hello", "frame_number": 1011, "timestamp_epoch": "1631315826.308118000", "src_ip": "10.9.10.102", "dst_ip": "20.140.48.71", "src_port": 58125, "dst_port": 443, "tcp_stream": 44, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "fp-afd.azurefd.us", "tls.handshake.ja3": "6271f898ce5be7dd52b0fc260d0662b3" } }, { "event_id": "evt-f65a51c82f982ffedb8a5a9b", "kind": "tls_client_hello", "frame_number": 1094, "timestamp_epoch": "1631315834.315747000", "src_ip": "10.9.10.102", "dst_ip": "52.137.106.217", "src_port": 58126, "dst_port": 443, "tcp_stream": 45, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "settings-win.data.microsoft.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-6d29db9ad00d64b26eade602", "kind": "tls_client_hello", "frame_number": 1096, "timestamp_epoch": "1631315834.317832000", "src_ip": "10.9.10.102", "dst_ip": "52.137.106.217", "src_port": 58127, "dst_port": 443, "tcp_stream": 46, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "settings-win.data.microsoft.com", "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4" } }, { "event_id": "evt-9199afc098a73c36bd183197", "kind": "tls_client_hello", "frame_number": 1126, "timestamp_epoch": "1631315835.488085000", "src_ip": "10.9.10.102", "dst_ip": "52.137.106.217", "src_port": 58128, "dst_port": 443, "tcp_stream": 47, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "settings-win.data.microsoft.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-8607b2dbee880c5ce0bed9dc", "kind": "tls_client_hello", "frame_number": 1150, "timestamp_epoch": "1631315841.137786000", "src_ip": "10.9.10.102", "dst_ip": "52.109.76.36", "src_port": 58129, "dst_port": 443, "tcp_stream": 48, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "nexus.officeapps.live.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-2a2e32c2eab05bba5835ecdc", "kind": "tls_client_hello", "frame_number": 1166, "timestamp_epoch": "1631315842.541994000", "src_ip": "10.9.10.102", "dst_ip": "52.109.8.19", "src_port": 58130, "dst_port": 443, "tcp_stream": 49, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "nexusrules.officeapps.live.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-e37dc15b70ef7a85225201ba", "kind": "tls_client_hello", "frame_number": 1486, "timestamp_epoch": "1631315852.122449000", "src_ip": "10.9.10.102", "dst_ip": "104.215.148.63", "src_port": 58133, "dst_port": 443, "tcp_stream": 52, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "microsoft.com", "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4" } }, { "event_id": "evt-988c7dc527ee0ec7520f4554", "kind": "tls_client_hello", "frame_number": 1487, "timestamp_epoch": "1631315852.132689000", "src_ip": "10.9.10.102", "dst_ip": "167.172.37.9", "src_port": 58132, "dst_port": 443, "tcp_stream": 51, "udp_stream": null, "fields": { "tls.handshake.ja3": "51c64c77e60f3980eea90869b68c58a8" } }, { "event_id": "evt-f91aaa509c22df65efb18470", "kind": "tls_client_hello", "frame_number": 1546, "timestamp_epoch": "1631315853.754352000", "src_ip": "10.9.10.102", "dst_ip": "23.3.85.234", "src_port": 58134, "dst_port": 443, "tcp_stream": 53, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "www.microsoft.com", "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4" } }, { "event_id": "evt-22f6371976147b510a1949a3", "kind": "tls_client_hello", "frame_number": 1845, "timestamp_epoch": "1631315857.340404000", "src_ip": "10.9.10.102", "dst_ip": "94.158.245.52", "src_port": 58135, "dst_port": 443, "tcp_stream": 54, "udp_stream": null, "fields": { "tls.handshake.ja3": "51c64c77e60f3980eea90869b68c58a8" } }, { "event_id": "evt-179372c94d2c1f9b5a43ecdd", "kind": "tls_client_hello", "frame_number": 1863, "timestamp_epoch": "1631315861.946297000", "src_ip": "10.9.10.102", "dst_ip": "94.158.245.52", "src_port": 58136, "dst_port": 443, "tcp_stream": 55, "udp_stream": null, "fields": { "tls.handshake.ja3": "51c64c77e60f3980eea90869b68c58a8" } }, { "event_id": "evt-862ce1ad8b9b73d3e08bf0de", "kind": "tls_client_hello", "frame_number": 1883, "timestamp_epoch": "1631315864.259420000", "src_ip": "10.9.10.102", "dst_ip": "94.158.245.52", "src_port": 58137, "dst_port": 443, "tcp_stream": 56, "udp_stream": null, "fields": { "tls.handshake.ja3": "51c64c77e60f3980eea90869b68c58a8" } }, { "event_id": "evt-42c52dc60a1622c22ea9aaef", "kind": "tls_client_hello", "frame_number": 1906, "timestamp_epoch": "1631315866.080548000", "src_ip": "10.9.10.102", "dst_ip": "94.158.245.52", "src_port": 58138, "dst_port": 443, "tcp_stream": 57, "udp_stream": null, "fields": { "tls.handshake.ja3": "51c64c77e60f3980eea90869b68c58a8" } }, { "event_id": "evt-44cae7ab29204c2a12caaf0c", "kind": "tls_client_hello", "frame_number": 1969, "timestamp_epoch": "1631315876.688950000", "src_ip": "10.9.10.102", "dst_ip": "23.3.86.10", "src_port": 58141, "dst_port": 443, "tcp_stream": 59, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "storeedgefd.dsx.mp.microsoft.com", "tls.handshake.ja3": "6271f898ce5be7dd52b0fc260d0662b3" } }, { "event_id": "evt-1cd33151884349b216649cca", "kind": "tls_client_hello", "frame_number": 1970, "timestamp_epoch": "1631315876.688951000", "src_ip": "10.9.10.102", "dst_ip": "23.3.86.10", "src_port": 58146, "dst_port": 443, "tcp_stream": 64, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "storeedgefd.dsx.mp.microsoft.com", "tls.handshake.ja3": "6271f898ce5be7dd52b0fc260d0662b3" } }, { "event_id": "evt-3a64998d6c932b889f9570db", "kind": "tls_client_hello", "frame_number": 1971, "timestamp_epoch": "1631315876.688952000", "src_ip": "10.9.10.102", "dst_ip": "23.3.86.10", "src_port": 58142, "dst_port": 443, "tcp_stream": 60, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "storeedgefd.dsx.mp.microsoft.com", "tls.handshake.ja3": "6271f898ce5be7dd52b0fc260d0662b3" } }, { "event_id": "evt-9ad13ffe016bd4323f2ce544", "kind": "tls_client_hello", "frame_number": 1972, "timestamp_epoch": "1631315876.689031000", "src_ip": "10.9.10.102", "dst_ip": "23.3.86.10", "src_port": 58145, "dst_port": 443, "tcp_stream": 65, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "storeedgefd.dsx.mp.microsoft.com", "tls.handshake.ja3": "6271f898ce5be7dd52b0fc260d0662b3" } }, { "event_id": "evt-1cc1a829c8ffa580913f02be", "kind": "tls_client_hello", "frame_number": 1973, "timestamp_epoch": "1631315876.689032000", "src_ip": "10.9.10.102", "dst_ip": "23.3.86.10", "src_port": 58139, "dst_port": 443, "tcp_stream": 58, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "storeedgefd.dsx.mp.microsoft.com", "tls.handshake.ja3": "6271f898ce5be7dd52b0fc260d0662b3" } }, { "event_id": "evt-8f4b098f2a55cb4c531d20ab", "kind": "tls_client_hello", "frame_number": 1974, "timestamp_epoch": "1631315876.689033000", "src_ip": "10.9.10.102", "dst_ip": "23.3.86.10", "src_port": 58140, "dst_port": 443, "tcp_stream": 61, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "storeedgefd.dsx.mp.microsoft.com", "tls.handshake.ja3": "6271f898ce5be7dd52b0fc260d0662b3" } }, { "event_id": "evt-7736b985364540646098fce2", "kind": "tls_client_hello", "frame_number": 1977, "timestamp_epoch": "1631315876.689526000", "src_ip": "10.9.10.102", "dst_ip": "23.3.86.10", "src_port": 58143, "dst_port": 443, "tcp_stream": 63, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "storeedgefd.dsx.mp.microsoft.com", "tls.handshake.ja3": "6271f898ce5be7dd52b0fc260d0662b3" } }, { "event_id": "evt-de8a19964ae02fbb8d5b0002", "kind": "tls_client_hello", "frame_number": 1978, "timestamp_epoch": "1631315876.689581000", "src_ip": "10.9.10.102", "dst_ip": "23.3.86.10", "src_port": 58144, "dst_port": 443, "tcp_stream": 62, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "storeedgefd.dsx.mp.microsoft.com", "tls.handshake.ja3": "6271f898ce5be7dd52b0fc260d0662b3" } }, { "event_id": "evt-2032bbff7f898444e5a10d11", "kind": "tls_client_hello", "frame_number": 2457, "timestamp_epoch": "1631315878.003403000", "src_ip": "10.9.10.102", "dst_ip": "23.3.6.28", "src_port": 58157, "dst_port": 443, "tcp_stream": 76, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "gameplayapi.intel.com", "tls.handshake.ja3": "3b5074b1b5d032e5620f69f9f700ff0e" } }, { "event_id": "evt-c2a131a8d94b80854695d5a7", "kind": "tls_client_hello", "frame_number": 2591, "timestamp_epoch": "1631315960.082826000", "src_ip": "10.9.10.102", "dst_ip": "94.158.245.52", "src_port": 58158, "dst_port": 443, "tcp_stream": 77, "udp_stream": null, "fields": { "tls.handshake.ja3": "51c64c77e60f3980eea90869b68c58a8" } }, { "event_id": "evt-6b7c1ec8e02802cd0c6acbd9", "kind": "tls_client_hello", "frame_number": 2611, "timestamp_epoch": "1631315961.798195000", "src_ip": "10.9.10.102", "dst_ip": "34.117.59.81", "src_port": 58159, "dst_port": 443, "tcp_stream": 78, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "myexternalip.com", "tls.handshake.ja3": "37f463bf4616ecd445d4a1937da06e19" } }, { "event_id": "evt-7d0d31a5e600d71a911b2c27", "kind": "tls_client_hello", "frame_number": 2832, "timestamp_epoch": "1631315967.851208000", "src_ip": "10.9.10.102", "dst_ip": "94.158.245.52", "src_port": 58163, "dst_port": 443, "tcp_stream": 82, "udp_stream": null, "fields": { "tls.handshake.ja3": "51c64c77e60f3980eea90869b68c58a8" } }, { "event_id": "evt-70ffa9168f6c821ef259c80f", "kind": "tls_client_hello", "frame_number": 2858, "timestamp_epoch": "1631315969.262219000", "src_ip": "10.9.10.102", "dst_ip": "52.109.8.22", "src_port": 58164, "dst_port": 443, "tcp_stream": 83, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "nexus.officeapps.live.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-65a3a3ee202d9fe8d1e2c422", "kind": "tls_client_hello", "frame_number": 2882, "timestamp_epoch": "1631315970.664926000", "src_ip": "10.9.10.102", "dst_ip": "52.109.76.32", "src_port": 58165, "dst_port": 443, "tcp_stream": 84, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "nexusrules.officeapps.live.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-2f3b63fb63a9b8790e86ba54", "kind": "tls_client_hello", "frame_number": 3031, "timestamp_epoch": "1631316273.307528000", "src_ip": "10.9.10.102", "dst_ip": "52.242.101.226", "src_port": 58170, "dst_port": 443, "tcp_stream": 89, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "slscr.update.microsoft.com", "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4" } }, { "event_id": "evt-3a73b5225439dadc8239249b", "kind": "tls_client_hello", "frame_number": 3054, "timestamp_epoch": "1631316274.690592000", "src_ip": "10.9.10.102", "dst_ip": "52.238.248.6", "src_port": 58171, "dst_port": 443, "tcp_stream": 90, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "fe2cr.update.microsoft.com", "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4" } }, { "event_id": "evt-03d91dfba5e6f998fd622a0b", "kind": "tls_client_hello", "frame_number": 3082, "timestamp_epoch": "1631316275.893695000", "src_ip": "10.9.10.102", "dst_ip": "20.190.154.138", "src_port": 58172, "dst_port": 443, "tcp_stream": 91, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "login.live.com", "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4" } }, { "event_id": "evt-c27ebc56bda4a9510817cc7a", "kind": "tls_client_hello", "frame_number": 3228, "timestamp_epoch": "1631316276.796295000", "src_ip": "10.9.10.102", "dst_ip": "104.46.162.226", "src_port": 58173, "dst_port": 443, "tcp_stream": 92, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "v10.events.data.microsoft.com", "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4" } }, { "event_id": "evt-9df814dbb1fa121b1988e55b", "kind": "tls_client_hello", "frame_number": 4028, "timestamp_epoch": "1631316283.932448000", "src_ip": "10.9.10.102", "dst_ip": "40.125.122.151", "src_port": 58175, "dst_port": 443, "tcp_stream": 94, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "fe3cr.delivery.mp.microsoft.com", "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4" } }, { "event_id": "evt-26064d7a4d53a0835a7369ae", "kind": "tls_client_hello", "frame_number": 4066, "timestamp_epoch": "1631316285.281343000", "src_ip": "10.9.10.102", "dst_ip": "104.46.162.226", "src_port": 58176, "dst_port": 443, "tcp_stream": 95, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "v10.events.data.microsoft.com", "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4" } }, { "event_id": "evt-fe8f728e92be2801fed28dd5", "kind": "tls_client_hello", "frame_number": 4107, "timestamp_epoch": "1631316286.544944000", "src_ip": "10.9.10.102", "dst_ip": "52.184.217.20", "src_port": 58177, "dst_port": 443, "tcp_stream": 96, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "geo.prod.do.dsp.mp.microsoft.com", "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4" } }, { "event_id": "evt-2998cb4a1415de843cf765a2", "kind": "tls_client_hello", "frame_number": 4131, "timestamp_epoch": "1631316287.389840000", "src_ip": "10.9.10.102", "dst_ip": "104.125.253.131", "src_port": 58178, "dst_port": 443, "tcp_stream": 97, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "kv601.prod.do.dsp.mp.microsoft.com", "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4" } }, { "event_id": "evt-f6fd8e5c973d1428ded24fe5", "kind": "tls_client_hello", "frame_number": 4146, "timestamp_epoch": "1631316287.718495000", "src_ip": "10.9.10.102", "dst_ip": "104.46.162.226", "src_port": 58179, "dst_port": 443, "tcp_stream": 98, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "v10.events.data.microsoft.com", "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4" } }, { "event_id": "evt-d534750adc6407c169cb5833", "kind": "tls_client_hello", "frame_number": 4163, "timestamp_epoch": "1631316288.173158000", "src_ip": "10.9.10.102", "dst_ip": "104.125.253.131", "src_port": 58180, "dst_port": 443, "tcp_stream": 99, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "cp601.prod.do.dsp.mp.microsoft.com", "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4" } }, { "event_id": "evt-60994400c089ddc3417cb244", "kind": "tls_client_hello", "frame_number": 5741, "timestamp_epoch": "1631316289.984008000", "src_ip": "10.9.10.102", "dst_ip": "104.46.162.226", "src_port": 58183, "dst_port": 443, "tcp_stream": 102, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "v10.events.data.microsoft.com", "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4" } }, { "event_id": "evt-05a7d1a2264ff3c9861a9758", "kind": "tls_client_hello", "frame_number": 7362, "timestamp_epoch": "1631316293.107545000", "src_ip": "10.9.10.102", "dst_ip": "20.50.73.10", "src_port": 58184, "dst_port": 443, "tcp_stream": 103, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "v10.events.data.microsoft.com", "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4" } }, { "event_id": "evt-5a86cebfe6f71653a7ddb6cc", "kind": "tls_client_hello", "frame_number": 7382, "timestamp_epoch": "1631316294.516983000", "src_ip": "10.9.10.102", "dst_ip": "94.158.245.52", "src_port": 58185, "dst_port": 443, "tcp_stream": 104, "udp_stream": null, "fields": { "tls.handshake.ja3": "51c64c77e60f3980eea90869b68c58a8" } }, { "event_id": "evt-a1b28b7c6ad7b7b78a653f6a", "kind": "tls_client_hello", "frame_number": 7402, "timestamp_epoch": "1631316297.355750000", "src_ip": "10.9.10.102", "dst_ip": "94.158.245.52", "src_port": 58186, "dst_port": 443, "tcp_stream": 105, "udp_stream": null, "fields": { "tls.handshake.ja3": "51c64c77e60f3980eea90869b68c58a8" } }, { "event_id": "evt-3506c9c4a241626b06cfc7f4", "kind": "tls_client_hello", "frame_number": 7425, "timestamp_epoch": "1631316303.946199000", "src_ip": "10.9.10.102", "dst_ip": "20.50.73.10", "src_port": 58187, "dst_port": 443, "tcp_stream": 106, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "v10.events.data.microsoft.com", "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4" } }, { "event_id": "evt-155334a3859709cbcf1e0a7f", "kind": "tls_client_hello", "frame_number": 7457, "timestamp_epoch": "1631316326.793867000", "src_ip": "10.9.10.102", "dst_ip": "52.137.106.217", "src_port": 58188, "dst_port": 443, "tcp_stream": 107, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "settings-win.data.microsoft.com", "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4" } }, { "event_id": "evt-3bc700d4d69185c1a1692ffc", "kind": "tls_client_hello", "frame_number": 7480, "timestamp_epoch": "1631316328.682953000", "src_ip": "10.9.10.102", "dst_ip": "52.137.106.217", "src_port": 58189, "dst_port": 443, "tcp_stream": 108, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "settings-win.data.microsoft.com", "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4" } }, { "event_id": "evt-7c97c829a2e4e3d5c893fdf3", "kind": "tls_client_hello", "frame_number": 7504, "timestamp_epoch": "1631316330.094014000", "src_ip": "10.9.10.102", "dst_ip": "52.137.106.217", "src_port": 58190, "dst_port": 443, "tcp_stream": 109, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "settings-win.data.microsoft.com", "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4" } }, { "event_id": "evt-6b6b915ec3c53d25c0cddb47", "kind": "tls_client_hello", "frame_number": 7526, "timestamp_epoch": "1631316330.807884000", "src_ip": "10.9.10.102", "dst_ip": "52.137.106.217", "src_port": 58191, "dst_port": 443, "tcp_stream": 110, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "settings-win.data.microsoft.com", "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4" } }, { "event_id": "evt-ee9c5018e87994832a41100c", "kind": "tls_client_hello", "frame_number": 7590, "timestamp_epoch": "1631316382.609018000", "src_ip": "10.9.10.102", "dst_ip": "20.189.173.7", "src_port": 58192, "dst_port": 443, "tcp_stream": 111, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "v10.events.data.microsoft.com", "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4" } }, { "event_id": "evt-4f8927bbcbfd803fe2309145", "kind": "tls_client_hello", "frame_number": 7674, "timestamp_epoch": "1631316667.709165000", "src_ip": "10.9.10.102", "dst_ip": "94.158.245.52", "src_port": 58194, "dst_port": 443, "tcp_stream": 113, "udp_stream": null, "fields": { "tls.handshake.ja3": "51c64c77e60f3980eea90869b68c58a8" } }, { "event_id": "evt-e853a431f88479f18b0471b5", "kind": "tls_client_hello", "frame_number": 7697, "timestamp_epoch": "1631316671.225931000", "src_ip": "10.9.10.102", "dst_ip": "94.158.245.52", "src_port": 58195, "dst_port": 443, "tcp_stream": 114, "udp_stream": null, "fields": { "tls.handshake.ja3": "51c64c77e60f3980eea90869b68c58a8" } }, { "event_id": "evt-4cd24cce0d299910f1b5ff5e", "kind": "tls_client_hello", "frame_number": 7746, "timestamp_epoch": "1631316926.532191000", "src_ip": "10.9.10.102", "dst_ip": "204.79.197.200", "src_port": 58196, "dst_port": 443, "tcp_stream": 115, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "www.bing.com", "tls.handshake.ja3": "6271f898ce5be7dd52b0fc260d0662b3" } }, { "event_id": "evt-12be39c4c7f4ab6598850f45", "kind": "tls_client_hello", "frame_number": 7770, "timestamp_epoch": "1631317013.932371000", "src_ip": "10.9.10.102", "dst_ip": "94.158.245.52", "src_port": 58197, "dst_port": 443, "tcp_stream": 116, "udp_stream": null, "fields": { "tls.handshake.ja3": "51c64c77e60f3980eea90869b68c58a8" } }, { "event_id": "evt-bbd8fbc18c212d1f7863608a", "kind": "tls_client_hello", "frame_number": 7793, "timestamp_epoch": "1631317019.554089000", "src_ip": "10.9.10.102", "dst_ip": "94.158.245.52", "src_port": 58198, "dst_port": 443, "tcp_stream": 117, "udp_stream": null, "fields": { "tls.handshake.ja3": "51c64c77e60f3980eea90869b68c58a8" } }, { "event_id": "evt-13f37498ef5288702b032ae2", "kind": "tls_client_hello", "frame_number": 7841, "timestamp_epoch": "1631317324.194424000", "src_ip": "10.9.10.102", "dst_ip": "94.158.245.52", "src_port": 58199, "dst_port": 443, "tcp_stream": 118, "udp_stream": null, "fields": { "tls.handshake.ja3": "51c64c77e60f3980eea90869b68c58a8" } }, { "event_id": "evt-cd97ccd452c082151fbbd390", "kind": "tls_client_hello", "frame_number": 7860, "timestamp_epoch": "1631317327.706122000", "src_ip": "10.9.10.102", "dst_ip": "94.158.245.52", "src_port": 58200, "dst_port": 443, "tcp_stream": 119, "udp_stream": null, "fields": { "tls.handshake.ja3": "51c64c77e60f3980eea90869b68c58a8" } }, { "event_id": "evt-32d2538dc97b0ad4eb0c4b46", "kind": "tls_client_hello", "frame_number": 7947, "timestamp_epoch": "1631317832.668825000", "src_ip": "10.9.10.102", "dst_ip": "94.158.245.52", "src_port": 58202, "dst_port": 443, "tcp_stream": 121, "udp_stream": null, "fields": { "tls.handshake.ja3": "51c64c77e60f3980eea90869b68c58a8" } }, { "event_id": "evt-989272922bc02726501ec274", "kind": "tls_client_hello", "frame_number": 7968, "timestamp_epoch": "1631317835.488335000", "src_ip": "10.9.10.102", "dst_ip": "94.158.245.52", "src_port": 58203, "dst_port": 443, "tcp_stream": 122, "udp_stream": null, "fields": { "tls.handshake.ja3": "51c64c77e60f3980eea90869b68c58a8" } }, { "event_id": "evt-557636accbf51a50112e5f39", "kind": "tls_client_hello", "frame_number": 7995, "timestamp_epoch": "1631317871.606825000", "src_ip": "10.9.10.102", "dst_ip": "13.107.5.88", "src_port": 58204, "dst_port": 443, "tcp_stream": 123, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "evoke-windowsservices-tas.msedge.net", "tls.handshake.ja3": "6271f898ce5be7dd52b0fc260d0662b3" } }, { "event_id": "evt-5c7a962e2b40421126d9a6b4", "kind": "tls_client_hello", "frame_number": 8048, "timestamp_epoch": "1631317952.271909000", "src_ip": "10.9.10.102", "dst_ip": "13.69.239.72", "src_port": 58206, "dst_port": 443, "tcp_stream": 125, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "v10.events.data.microsoft.com", "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4" } }, { "event_id": "evt-f1d8d2ed82d71c5c08c9426a", "kind": "tls_client_hello", "frame_number": 8082, "timestamp_epoch": "1631318194.461483000", "src_ip": "10.9.10.102", "dst_ip": "94.158.245.52", "src_port": 58207, "dst_port": 443, "tcp_stream": 126, "udp_stream": null, "fields": { "tls.handshake.ja3": "51c64c77e60f3980eea90869b68c58a8" } }, { "event_id": "evt-8b00f158e91d80890bb03eb2", "kind": "tls_client_hello", "frame_number": 8104, "timestamp_epoch": "1631318197.177106000", "src_ip": "10.9.10.102", "dst_ip": "94.158.245.52", "src_port": 58208, "dst_port": 443, "tcp_stream": 127, "udp_stream": null, "fields": { "tls.handshake.ja3": "51c64c77e60f3980eea90869b68c58a8" } }, { "event_id": "evt-bde3325e569aeefb6cf14f34", "kind": "tls_client_hello", "frame_number": 8188, "timestamp_epoch": "1631318520.735515000", "src_ip": "10.9.10.102", "dst_ip": "52.109.8.22", "src_port": 58210, "dst_port": 443, "tcp_stream": 129, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "nexus.officeapps.live.com", "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4" } }, { "event_id": "evt-9a6562cfb9dd9c07939d6e58", "kind": "tls_client_hello", "frame_number": 8210, "timestamp_epoch": "1631318587.243185000", "src_ip": "10.9.10.102", "dst_ip": "94.158.245.52", "src_port": 58211, "dst_port": 443, "tcp_stream": 130, "udp_stream": null, "fields": { "tls.handshake.ja3": "51c64c77e60f3980eea90869b68c58a8" } }, { "event_id": "evt-52fd7406e9abaf29d809158c", "kind": "tls_client_hello", "frame_number": 8231, "timestamp_epoch": "1631318589.127766000", "src_ip": "10.9.10.102", "dst_ip": "94.158.245.52", "src_port": 58212, "dst_port": 443, "tcp_stream": 131, "udp_stream": null, "fields": { "tls.handshake.ja3": "51c64c77e60f3980eea90869b68c58a8" } }, { "event_id": "evt-476099945e1bde33e2ee1e1b", "kind": "tls_client_hello", "frame_number": 8271, "timestamp_epoch": "1631318780.204428000", "src_ip": "10.9.10.102", "dst_ip": "94.158.245.52", "src_port": 58213, "dst_port": 443, "tcp_stream": 132, "udp_stream": null, "fields": { "tls.handshake.ja3": "51c64c77e60f3980eea90869b68c58a8" } }, { "event_id": "evt-33cee20a27ca7f1324274b02", "kind": "tls_client_hello", "frame_number": 8288, "timestamp_epoch": "1631318782.333112000", "src_ip": "10.9.10.102", "dst_ip": "94.158.245.52", "src_port": 58214, "dst_port": 443, "tcp_stream": 133, "udp_stream": null, "fields": { "tls.handshake.ja3": "51c64c77e60f3980eea90869b68c58a8" } }, { "event_id": "evt-58a7de4e07613d273316401d", "kind": "tls_client_hello", "frame_number": 8342, "timestamp_epoch": "1631318946.145996000", "src_ip": "10.9.10.102", "dst_ip": "172.217.168.195", "src_port": 58215, "dst_port": 443, "tcp_stream": 134, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "update.googleapis.com", "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4" } }, { "event_id": "evt-6dd1a088189bcd2449022371", "kind": "tls_client_hello", "frame_number": 8380, "timestamp_epoch": "1631318968.260301000", "src_ip": "10.9.10.102", "dst_ip": "52.137.106.217", "src_port": 58216, "dst_port": 443, "tcp_stream": 135, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "settings-win.data.microsoft.com", "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4" } }, { "event_id": "evt-bef1c14807b6f07668259729", "kind": "tls_client_hello", "frame_number": 8403, "timestamp_epoch": "1631318973.635253000", "src_ip": "10.9.10.102", "dst_ip": "40.126.26.135", "src_port": 58217, "dst_port": 443, "tcp_stream": 136, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "login.live.com", "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4" } }, { "event_id": "evt-2fbb794be4cdfe1460b2c6ee", "kind": "tls_client_hello", "frame_number": 8481, "timestamp_epoch": "1631319236.858219000", "src_ip": "10.9.10.102", "dst_ip": "94.158.245.52", "src_port": 58219, "dst_port": 443, "tcp_stream": 138, "udp_stream": null, "fields": { "tls.handshake.ja3": "51c64c77e60f3980eea90869b68c58a8" } }, { "event_id": "evt-cd16252f0e49de5086d56b6f", "kind": "tls_client_hello", "frame_number": 8501, "timestamp_epoch": "1631319239.882134000", "src_ip": "10.9.10.102", "dst_ip": "94.158.245.52", "src_port": 58220, "dst_port": 443, "tcp_stream": 139, "udp_stream": null, "fields": { "tls.handshake.ja3": "51c64c77e60f3980eea90869b68c58a8" } }, { "event_id": "evt-9763023103ef8dd70050df13", "kind": "tls_client_hello", "frame_number": 8584, "timestamp_epoch": "1631319588.010547000", "src_ip": "10.9.10.102", "dst_ip": "94.158.245.52", "src_port": 58222, "dst_port": 443, "tcp_stream": 141, "udp_stream": null, "fields": { "tls.handshake.ja3": "51c64c77e60f3980eea90869b68c58a8" } }, { "event_id": "evt-d44cf72b436776764b3e14f4", "kind": "tls_client_hello", "frame_number": 8608, "timestamp_epoch": "1631319592.221626000", "src_ip": "10.9.10.102", "dst_ip": "94.158.245.52", "src_port": 58223, "dst_port": 443, "tcp_stream": 142, "udp_stream": null, "fields": { "tls.handshake.ja3": "51c64c77e60f3980eea90869b68c58a8" } }, { "event_id": "evt-1226a11c609c2c51d2d09513", "kind": "tls_client_hello", "frame_number": 8626, "timestamp_epoch": "1631319595.781636000", "src_ip": "10.9.10.102", "dst_ip": "94.158.245.52", "src_port": 58224, "dst_port": 443, "tcp_stream": 143, "udp_stream": null, "fields": { "tls.handshake.ja3": "51c64c77e60f3980eea90869b68c58a8" } }, { "event_id": "evt-50f4dc915e40257f4e532865", "kind": "tls_client_hello", "frame_number": 8659, "timestamp_epoch": "1631319727.425336000", "src_ip": "10.9.10.102", "dst_ip": "20.42.73.25", "src_port": 58225, "dst_port": 443, "tcp_stream": 144, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "v10.events.data.microsoft.com", "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4" } }, { "event_id": "evt-71dbfd770fad1e15668807d9", "kind": "tls_client_hello", "frame_number": 8773, "timestamp_epoch": "1631319861.047360000", "src_ip": "10.9.10.102", "dst_ip": "94.158.245.52", "src_port": 58230, "dst_port": 443, "tcp_stream": 149, "udp_stream": null, "fields": { "tls.handshake.ja3": "51c64c77e60f3980eea90869b68c58a8" } }, { "event_id": "evt-621c47267bcc0b1bd9b2ca40", "kind": "tls_client_hello", "frame_number": 8790, "timestamp_epoch": "1631319864.587955000", "src_ip": "10.9.10.102", "dst_ip": "94.158.245.52", "src_port": 58231, "dst_port": 443, "tcp_stream": 150, "udp_stream": null, "fields": { "tls.handshake.ja3": "51c64c77e60f3980eea90869b68c58a8" } }, { "event_id": "evt-f186b20092c9ac035855deee", "kind": "tls_client_hello", "frame_number": 8837, "timestamp_epoch": "1631320035.320447000", "src_ip": "10.9.10.102", "dst_ip": "94.158.245.52", "src_port": 58232, "dst_port": 443, "tcp_stream": 151, "udp_stream": null, "fields": { "tls.handshake.ja3": "51c64c77e60f3980eea90869b68c58a8" } }, { "event_id": "evt-0bb0d9659ecfaf8d5287a1ad", "kind": "tls_client_hello", "frame_number": 8860, "timestamp_epoch": "1631320038.844492000", "src_ip": "10.9.10.102", "dst_ip": "94.158.245.52", "src_port": 58233, "dst_port": 443, "tcp_stream": 152, "udp_stream": null, "fields": { "tls.handshake.ja3": "51c64c77e60f3980eea90869b68c58a8" } }, { "event_id": "evt-245846101cf588bf77bad23c", "kind": "tls_client_hello", "frame_number": 9119, "timestamp_epoch": "1631320217.101408000", "src_ip": "10.9.10.102", "dst_ip": "94.158.245.52", "src_port": 58239, "dst_port": 443, "tcp_stream": 158, "udp_stream": null, "fields": { "tls.handshake.ja3": "51c64c77e60f3980eea90869b68c58a8" } }, { "event_id": "evt-aaee37da74f1d24153b94788", "kind": "tls_client_hello", "frame_number": 9137, "timestamp_epoch": "1631320220.638845000", "src_ip": "10.9.10.102", "dst_ip": "94.158.245.52", "src_port": 58240, "dst_port": 443, "tcp_stream": 159, "udp_stream": null, "fields": { "tls.handshake.ja3": "51c64c77e60f3980eea90869b68c58a8" } }, { "event_id": "evt-9ce4192e80d4f7f534423f68", "kind": "tls_client_hello", "frame_number": 9208, "timestamp_epoch": "1631320316.499210000", "src_ip": "10.9.10.102", "dst_ip": "52.109.8.25", "src_port": 58241, "dst_port": 443, "tcp_stream": 160, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "nexus.officeapps.live.com", "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4" } } ], "dhcp": [ { "event_id": "evt-0b0da3272998167405d7ea96", "kind": "dhcp", "frame_number": 1, "timestamp_epoch": "1631315707.787295000", "src_ip": "0.0.0.0", "dst_ip": "255.255.255.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 0, "fields": { "dhcp.hw.mac_addr": "00:4f:49:b1:e8:c3,00:4f:49:b1:e8:c3", "dhcp.ip.your": "0.0.0.0", "dhcp.option.dhcp": "1", "dhcp.option.hostname": "DESKTOP-KKITB6Q", "dhcp.option.requested_ip_address": "10.9.10.102", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-26a1ac0c5829cf862c2efdd4", "kind": "dhcp", "frame_number": 2, "timestamp_epoch": "1631315707.787997000", "src_ip": "10.9.10.9", "dst_ip": "255.255.255.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 1, "fields": { "dhcp.hw.mac_addr": "00:4f:49:b1:e8:c3", "dhcp.ip.your": "10.9.10.102", "dhcp.option.dhcp": "2", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-defcdd5625dd422957b4eefa", "kind": "dhcp", "frame_number": 3, "timestamp_epoch": "1631315707.790675000", "src_ip": "0.0.0.0", "dst_ip": "255.255.255.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 0, "fields": { "dhcp.hw.mac_addr": "00:4f:49:b1:e8:c3,00:4f:49:b1:e8:c3", "dhcp.ip.your": "0.0.0.0", "dhcp.option.dhcp": "3", "dhcp.option.hostname": "DESKTOP-KKITB6Q", "dhcp.option.requested_ip_address": "10.9.10.102", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-f123d94140815b70cf878fc2", "kind": "dhcp", "frame_number": 4, "timestamp_epoch": "1631315707.791650000", "src_ip": "10.9.10.9", "dst_ip": "255.255.255.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 1, "fields": { "dhcp.hw.mac_addr": "00:4f:49:b1:e8:c3", "dhcp.ip.your": "10.9.10.102", "dhcp.option.dhcp": "5", "eth.src": "14:18:77:0f:c6:9e" } } ], "identity": [ { "event_id": "evt-2e0acba1f053a8eb7ac9763c", "kind": "identity", "frame_number": 5, "timestamp_epoch": "1631315707.932871000", "src_ip": "169.254.181.227", "dst_ip": "169.254.255.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 2, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:4f:49:b1:e8:c3", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "DESKTOP-KKITB6Q<20>,DESKTOP-KKITB6Q<20> (Server service)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-92cb77999bfe9c69dc01f0d6", "kind": "identity", "frame_number": 6, "timestamp_epoch": "1631315707.932872000", "src_ip": "169.254.181.227", "dst_ip": "169.254.255.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 2, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:4f:49:b1:e8:c3", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "DESKTOP-KKITB6Q<00>,DESKTOP-KKITB6Q<00> (Workstation/Redirector)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-dd3e04ae66dfc596bb8c436d", "kind": "identity", "frame_number": 7, "timestamp_epoch": "1631315707.932873000", "src_ip": "169.254.181.227", "dst_ip": "169.254.255.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 2, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:4f:49:b1:e8:c3", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "ANGRYPOUTINE<00>,ANGRYPOUTINE<00> (Workstation/Redirector)", "nbns.nb_flags.group": "True" } }, { "event_id": "evt-64f51156db083a9eff72a054", "kind": "identity", "frame_number": 8, "timestamp_epoch": "1631315708.684598000", "src_ip": "169.254.181.227", "dst_ip": "169.254.255.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 2, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:4f:49:b1:e8:c3", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "ANGRYPOUTINE<00>,ANGRYPOUTINE<00> (Workstation/Redirector)", "nbns.nb_flags.group": "True" } }, { "event_id": "evt-8cbbec2e8b3272af8648abdf", "kind": "identity", "frame_number": 9, "timestamp_epoch": "1631315708.684599000", "src_ip": "169.254.181.227", "dst_ip": "169.254.255.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 2, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:4f:49:b1:e8:c3", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "DESKTOP-KKITB6Q<00>,DESKTOP-KKITB6Q<00> (Workstation/Redirector)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-4f9f270a11210f2a24f71999", "kind": "identity", "frame_number": 10, "timestamp_epoch": "1631315708.684600000", "src_ip": "169.254.181.227", "dst_ip": "169.254.255.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 2, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:4f:49:b1:e8:c3", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "DESKTOP-KKITB6Q<20>,DESKTOP-KKITB6Q<20> (Server service)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-a5984a9347a94d938fc1a755", "kind": "identity", "frame_number": 11, "timestamp_epoch": "1631315709.495571000", "src_ip": "169.254.181.227", "dst_ip": "169.254.255.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 2, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:4f:49:b1:e8:c3", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "ANGRYPOUTINE<1e>,ANGRYPOUTINE<1e> (Browser Election Service)", "nbns.nb_flags.group": "True" } }, { "event_id": "evt-5321ba04ce37790add5d6a25", "kind": "identity", "frame_number": 27, "timestamp_epoch": "1631315709.550831000", "src_ip": "10.9.10.102", "dst_ip": "224.0.0.251", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 6, "fields": { "dns.qry.name": "DESKTOP-KKITB6Q.local", "eth.dst": "01:00:5e:00:00:fb", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-4ff2a97a9213678ac1149ff2", "kind": "identity", "frame_number": 28, "timestamp_epoch": "1631315709.550832000", "src_ip": "10.9.10.102", "dst_ip": "224.0.0.251", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 6, "fields": { "eth.dst": "01:00:5e:00:00:fb", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-f0bc5386a2bc80ba7e7e7c21", "kind": "identity", "frame_number": 29, "timestamp_epoch": "1631315709.551279000", "src_ip": "10.9.10.102", "dst_ip": "224.0.0.252", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 7, "fields": { "dns.qry.name": "DESKTOP-KKITB6Q", "eth.dst": "01:00:5e:00:00:fc", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-51451dd58c5dc034049051d3", "kind": "identity", "frame_number": 31, "timestamp_epoch": "1631315709.575825000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 8, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:4f:49:b1:e8:c3", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "DESKTOP-KKITB6Q<20>,DESKTOP-KKITB6Q<20> (Server service)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-b3eed8cf50c223b354c12e86", "kind": "identity", "frame_number": 35, "timestamp_epoch": "1631315710.258173000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 8, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:4f:49:b1:e8:c3", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "ANGRYPOUTINE<1e>,ANGRYPOUTINE<1e> (Browser Election Service)", "nbns.nb_flags.group": "True" } }, { "event_id": "evt-159a4be70a1aa3f2df77f973", "kind": "identity", "frame_number": 36, "timestamp_epoch": "1631315710.353794000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 8, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:4f:49:b1:e8:c3", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "DESKTOP-KKITB6Q<20>,DESKTOP-KKITB6Q<20> (Server service)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-50920511aafaa4c467be22f7", "kind": "identity", "frame_number": 38, "timestamp_epoch": "1631315711.017650000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 8, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:4f:49:b1:e8:c3", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "ANGRYPOUTINE<1e>,ANGRYPOUTINE<1e> (Browser Election Service)", "nbns.nb_flags.group": "True" } }, { "event_id": "evt-02b57160dcbf470812f72649", "kind": "identity", "frame_number": 43, "timestamp_epoch": "1631315711.117648000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 8, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:4f:49:b1:e8:c3", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "DESKTOP-KKITB6Q<20>,DESKTOP-KKITB6Q<20> (Server service)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-10c5d69928990b8f2e3dce63", "kind": "identity", "frame_number": 50, "timestamp_epoch": "1631315711.789000000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 8, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:4f:49:b1:e8:c3", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "ANGRYPOUTINE<1e>,ANGRYPOUTINE<1e> (Browser Election Service)", "nbns.nb_flags.group": "True" } }, { "event_id": "evt-32551e47da86eef43e27796e", "kind": "identity", "frame_number": 52, "timestamp_epoch": "1631315711.869204000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 8, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:4f:49:b1:e8:c3", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "DESKTOP-KKITB6Q<20>,DESKTOP-KKITB6Q<20> (Server service)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-7daee5e2e2f1bd2c30fcffba", "kind": "identity", "frame_number": 53, "timestamp_epoch": "1631315712.599977000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 8, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:4f:49:b1:e8:c3", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "ANGRYPOUTINE<00>,ANGRYPOUTINE<00> (Workstation/Redirector)", "nbns.nb_flags.group": "True" } }, { "event_id": "evt-1ad7220cd8c3bec857cf8b3f", "kind": "identity", "frame_number": 54, "timestamp_epoch": "1631315712.599978000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 8, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:4f:49:b1:e8:c3", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "DESKTOP-KKITB6Q<00>,DESKTOP-KKITB6Q<00> (Workstation/Redirector)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-242a4ce5d2ecd0a67c55081a", "kind": "identity", "frame_number": 55, "timestamp_epoch": "1631315712.687123000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 14, "fields": { "browser.server": "DESKTOP-KKITB6Q", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-55a970362f2fdd9492a9d8bb", "kind": "identity", "frame_number": 58, "timestamp_epoch": "1631315713.358829000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 8, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:4f:49:b1:e8:c3", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "DESKTOP-KKITB6Q<00>,DESKTOP-KKITB6Q<00> (Workstation/Redirector)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-3dd5e1f35660908345672a80", "kind": "identity", "frame_number": 59, "timestamp_epoch": "1631315713.358831000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 8, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:4f:49:b1:e8:c3", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "ANGRYPOUTINE<00>,ANGRYPOUTINE<00> (Workstation/Redirector)", "nbns.nb_flags.group": "True" } }, { "event_id": "evt-4969e5106e8fb765f364e7e0", "kind": "identity", "frame_number": 60, "timestamp_epoch": "1631315714.122639000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 8, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:4f:49:b1:e8:c3", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "ANGRYPOUTINE<00>,ANGRYPOUTINE<00> (Workstation/Redirector)", "nbns.nb_flags.group": "True" } }, { "event_id": "evt-5515077709dcaa3f77761b7c", "kind": "identity", "frame_number": 61, "timestamp_epoch": "1631315714.122641000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 8, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:4f:49:b1:e8:c3", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "DESKTOP-KKITB6Q<00>,DESKTOP-KKITB6Q<00> (Workstation/Redirector)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-c356485557e83725ef551137", "kind": "identity", "frame_number": 72, "timestamp_epoch": "1631315714.885657000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 8, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:4f:49:b1:e8:c3", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "DESKTOP-KKITB6Q<00>,DESKTOP-KKITB6Q<00> (Workstation/Redirector)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-ebef94e61d44894c007b37d2", "kind": "identity", "frame_number": 73, "timestamp_epoch": "1631315714.885658000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 8, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:4f:49:b1:e8:c3", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "ANGRYPOUTINE<00>,ANGRYPOUTINE<00> (Workstation/Redirector)", "nbns.nb_flags.group": "True" } }, { "event_id": "evt-a541013975e792fd6f17484f", "kind": "identity", "frame_number": 80, "timestamp_epoch": "1631315714.903567000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3", "kerberos.msg_type": "14" } }, { "event_id": "evt-1e1c9f8f4d5b9a46520c3216", "kind": "identity", "frame_number": 82, "timestamp_epoch": "1631315714.905140000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e", "kerberos.msg_type": "15" } }, { "event_id": "evt-416f842835e5c454e67f5822", "kind": "identity", "frame_number": 98, "timestamp_epoch": "1631315715.685778000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 14, "fields": { "browser.response_computer_name": "DESKTOP-KKITB6Q", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-cf6f761f1772b956a21e3207", "kind": "identity", "frame_number": 121, "timestamp_epoch": "1631315717.199232000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 14, "fields": { "browser.response_computer_name": "DESKTOP-KKITB6Q", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-e5712560f07d15a9389e0cb6", "kind": "identity", "frame_number": 123, "timestamp_epoch": "1631315718.747751000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 8, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:4f:49:b1:e8:c3", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "ANGRYPOUTINE<1e>,ANGRYPOUTINE<1e> (Browser Election Service)", "nbns.nb_flags.group": "True" } }, { "event_id": "evt-55e19d00fa5d44ac9fb3e491", "kind": "identity", "frame_number": 127, "timestamp_epoch": "1631315719.511263000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 8, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:4f:49:b1:e8:c3", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "ANGRYPOUTINE<1e>,ANGRYPOUTINE<1e> (Browser Election Service)", "nbns.nb_flags.group": "True" } }, { "event_id": "evt-934b3acc345f3f67c34107b7", "kind": "identity", "frame_number": 128, "timestamp_epoch": "1631315720.278616000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 8, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:4f:49:b1:e8:c3", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "ANGRYPOUTINE<1e>,ANGRYPOUTINE<1e> (Browser Election Service)", "nbns.nb_flags.group": "True" } }, { "event_id": "evt-0592e51ed42f7d9fe947dc58", "kind": "identity", "frame_number": 129, "timestamp_epoch": "1631315721.040842000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 8, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:4f:49:b1:e8:c3", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "ANGRYPOUTINE<1e>,ANGRYPOUTINE<1e> (Browser Election Service)", "nbns.nb_flags.group": "True" } }, { "event_id": "evt-1a88abe03d3c6dd48341fb3d", "kind": "identity", "frame_number": 131, "timestamp_epoch": "1631315721.834465000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 14, "fields": { "browser.response_computer_name": "DESKTOP-KKITB6Q", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-0534004dc128b5711132db3a", "kind": "identity", "frame_number": 132, "timestamp_epoch": "1631315721.842967000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 14, "fields": { "browser.server": "DESKTOP-KKITB6Q", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-382f9308f83a5eb12ddef99e", "kind": "identity", "frame_number": 141, "timestamp_epoch": "1631315745.514496000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 3, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-e9d5fed8357bad61a7af08e0", "kind": "identity", "frame_number": 142, "timestamp_epoch": "1631315745.516004000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 3, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-41ec98823f55c52dcd4427ee", "kind": "identity", "frame_number": 143, "timestamp_epoch": "1631315745.516603000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 3, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-0bac4d2c9342a49ecc1a5ab3", "kind": "identity", "frame_number": 146, "timestamp_epoch": "1631315745.520131000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 3, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3", "kerberos.msg_type": "14" } }, { "event_id": "evt-c03eccd93501dfc6322694e5", "kind": "identity", "frame_number": 148, "timestamp_epoch": "1631315745.522228000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 3, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e", "kerberos.msg_type": "15" } }, { "event_id": "evt-c54541f6ae388631a4d0dcee", "kind": "identity", "frame_number": 149, "timestamp_epoch": "1631315745.524609000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 3, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-6eabe3ae8088573a48b722f0", "kind": "identity", "frame_number": 150, "timestamp_epoch": "1631315745.524761000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 3, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-f5cf41c2d74df6846d9d9eb6", "kind": "identity", "frame_number": 151, "timestamp_epoch": "1631315745.526976000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 3, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-b8275640ca139bc9bb59d65f", "kind": "identity", "frame_number": 152, "timestamp_epoch": "1631315745.526977000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 3, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-08416892d77444474ce3119b", "kind": "identity", "frame_number": 154, "timestamp_epoch": "1631315745.527187000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 3, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-3ac7f6ea1d5275f4ae7a6a08", "kind": "identity", "frame_number": 155, "timestamp_epoch": "1631315745.527433000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 3, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-aa89e720af776287636bf65b", "kind": "identity", "frame_number": 157, "timestamp_epoch": "1631315756.228762000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 3, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-4c07a0cfc9c8901af653a3f5", "kind": "identity", "frame_number": 158, "timestamp_epoch": "1631315756.228990000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 3, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-9f0ffa7df81c42bd0de7cd6b", "kind": "identity", "frame_number": 159, "timestamp_epoch": "1631315756.230519000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 3, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-8fd62c46e0a464000bc540cb", "kind": "identity", "frame_number": 160, "timestamp_epoch": "1631315756.230779000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 3, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-e90d02b8d0ae8d819e11cbcd", "kind": "identity", "frame_number": 300, "timestamp_epoch": "1631315815.761043000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 11, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3", "kerberos.CNameString": "hobart.gunnarsson", "kerberos.msg_type": "10" } }, { "event_id": "evt-3ef16617394c5cc8a6afe669", "kind": "identity", "frame_number": 302, "timestamp_epoch": "1631315815.762030000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 11, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e", "kerberos.msg_type": "30" } }, { "event_id": "evt-83cc32cf00d4b136b9140121", "kind": "identity", "frame_number": 311, "timestamp_epoch": "1631315815.983665000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3", "kerberos.CNameString": "hobart.gunnarsson", "kerberos.msg_type": "10" } }, { "event_id": "evt-821c76323867707ecdeeca22", "kind": "identity", "frame_number": 315, "timestamp_epoch": "1631315815.985466000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e", "kerberos.CNameString": "hobart.gunnarsson", "kerberos.msg_type": "11" } }, { "event_id": "evt-e98c572fd5e083ef08087f76", "kind": "identity", "frame_number": 329, "timestamp_epoch": "1631315815.994240000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 14, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3", "kerberos.msg_type": "12,14" } }, { "event_id": "evt-3e690bc0f2b2e095a1443860", "kind": "identity", "frame_number": 332, "timestamp_epoch": "1631315815.995245000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 14, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e", "kerberos.CNameString": "hobart.gunnarsson", "kerberos.msg_type": "13" } }, { "event_id": "evt-cd5ffd5a2a1b15931ddb4916", "kind": "identity", "frame_number": 341, "timestamp_epoch": "1631315815.996631000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 16, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3", "kerberos.CNameString": "hobart.gunnarsson", "kerberos.msg_type": "10" } }, { "event_id": "evt-63a1c695b4944e819a704057", "kind": "identity", "frame_number": 342, "timestamp_epoch": "1631315815.996983000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 16, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e", "kerberos.msg_type": "30" } }, { "event_id": "evt-176d2fbacc7f5d5c77a2702b", "kind": "identity", "frame_number": 350, "timestamp_epoch": "1631315816.020222000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 17, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3", "kerberos.CNameString": "hobart.gunnarsson", "kerberos.msg_type": "10" } }, { "event_id": "evt-f18e532fee5edd7a2afb5145", "kind": "identity", "frame_number": 352, "timestamp_epoch": "1631315816.021278000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 17, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e", "kerberos.CNameString": "hobart.gunnarsson", "kerberos.msg_type": "11" } }, { "event_id": "evt-0f9c602b1e0961543c106fa7", "kind": "identity", "frame_number": 363, "timestamp_epoch": "1631315816.108829000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 18, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3", "kerberos.msg_type": "12,14" } }, { "event_id": "evt-2da204e8232bc640fa7d9864", "kind": "identity", "frame_number": 367, "timestamp_epoch": "1631315816.109766000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 18, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e", "kerberos.CNameString": "hobart.gunnarsson", "kerberos.msg_type": "13" } }, { "event_id": "evt-5055e9c465ce872a8fee10f3", "kind": "identity", "frame_number": 368, "timestamp_epoch": "1631315816.110555000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-402c7d09f9e8fe9f83d3afd6", "kind": "identity", "frame_number": 373, "timestamp_epoch": "1631315816.111087000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-16518cdfc74cf5cdd3f79640", "kind": "identity", "frame_number": 375, "timestamp_epoch": "1631315816.111775000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 15, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3", "kerberos.msg_type": "14" } }, { "event_id": "evt-c911b29fb1e3243563ab5ad9", "kind": "identity", "frame_number": 377, "timestamp_epoch": "1631315816.112496000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 15, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e", "kerberos.msg_type": "15" } }, { "event_id": "evt-d9c4327b90cd7e14b946486c", "kind": "identity", "frame_number": 382, "timestamp_epoch": "1631315816.200561000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 15, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3", "kerberos.msg_type": "15" } }, { "event_id": "evt-b9fd263c7c61ab8115fb36e5", "kind": "identity", "frame_number": 388, "timestamp_epoch": "1631315816.202209000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 20, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3", "kerberos.msg_type": "12,14" } }, { "event_id": "evt-8ead93fbe9b3ce0a800d6f68", "kind": "identity", "frame_number": 393, "timestamp_epoch": "1631315816.203285000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 20, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e", "kerberos.CNameString": "hobart.gunnarsson", "kerberos.msg_type": "13" } }, { "event_id": "evt-e5c4e53dfe35b65978dacacd", "kind": "identity", "frame_number": 403, "timestamp_epoch": "1631315816.205311000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3", "kerberos.msg_type": "12,14" } }, { "event_id": "evt-fd4c02bbcb82dc4f6a805cf4", "kind": "identity", "frame_number": 408, "timestamp_epoch": "1631315816.206084000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e", "kerberos.CNameString": "hobart.gunnarsson", "kerberos.msg_type": "13" } }, { "event_id": "evt-57ce7173b29466f0a685a8de", "kind": "identity", "frame_number": 415, "timestamp_epoch": "1631315816.207719000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3", "kerberos.msg_type": "14" } }, { "event_id": "evt-02838b3c2277dc392be0abbd", "kind": "identity", "frame_number": 419, "timestamp_epoch": "1631315816.208630000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e", "kerberos.msg_type": "15" } }, { "event_id": "evt-010b4d57b4a346460137cdf4", "kind": "identity", "frame_number": 420, "timestamp_epoch": "1631315816.210792000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-e5fb662388631c9534426b7c", "kind": "identity", "frame_number": 421, "timestamp_epoch": "1631315816.211054000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-bfb2e1e7244c7da8e9e202ef", "kind": "identity", "frame_number": 422, "timestamp_epoch": "1631315816.224416000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-8a6602bfee6b40ea98a48aad", "kind": "identity", "frame_number": 423, "timestamp_epoch": "1631315816.224704000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-26ecd8c50cf4b7428a64a4fe", "kind": "identity", "frame_number": 424, "timestamp_epoch": "1631315816.224705000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-9b8662cc5de3fb447741cdae", "kind": "identity", "frame_number": 425, "timestamp_epoch": "1631315816.224796000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-f8ea31bc2627b17be365123b", "kind": "identity", "frame_number": 427, "timestamp_epoch": "1631315816.226110000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-3c2017dbaf19f9296910cbf8", "kind": "identity", "frame_number": 428, "timestamp_epoch": "1631315816.226152000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-d4546e888e2643cd65d744da", "kind": "identity", "frame_number": 429, "timestamp_epoch": "1631315816.226306000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-2bc3c8bce99599412a98a798", "kind": "identity", "frame_number": 430, "timestamp_epoch": "1631315816.226482000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-668d90fb7f0f4b09786ea57b", "kind": "identity", "frame_number": 432, "timestamp_epoch": "1631315816.227697000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-86e3d4fa9a8f615221874030", "kind": "identity", "frame_number": 433, "timestamp_epoch": "1631315816.227836000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-1830ad45acc85ea445d8f782", "kind": "identity", "frame_number": 436, "timestamp_epoch": "1631315816.239964000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-a48a6f79c37bc196217c94fa", "kind": "identity", "frame_number": 437, "timestamp_epoch": "1631315816.240071000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-e0dbe5e20c6dc05103422b94", "kind": "identity", "frame_number": 438, "timestamp_epoch": "1631315816.241467000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-08d19a1b7417e6751fcd6f00", "kind": "identity", "frame_number": 439, "timestamp_epoch": "1631315816.241716000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-c7e9030224187ba29eb748be", "kind": "identity", "frame_number": 440, "timestamp_epoch": "1631315816.243133000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-9d5b3a9461901eb3bb68a02d", "kind": "identity", "frame_number": 441, "timestamp_epoch": "1631315816.243557000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-8e71614a5aa9472f679746c9", "kind": "identity", "frame_number": 442, "timestamp_epoch": "1631315816.245054000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-f2fa7122c8d1467ed93a68a2", "kind": "identity", "frame_number": 443, "timestamp_epoch": "1631315816.245465000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-0a6c4f779b39e6f534fd8d0e", "kind": "identity", "frame_number": 444, "timestamp_epoch": "1631315816.246899000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-52febd7215dc81f02ecedcbb", "kind": "identity", "frame_number": 445, "timestamp_epoch": "1631315816.247380000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-c23d23a5af76362a4ae67e88", "kind": "identity", "frame_number": 446, "timestamp_epoch": "1631315816.248730000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-26e9c862160dbd63ab30b821", "kind": "identity", "frame_number": 447, "timestamp_epoch": "1631315816.249191000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-fa9b22ff0abe0b3daa2f2b13", "kind": "identity", "frame_number": 448, "timestamp_epoch": "1631315816.250617000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-f0535e113b4f0c8f32e237f7", "kind": "identity", "frame_number": 449, "timestamp_epoch": "1631315816.250931000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-52544b1a464449d922b5742d", "kind": "identity", "frame_number": 450, "timestamp_epoch": "1631315816.252375000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-e0d5f522507c2f04d78bdc1f", "kind": "identity", "frame_number": 451, "timestamp_epoch": "1631315816.252925000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-34468fe4096946a0bbd30c4e", "kind": "identity", "frame_number": 452, "timestamp_epoch": "1631315816.254369000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-c068fe120e49f137040f8fdd", "kind": "identity", "frame_number": 453, "timestamp_epoch": "1631315816.254812000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-1dca50f311e00eb994210ca1", "kind": "identity", "frame_number": 454, "timestamp_epoch": "1631315816.256268000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-cd83d87919899cb27af0836c", "kind": "identity", "frame_number": 455, "timestamp_epoch": "1631315816.256961000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e", "samr.samr_UserInfo21.account_name": "hobart.gunnarsson", "samr.samr_UserInfo21.full_name": "Hobart Gunnarsson" } }, { "event_id": "evt-92b83564b602b0f21655311e", "kind": "identity", "frame_number": 456, "timestamp_epoch": "1631315816.258395000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-ca2991e9671c63669d65be9d", "kind": "identity", "frame_number": 457, "timestamp_epoch": "1631315816.258946000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-56350033a8e353890477b8d0", "kind": "identity", "frame_number": 458, "timestamp_epoch": "1631315816.260346000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-fb719087ee4c4f6c5e1a1b28", "kind": "identity", "frame_number": 459, "timestamp_epoch": "1631315816.260793000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-dda9348dfaa547c45a16a483", "kind": "identity", "frame_number": 460, "timestamp_epoch": "1631315816.262280000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-de21bb271f05fbb37ef82335", "kind": "identity", "frame_number": 461, "timestamp_epoch": "1631315816.262733000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-7bc624fc5b34a5daa7a5c327", "kind": "identity", "frame_number": 462, "timestamp_epoch": "1631315816.264186000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-fba90999ac2b5dd2fc415355", "kind": "identity", "frame_number": 463, "timestamp_epoch": "1631315816.264601000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-4dfedc050cad9d0f4f22c9af", "kind": "identity", "frame_number": 464, "timestamp_epoch": "1631315816.265989000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-1044360aa21f6c392aed1ee9", "kind": "identity", "frame_number": 465, "timestamp_epoch": "1631315816.266340000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-b9caa6f60284042bcdf3058a", "kind": "identity", "frame_number": 466, "timestamp_epoch": "1631315816.267805000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-916d8071acb2755be4b3ff01", "kind": "identity", "frame_number": 467, "timestamp_epoch": "1631315816.268210000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-fd2bd9befe497fbba0d8d7d0", "kind": "identity", "frame_number": 468, "timestamp_epoch": "1631315816.269633000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-fe80678974084bf6fd4fc78d", "kind": "identity", "frame_number": 469, "timestamp_epoch": "1631315816.269868000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-8944798e4e581515fc5f9a2f", "kind": "identity", "frame_number": 470, "timestamp_epoch": "1631315816.271347000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-ba50bea38799872913bf9665", "kind": "identity", "frame_number": 471, "timestamp_epoch": "1631315816.271588000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-92f7d631de8aae52632d5af6", "kind": "identity", "frame_number": 483, "timestamp_epoch": "1631315816.973775000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 22, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3", "kerberos.msg_type": "14" } }, { "event_id": "evt-e7d623464c63c16e93825e89", "kind": "identity", "frame_number": 485, "timestamp_epoch": "1631315816.975285000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 22, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e", "kerberos.msg_type": "15" } }, { "event_id": "evt-1e312d950e66b5412ced1bf9", "kind": "identity", "frame_number": 493, "timestamp_epoch": "1631315817.083271000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 23, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3", "kerberos.msg_type": "14" } }, { "event_id": "evt-1f92e3ea1df78936da27a6ef", "kind": "identity", "frame_number": 495, "timestamp_epoch": "1631315817.084711000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 23, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e", "kerberos.msg_type": "15" } }, { "event_id": "evt-bae80bd88c3cff634ce53a39", "kind": "identity", "frame_number": 1018, "timestamp_epoch": "1631315826.563096000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-0893298dc88d6f9efa9c57e0", "kind": "identity", "frame_number": 1019, "timestamp_epoch": "1631315826.563419000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-056310f30b7fe774b6a370ba", "kind": "identity", "frame_number": 1029, "timestamp_epoch": "1631315826.828704000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-66e9d9d9e136f933b7ca9f66", "kind": "identity", "frame_number": 1030, "timestamp_epoch": "1631315826.828838000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-f7cf004c54c17cc07e2e20ad", "kind": "identity", "frame_number": 1050, "timestamp_epoch": "1631315830.742632000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-bbba4cb1eea88072870ff5b6", "kind": "identity", "frame_number": 1051, "timestamp_epoch": "1631315830.743100000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-667bb8c01cb1892566778321", "kind": "identity", "frame_number": 1054, "timestamp_epoch": "1631315830.829478000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-6822234ade845eb4b398ebaa", "kind": "identity", "frame_number": 1055, "timestamp_epoch": "1631315830.829919000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-301de27c1335a425137a1ce3", "kind": "identity", "frame_number": 1058, "timestamp_epoch": "1631315831.151423000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-756cf52f37341eb5997ce588", "kind": "identity", "frame_number": 1059, "timestamp_epoch": "1631315831.151828000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-0ed00aa5b43fd1d7a0eeed53", "kind": "identity", "frame_number": 1060, "timestamp_epoch": "1631315831.153952000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-9e2f89a5938281f92a77347f", "kind": "identity", "frame_number": 1061, "timestamp_epoch": "1631315831.154197000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-b673e1a091f3830f185eebe0", "kind": "identity", "frame_number": 1062, "timestamp_epoch": "1631315831.155606000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-4738b8514d6d7183fff93d0a", "kind": "identity", "frame_number": 1063, "timestamp_epoch": "1631315831.155837000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-e59dc3baec2dcfcc03720d54", "kind": "identity", "frame_number": 1064, "timestamp_epoch": "1631315831.159360000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-598b74b16d75067789ea8e78", "kind": "identity", "frame_number": 1065, "timestamp_epoch": "1631315831.159834000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-afe85a40cee868f669cb5221", "kind": "identity", "frame_number": 1067, "timestamp_epoch": "1631315831.225410000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-005d6d2da0b0a3b347847a75", "kind": "identity", "frame_number": 1068, "timestamp_epoch": "1631315831.225783000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-316bfbc05bfa59b1895ee8ea", "kind": "identity", "frame_number": 1070, "timestamp_epoch": "1631315831.228129000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-eaaa1c9421b9be558d91e335", "kind": "identity", "frame_number": 1071, "timestamp_epoch": "1631315831.228670000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-4905f4f8f7b60bb4d5cc144b", "kind": "identity", "frame_number": 1072, "timestamp_epoch": "1631315831.230059000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-f7a3fe62c2f90adb56b28309", "kind": "identity", "frame_number": 1073, "timestamp_epoch": "1631315831.230349000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-05481234522e4ce8f47feb89", "kind": "identity", "frame_number": 1075, "timestamp_epoch": "1631315831.453851000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-0d3fb08d424c81d7c3aaf91b", "kind": "identity", "frame_number": 1076, "timestamp_epoch": "1631315831.454322000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-2f8e04f3eba4f07400ff2151", "kind": "identity", "frame_number": 1078, "timestamp_epoch": "1631315831.551165000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-e9c988fdfcaf13dd84a26f62", "kind": "identity", "frame_number": 1079, "timestamp_epoch": "1631315831.551455000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-f8d9fe3cfae08b9e762f4dd3", "kind": "identity", "frame_number": 1081, "timestamp_epoch": "1631315831.555223000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-b0a5a33b25630a73432a9511", "kind": "identity", "frame_number": 1082, "timestamp_epoch": "1631315831.555686000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-066d4e02083f326dc471f645", "kind": "identity", "frame_number": 1083, "timestamp_epoch": "1631315831.557078000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-514490f340efdd1f1cb41a34", "kind": "identity", "frame_number": 1084, "timestamp_epoch": "1631315831.557419000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-afbe47b96f232aef9fae4f6d", "kind": "identity", "frame_number": 1138, "timestamp_epoch": "1631315838.421523000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-85cc6845f387e85d2e806a68", "kind": "identity", "frame_number": 1139, "timestamp_epoch": "1631315838.422058000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-3f70a80c88476387e4d275a3", "kind": "identity", "frame_number": 2054, "timestamp_epoch": "1631315877.049429000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 67, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3", "kerberos.msg_type": "14" } }, { "event_id": "evt-3dac34d5353e7b75f5bcc7ac", "kind": "identity", "frame_number": 2056, "timestamp_epoch": "1631315877.050711000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 67, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e", "kerberos.msg_type": "15" } }, { "event_id": "evt-a5874b1cd8f7b81db6e21d5e", "kind": "identity", "frame_number": 2057, "timestamp_epoch": "1631315877.052318000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 67, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3", "kerberos.msg_type": "15" } }, { "event_id": "evt-988045f6dbe46dd2948b6301", "kind": "identity", "frame_number": 2119, "timestamp_epoch": "1631315877.088427000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 68, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3", "kerberos.msg_type": "14" } }, { "event_id": "evt-331830ac0e1f629c75a4a5cb", "kind": "identity", "frame_number": 2121, "timestamp_epoch": "1631315877.089901000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 68, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e", "kerberos.msg_type": "15" } }, { "event_id": "evt-9fb0386132b01796a12fd0ec", "kind": "identity", "frame_number": 2133, "timestamp_epoch": "1631315877.114050000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 69, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3", "kerberos.msg_type": "14" } }, { "event_id": "evt-c209632429a1f00166883a9d", "kind": "identity", "frame_number": 2135, "timestamp_epoch": "1631315877.114813000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 69, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e", "kerberos.msg_type": "15" } }, { "event_id": "evt-7a1b4e5f1a7b4e6ee3e715a2", "kind": "identity", "frame_number": 2553, "timestamp_epoch": "1631315943.306143000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-1e3ba3aff2e91c0f182e4a32", "kind": "identity", "frame_number": 2554, "timestamp_epoch": "1631315943.306517000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-cade706ff10f3f6f5244f71a", "kind": "identity", "frame_number": 2555, "timestamp_epoch": "1631315943.308630000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-23af71e9a666efcb708c527a", "kind": "identity", "frame_number": 2556, "timestamp_epoch": "1631315943.308924000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-2975d687429aa32729aebf05", "kind": "identity", "frame_number": 2557, "timestamp_epoch": "1631315943.310352000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-112e07f0d8bb8372009edd20", "kind": "identity", "frame_number": 2558, "timestamp_epoch": "1631315943.310682000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-21c75945719dd1b59555d77d", "kind": "identity", "frame_number": 2559, "timestamp_epoch": "1631315943.313662000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-680be66a6b17dfc7d3461fd1", "kind": "identity", "frame_number": 2560, "timestamp_epoch": "1631315943.314176000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-731c7f44d2ad9aabe1472aae", "kind": "identity", "frame_number": 2562, "timestamp_epoch": "1631315943.409669000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-c063d1a0a82e397b5a7599a9", "kind": "identity", "frame_number": 2564, "timestamp_epoch": "1631315943.409968000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-a12d96202e06da35117be0bf", "kind": "identity", "frame_number": 2565, "timestamp_epoch": "1631315943.413431000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-d007433891db95b57bdfb1f9", "kind": "identity", "frame_number": 2566, "timestamp_epoch": "1631315943.414008000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-fba04acb6acc491ae781ef95", "kind": "identity", "frame_number": 2567, "timestamp_epoch": "1631315943.415378000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-4dbb11f80c9c2032289b1767", "kind": "identity", "frame_number": 2568, "timestamp_epoch": "1631315943.415669000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-b966b729a48ddfb2c9697dd1", "kind": "identity", "frame_number": 2628, "timestamp_epoch": "1631315962.234432000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 14, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-18fec1136d6c3f81ee94d500", "kind": "identity", "frame_number": 2629, "timestamp_epoch": "1631315962.234433000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 8, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:4f:49:b1:e8:c3", "nbns.flags.opcode": "0", "nbns.flags.response": "False", "nbns.name": "ANGRYPOUTINE<1b>" } }, { "event_id": "evt-634f0db9bfdec5fc8665b839", "kind": "identity", "frame_number": 2630, "timestamp_epoch": "1631315962.234697000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 51, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e", "nbns.flags.opcode": "0", "nbns.flags.response": "True", "nbns.name": "ANGRYPOUTINE<1b> (Domain Master Browser)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-766c4674b96aa01c9784ba7d", "kind": "identity", "frame_number": 2631, "timestamp_epoch": "1631315962.249217000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 52, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-d6f6ac31221c3386a302e9de", "kind": "identity", "frame_number": 2634, "timestamp_epoch": "1631315962.249925000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.103", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 53, "fields": { "eth.dst": "20:1a:06:68:23:49", "eth.src": "00:4f:49:b1:e8:c3", "nbns.flags.opcode": "0", "nbns.flags.response": "True", "nbns.name": "DESKTOP-KKITB6Q<00> (Workstation/Redirector)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-0f75b1602124d985cb353d5d", "kind": "identity", "frame_number": 2635, "timestamp_epoch": "1631315962.250401000", "src_ip": "10.9.10.103", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 54, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "20:1a:06:68:23:49" } }, { "event_id": "evt-d94301a226b38520e7c76189", "kind": "identity", "frame_number": 2640, "timestamp_epoch": "1631315962.346778000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 8, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:4f:49:b1:e8:c3", "nbns.flags.opcode": "0", "nbns.flags.response": "False", "nbns.name": "DESKTOP-MUYEYV7<20>" } }, { "event_id": "evt-cf17a50a2a39b78c6df34e97", "kind": "identity", "frame_number": 2641, "timestamp_epoch": "1631315962.347248000", "src_ip": "10.9.10.103", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 53, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "20:1a:06:68:23:49", "nbns.flags.opcode": "0", "nbns.flags.response": "True", "nbns.name": "DESKTOP-MUYEYV7<20> (Server service)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-8dbf4e45eb81e56312a2ee87", "kind": "identity", "frame_number": 2649, "timestamp_epoch": "1631315964.374860000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.103", "src_port": null, "dst_port": null, "tcp_stream": 79, "udp_stream": null, "fields": { "eth.dst": "20:1a:06:68:23:49", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-c6be70d9ea3c6d8aa58a4442", "kind": "identity", "frame_number": 2650, "timestamp_epoch": "1631315964.375757000", "src_ip": "10.9.10.103", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 79, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "20:1a:06:68:23:49" } }, { "event_id": "evt-43be73fe56d8d6fd19df00b0", "kind": "identity", "frame_number": 2651, "timestamp_epoch": "1631315964.378254000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.103", "src_port": null, "dst_port": null, "tcp_stream": 79, "udp_stream": null, "fields": { "eth.dst": "20:1a:06:68:23:49", "eth.src": "00:4f:49:b1:e8:c3", "ntlmssp.auth.domain": "NULL", "ntlmssp.auth.hostname": "DESKTOP-KKITB6Q", "ntlmssp.auth.username": "NULL" } }, { "event_id": "evt-162be9c52c98b2b9e1daa21c", "kind": "identity", "frame_number": 2657, "timestamp_epoch": "1631315965.735828000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 14, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-2854a4b9f555c67efc90134a", "kind": "identity", "frame_number": 2658, "timestamp_epoch": "1631315965.735830000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 52, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-ddbfd574b29b7f52ba285081", "kind": "identity", "frame_number": 2659, "timestamp_epoch": "1631315965.736491000", "src_ip": "10.9.10.103", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 54, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "20:1a:06:68:23:49" } }, { "event_id": "evt-0308d8de95f0fb3b5f7ea48c", "kind": "identity", "frame_number": 2662, "timestamp_epoch": "1631315965.742405000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 14, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-1cbe7fca67922b3fbd4bd6fb", "kind": "identity", "frame_number": 2663, "timestamp_epoch": "1631315965.742479000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 52, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-9a74b8a8ef4e413bb4a7ec2e", "kind": "identity", "frame_number": 2664, "timestamp_epoch": "1631315965.743002000", "src_ip": "10.9.10.103", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 54, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "20:1a:06:68:23:49" } }, { "event_id": "evt-2a952e8212426edc28ef85e1", "kind": "identity", "frame_number": 2670, "timestamp_epoch": "1631315966.439290000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-74c0f2f18047648e44cf88c1", "kind": "identity", "frame_number": 2671, "timestamp_epoch": "1631315966.440822000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-f9aa091498cbe78ded2aca1d", "kind": "identity", "frame_number": 2672, "timestamp_epoch": "1631315966.441552000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-faf3cf873162f42565bdd02e", "kind": "identity", "frame_number": 2678, "timestamp_epoch": "1631315966.485565000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 81, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3", "kerberos.msg_type": "12,14" } }, { "event_id": "evt-2b4cd73ac59504eab9b313a0", "kind": "identity", "frame_number": 2681, "timestamp_epoch": "1631315966.487925000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 81, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e", "kerberos.CNameString": "hobart.gunnarsson", "kerberos.msg_type": "13" } }, { "event_id": "evt-20049260c3e65c26e774fb91", "kind": "identity", "frame_number": 2688, "timestamp_epoch": "1631315966.490446000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3", "kerberos.msg_type": "14" } }, { "event_id": "evt-005f083b13549e1876663c6d", "kind": "identity", "frame_number": 2690, "timestamp_epoch": "1631315966.492277000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e", "kerberos.msg_type": "15" } }, { "event_id": "evt-683d6638d0971af2cff12755", "kind": "identity", "frame_number": 2691, "timestamp_epoch": "1631315966.494923000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-9aad8254749745605c8e67f3", "kind": "identity", "frame_number": 2692, "timestamp_epoch": "1631315966.495163000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-fad0b59a1f3602f7086160f4", "kind": "identity", "frame_number": 2693, "timestamp_epoch": "1631315966.496776000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-76a022097296e66127f721b7", "kind": "identity", "frame_number": 2694, "timestamp_epoch": "1631315966.496833000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-308fc610e9b6c0444492878e", "kind": "identity", "frame_number": 2696, "timestamp_epoch": "1631315966.497043000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-9dc9c153747410b6f292555d", "kind": "identity", "frame_number": 2697, "timestamp_epoch": "1631315966.497195000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-8fb98bc5d4b7edec6773842b", "kind": "identity", "frame_number": 2699, "timestamp_epoch": "1631315966.498665000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-9c78b3236d55aac0d38b3cc2", "kind": "identity", "frame_number": 2700, "timestamp_epoch": "1631315966.498769000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-5f17029e367d02c44477f947", "kind": "identity", "frame_number": 2701, "timestamp_epoch": "1631315966.500945000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-196ab84aaf6bf87b27e0998d", "kind": "identity", "frame_number": 2702, "timestamp_epoch": "1631315966.501189000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-d9be05841bfd8eb1ae42c3b6", "kind": "identity", "frame_number": 2703, "timestamp_epoch": "1631315966.503415000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-2cbc7ee09c5079c586566dd5", "kind": "identity", "frame_number": 2704, "timestamp_epoch": "1631315966.503686000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-1452dc447c6461775121f11b", "kind": "identity", "frame_number": 2705, "timestamp_epoch": "1631315966.505945000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-34378a2943c17df12b9e1482", "kind": "identity", "frame_number": 2706, "timestamp_epoch": "1631315966.506606000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-a9e5c2e03ea3bf3873249d11", "kind": "identity", "frame_number": 2707, "timestamp_epoch": "1631315966.508802000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-66535e6e70d62a18ab256776", "kind": "identity", "frame_number": 2708, "timestamp_epoch": "1631315966.509355000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-7f979737155ce69f3b1429e6", "kind": "identity", "frame_number": 2709, "timestamp_epoch": "1631315966.511562000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-572150a983d4e019cbd619d8", "kind": "identity", "frame_number": 2710, "timestamp_epoch": "1631315966.512048000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-47080678b26da4f9209f0cd6", "kind": "identity", "frame_number": 2711, "timestamp_epoch": "1631315966.514181000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-bc7a84bf60cd60aa9111cc5a", "kind": "identity", "frame_number": 2712, "timestamp_epoch": "1631315966.514600000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-8a59459dee18eb17b5f666c5", "kind": "identity", "frame_number": 2713, "timestamp_epoch": "1631315966.516818000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-5af7d8ea9d96b5d41d0c32c1", "kind": "identity", "frame_number": 2714, "timestamp_epoch": "1631315966.517327000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-7b9c52419faab4caf174c089", "kind": "identity", "frame_number": 2717, "timestamp_epoch": "1631315966.895289000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-c30181fc86678f6fc390a313", "kind": "identity", "frame_number": 2718, "timestamp_epoch": "1631315966.896127000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-7d3d1723de0e5e72c370bcd8", "kind": "identity", "frame_number": 2719, "timestamp_epoch": "1631315966.897682000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-d4f165da76c4530857899e55", "kind": "identity", "frame_number": 2720, "timestamp_epoch": "1631315966.898450000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-5515c29f49c8ebfd06a61dde", "kind": "identity", "frame_number": 2721, "timestamp_epoch": "1631315966.900014000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-2c69f0323971d49df50e0b2d", "kind": "identity", "frame_number": 2722, "timestamp_epoch": "1631315966.900524000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-9f4de68573fd3ccc93def8b4", "kind": "identity", "frame_number": 2723, "timestamp_epoch": "1631315966.902012000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-3b39ebbdb20cde8518428701", "kind": "identity", "frame_number": 2724, "timestamp_epoch": "1631315966.902430000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-6215f41bc0ea829d8d5724a6", "kind": "identity", "frame_number": 2725, "timestamp_epoch": "1631315966.903988000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-6515c9ca9e30a18875518e0b", "kind": "identity", "frame_number": 2726, "timestamp_epoch": "1631315966.904500000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-1b08358a85fce32745bba1fe", "kind": "identity", "frame_number": 2727, "timestamp_epoch": "1631315966.905999000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-4ddb2a9a1b9d41716a24d6c5", "kind": "identity", "frame_number": 2728, "timestamp_epoch": "1631315966.906219000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-aec1ce7d215f8a56afa652e6", "kind": "identity", "frame_number": 2729, "timestamp_epoch": "1631315966.909030000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-a49481877218e20229ba349c", "kind": "identity", "frame_number": 2730, "timestamp_epoch": "1631315966.909399000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-d4a2e96fba4a7a39f21d1707", "kind": "identity", "frame_number": 2731, "timestamp_epoch": "1631315966.910871000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-e5b205041881a4ee443ff4e0", "kind": "identity", "frame_number": 2732, "timestamp_epoch": "1631315966.911092000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-c395df9db7e914b693d7c0bb", "kind": "identity", "frame_number": 2733, "timestamp_epoch": "1631315966.912682000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-4702eaaeac48ca1ad030949d", "kind": "identity", "frame_number": 2734, "timestamp_epoch": "1631315966.912861000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-9ff3cf1098c870a5dc17a85f", "kind": "identity", "frame_number": 2735, "timestamp_epoch": "1631315966.914456000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-9b338258d4cfe8e4c7402b72", "kind": "identity", "frame_number": 2736, "timestamp_epoch": "1631315966.914701000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-d769b1d89c9432d7ad4af81c", "kind": "identity", "frame_number": 2737, "timestamp_epoch": "1631315966.916394000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-708daf4ea76ef5b0e4410339", "kind": "identity", "frame_number": 2738, "timestamp_epoch": "1631315966.916801000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-eca3731813b87060080a655b", "kind": "identity", "frame_number": 2739, "timestamp_epoch": "1631315966.918290000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-8296fd4302495e0fffd6f004", "kind": "identity", "frame_number": 2740, "timestamp_epoch": "1631315966.918651000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-528717c638339a25ea85a9b4", "kind": "identity", "frame_number": 2741, "timestamp_epoch": "1631315966.920310000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-a452bac51675ee43a9e4b960", "kind": "identity", "frame_number": 2742, "timestamp_epoch": "1631315966.920672000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-8a4f62dc0ea9d5b19aad43f8", "kind": "identity", "frame_number": 2743, "timestamp_epoch": "1631315966.922243000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-051019c8d351299506150185", "kind": "identity", "frame_number": 2744, "timestamp_epoch": "1631315966.922457000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-82ce144d9da8335ea1dc705e", "kind": "identity", "frame_number": 2745, "timestamp_epoch": "1631315966.923956000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-84cedd482d19121cd0da8bc2", "kind": "identity", "frame_number": 2746, "timestamp_epoch": "1631315966.924393000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-ffd6d14373c537dec4472d36", "kind": "identity", "frame_number": 2747, "timestamp_epoch": "1631315966.925841000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-e61991e0560a080959d8571f", "kind": "identity", "frame_number": 2748, "timestamp_epoch": "1631315966.926357000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-724620c5b95f1e12a5718f49", "kind": "identity", "frame_number": 2749, "timestamp_epoch": "1631315966.927916000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-75674c4bb1692b1a2565573e", "kind": "identity", "frame_number": 2750, "timestamp_epoch": "1631315966.928378000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-d8a84514a451f32bf800089c", "kind": "identity", "frame_number": 2751, "timestamp_epoch": "1631315966.929933000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-f7132f71d1e0b12bc2e3da38", "kind": "identity", "frame_number": 2752, "timestamp_epoch": "1631315966.930497000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-86f6843cdfd67418ad1960f5", "kind": "identity", "frame_number": 2753, "timestamp_epoch": "1631315966.932162000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-3e807d419399e621f6cea624", "kind": "identity", "frame_number": 2754, "timestamp_epoch": "1631315966.932520000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-1147f11011489cd1fcff8e21", "kind": "identity", "frame_number": 2755, "timestamp_epoch": "1631315966.934106000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-a1ddb7ba35f6efab62218566", "kind": "identity", "frame_number": 2756, "timestamp_epoch": "1631315966.934472000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-25ce5d1e76058e19d6fdcd62", "kind": "identity", "frame_number": 2757, "timestamp_epoch": "1631315966.936076000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-245b323c065268fb8ebee75a", "kind": "identity", "frame_number": 2758, "timestamp_epoch": "1631315966.936436000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-ad63b08f18890e6ebfa94e40", "kind": "identity", "frame_number": 2759, "timestamp_epoch": "1631315966.938647000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-c9753663d2ee412dc7696157", "kind": "identity", "frame_number": 2760, "timestamp_epoch": "1631315966.938801000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-0dff5032f89c9a958980b068", "kind": "identity", "frame_number": 2762, "timestamp_epoch": "1631315967.101024000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-f3d1ef7d8962a1dd5a5e40be", "kind": "identity", "frame_number": 2763, "timestamp_epoch": "1631315967.101337000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-76a66bb7338c02da68053b47", "kind": "identity", "frame_number": 2764, "timestamp_epoch": "1631315967.102824000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-0ff31bf037b04312c860d0bd", "kind": "identity", "frame_number": 2765, "timestamp_epoch": "1631315967.103080000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-cfc39bc38cdcf4eea15e1d64", "kind": "identity", "frame_number": 2766, "timestamp_epoch": "1631315967.104576000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-a84bb390fb206731c68984ba", "kind": "identity", "frame_number": 2767, "timestamp_epoch": "1631315967.104852000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-1a6ee03009d28afb407f51ac", "kind": "identity", "frame_number": 2768, "timestamp_epoch": "1631315967.106288000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-cc7c382d8a3d795aba5e1325", "kind": "identity", "frame_number": 2769, "timestamp_epoch": "1631315967.106571000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-efd956e403e8f44c33842129", "kind": "identity", "frame_number": 2770, "timestamp_epoch": "1631315967.107975000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-275410fd50bd8e61d06b5297", "kind": "identity", "frame_number": 2771, "timestamp_epoch": "1631315967.108357000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-e4bce254cc60bfe820cc9417", "kind": "identity", "frame_number": 2772, "timestamp_epoch": "1631315967.109802000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-a70a3149d1e7ea95799dd609", "kind": "identity", "frame_number": 2773, "timestamp_epoch": "1631315967.110185000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-630c66a7b2a688fad983a55d", "kind": "identity", "frame_number": 2774, "timestamp_epoch": "1631315967.111638000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-c98b966c5d2c4d987b8b2a07", "kind": "identity", "frame_number": 2775, "timestamp_epoch": "1631315967.112004000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-417d0eb8cf9328ef922a5aa9", "kind": "identity", "frame_number": 2776, "timestamp_epoch": "1631315967.113444000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-86a6353843dff4d75697f640", "kind": "identity", "frame_number": 2777, "timestamp_epoch": "1631315967.113908000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-f536d8f4ffa21517fbe31b2c", "kind": "identity", "frame_number": 2778, "timestamp_epoch": "1631315967.115360000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-90fd6302ab85a3a3ed3e4a15", "kind": "identity", "frame_number": 2779, "timestamp_epoch": "1631315967.115884000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-366601c278a682dcb57cf6c1", "kind": "identity", "frame_number": 2780, "timestamp_epoch": "1631315967.117411000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-24b4629a1b11923ba6f56d09", "kind": "identity", "frame_number": 2781, "timestamp_epoch": "1631315967.117894000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-656603fd3367550d03c0c688", "kind": "identity", "frame_number": 2782, "timestamp_epoch": "1631315967.119332000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-8a274a97bb296e7bf8eb4081", "kind": "identity", "frame_number": 2783, "timestamp_epoch": "1631315967.119790000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-bf92f9f7031c4aff08b48870", "kind": "identity", "frame_number": 2784, "timestamp_epoch": "1631315967.121257000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-b4f5bfb6985d9d02ac9120bf", "kind": "identity", "frame_number": 2785, "timestamp_epoch": "1631315967.121621000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-f12017cb96c6737447db7a2b", "kind": "identity", "frame_number": 2786, "timestamp_epoch": "1631315967.123094000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-399a658ba875359e4ea68eb9", "kind": "identity", "frame_number": 2787, "timestamp_epoch": "1631315967.123453000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-ae5b83da30d7186d9f1f1d0b", "kind": "identity", "frame_number": 2788, "timestamp_epoch": "1631315967.124946000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-bd81dbf251d469426a661842", "kind": "identity", "frame_number": 2789, "timestamp_epoch": "1631315967.125283000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-7791468a8d3e03269ff5be2c", "kind": "identity", "frame_number": 2790, "timestamp_epoch": "1631315967.126742000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-fa0ddeabbadb95c055b3d97f", "kind": "identity", "frame_number": 2791, "timestamp_epoch": "1631315967.127022000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-b717fa90680d28923f23f9f2", "kind": "identity", "frame_number": 2792, "timestamp_epoch": "1631315967.129773000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-b30a8323e44cd4ba505c71bb", "kind": "identity", "frame_number": 2793, "timestamp_epoch": "1631315967.130091000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-993a19b27a117dcdab27542c", "kind": "identity", "frame_number": 2794, "timestamp_epoch": "1631315967.131559000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-2c8b1f7457a847f844e46e59", "kind": "identity", "frame_number": 2795, "timestamp_epoch": "1631315967.131653000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-bcc162f248fca73bcfadfa8f", "kind": "identity", "frame_number": 2796, "timestamp_epoch": "1631315967.133801000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-1e116b3b2be00ab9c74ac71d", "kind": "identity", "frame_number": 2797, "timestamp_epoch": "1631315967.134082000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-d4ac96894ac71131e14ca158", "kind": "identity", "frame_number": 2798, "timestamp_epoch": "1631315967.135567000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-0e96af1e4f25a6b1311c7f3d", "kind": "identity", "frame_number": 2799, "timestamp_epoch": "1631315967.135861000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-913770344dca6a32f32f07ae", "kind": "identity", "frame_number": 2800, "timestamp_epoch": "1631315967.137311000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-08f3fc79a2c9aa94bbae7ff6", "kind": "identity", "frame_number": 2801, "timestamp_epoch": "1631315967.137715000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-c2cf091aeb6d3aca6561bc49", "kind": "identity", "frame_number": 2802, "timestamp_epoch": "1631315967.139190000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-c7f65c1b78fd904081e5d752", "kind": "identity", "frame_number": 2803, "timestamp_epoch": "1631315967.139701000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-e226bfb17aa23e0276afdf17", "kind": "identity", "frame_number": 2804, "timestamp_epoch": "1631315967.141123000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-85f3969c37a2cae19a62bb92", "kind": "identity", "frame_number": 2805, "timestamp_epoch": "1631315967.141536000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-1fcc5d5d521e85eb531b1d6c", "kind": "identity", "frame_number": 2806, "timestamp_epoch": "1631315967.142993000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-1f4a8c33cf376c3fc3012920", "kind": "identity", "frame_number": 2807, "timestamp_epoch": "1631315967.143458000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-8b7ef3ea17eb62d388be5ddb", "kind": "identity", "frame_number": 2808, "timestamp_epoch": "1631315967.144878000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-4e5d41b5909f1bacce160b80", "kind": "identity", "frame_number": 2809, "timestamp_epoch": "1631315967.145402000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-902fc9380e8c0e1b556997e1", "kind": "identity", "frame_number": 2810, "timestamp_epoch": "1631315967.146886000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-799d8d60196d5c4a76c1d75c", "kind": "identity", "frame_number": 2811, "timestamp_epoch": "1631315967.147382000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-71d7bb870e20be37d7788660", "kind": "identity", "frame_number": 2812, "timestamp_epoch": "1631315967.148810000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-8a20b2fab04a31fb760c1816", "kind": "identity", "frame_number": 2813, "timestamp_epoch": "1631315967.149337000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-415427dc7a22fe5ed4096bb9", "kind": "identity", "frame_number": 2814, "timestamp_epoch": "1631315967.150926000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-e2c5c486d2c0274b46a5c91f", "kind": "identity", "frame_number": 2815, "timestamp_epoch": "1631315967.151339000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-fc714ed0a34d55706769f6e8", "kind": "identity", "frame_number": 2816, "timestamp_epoch": "1631315967.152894000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-7f4e9abece3b7e0a0cf0a396", "kind": "identity", "frame_number": 2817, "timestamp_epoch": "1631315967.153273000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-195f9373fa311ae73db1482a", "kind": "identity", "frame_number": 2818, "timestamp_epoch": "1631315967.154700000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-178b0413ca0b93932365d860", "kind": "identity", "frame_number": 2819, "timestamp_epoch": "1631315967.155105000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-f258586aedcc56ea839f556b", "kind": "identity", "frame_number": 2820, "timestamp_epoch": "1631315967.156536000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-5098cc36c66091698af1cbe3", "kind": "identity", "frame_number": 2821, "timestamp_epoch": "1631315967.156946000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-6d75b9cfa4659f64631e0b9c", "kind": "identity", "frame_number": 2822, "timestamp_epoch": "1631315967.158443000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-8a48cdc86da3a2b106d10199", "kind": "identity", "frame_number": 2823, "timestamp_epoch": "1631315967.158662000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-00421ff9d9f0be185dd883fe", "kind": "identity", "frame_number": 2902, "timestamp_epoch": "1631315979.124757000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-fb3cd80a30f71c3cb780c617", "kind": "identity", "frame_number": 2903, "timestamp_epoch": "1631315979.124978000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-9f338084fc24004ae2d3aa62", "kind": "identity", "frame_number": 2906, "timestamp_epoch": "1631315979.126648000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-3e6a6cf95ca324cad1d74b58", "kind": "identity", "frame_number": 2907, "timestamp_epoch": "1631315979.126857000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-51ec61e4bb0310e586d343c4", "kind": "identity", "frame_number": 2957, "timestamp_epoch": "1631316142.047732000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 86, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3", "kerberos.msg_type": "14" } }, { "event_id": "evt-efd7d331f2885a5561cf9568", "kind": "identity", "frame_number": 2959, "timestamp_epoch": "1631316142.049101000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 86, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e", "kerberos.msg_type": "15" } }, { "event_id": "evt-37ca624e82a112713901cd90", "kind": "identity", "frame_number": 2960, "timestamp_epoch": "1631316142.051496000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 86, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3", "kerberos.msg_type": "15" } }, { "event_id": "evt-e1178e340d4b81b30bf1ecb0", "kind": "identity", "frame_number": 2987, "timestamp_epoch": "1631316142.361415000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 87, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3", "kerberos.msg_type": "14" } }, { "event_id": "evt-380a925dbf60cd6d537509fb", "kind": "identity", "frame_number": 2989, "timestamp_epoch": "1631316142.363093000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 87, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e", "kerberos.msg_type": "15" } }, { "event_id": "evt-786e669923d6b4c602d8cd63", "kind": "identity", "frame_number": 3001, "timestamp_epoch": "1631316142.407882000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 88, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3", "kerberos.msg_type": "14" } }, { "event_id": "evt-026c86b7e4f7f45fecff8d54", "kind": "identity", "frame_number": 3003, "timestamp_epoch": "1631316142.409360000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 88, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e", "kerberos.msg_type": "15" } }, { "event_id": "evt-2cb7d3b0f85afdccdc794035", "kind": "identity", "frame_number": 7627, "timestamp_epoch": "1631316426.916754000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-a0a4cf6a74ec621b8450a620", "kind": "identity", "frame_number": 7628, "timestamp_epoch": "1631316426.917043000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-540d59495387b86e83321c56", "kind": "identity", "frame_number": 7630, "timestamp_epoch": "1631316442.162758000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 14, "fields": { "browser.server": "DESKTOP-KKITB6Q", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-18eff3c175b9a149ec820c14", "kind": "identity", "frame_number": 7647, "timestamp_epoch": "1631316646.230409000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 112, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-606cc481f06acbd0787a34d8", "kind": "identity", "frame_number": 7648, "timestamp_epoch": "1631316646.231950000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 112, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-7a78d6b5fccd4c11571ddbc8", "kind": "identity", "frame_number": 7649, "timestamp_epoch": "1631316646.232606000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 112, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-f20488683a0d7dfa7f36b225", "kind": "identity", "frame_number": 7652, "timestamp_epoch": "1631316646.236887000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 112, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3", "kerberos.msg_type": "14" } }, { "event_id": "evt-b78b06e4c8e61fade838051c", "kind": "identity", "frame_number": 7654, "timestamp_epoch": "1631316646.238724000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 112, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e", "kerberos.msg_type": "15" } }, { "event_id": "evt-0c79b58ec3946d235ea8446a", "kind": "identity", "frame_number": 7655, "timestamp_epoch": "1631316646.241440000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 112, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-e18057bb6d43637952c8ba8e", "kind": "identity", "frame_number": 7656, "timestamp_epoch": "1631316646.241744000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 112, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-f886319aeb285fb97a950be3", "kind": "identity", "frame_number": 7657, "timestamp_epoch": "1631316646.243921000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 112, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-585ae7315bdd1a1ea1391c49", "kind": "identity", "frame_number": 7658, "timestamp_epoch": "1631316646.243923000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 112, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-0cf236b050451f21170ece64", "kind": "identity", "frame_number": 7660, "timestamp_epoch": "1631316646.244207000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 112, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-57a875bad030ab4d04a3027e", "kind": "identity", "frame_number": 7661, "timestamp_epoch": "1631316646.244334000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 112, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-77088b1d2268318d2ae39d76", "kind": "identity", "frame_number": 7663, "timestamp_epoch": "1631316656.946952000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 112, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-ca1e918fcd4432ea19d07dca", "kind": "identity", "frame_number": 7664, "timestamp_epoch": "1631316656.947204000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 112, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-8ada14ae982e4d65dd14ef71", "kind": "identity", "frame_number": 7665, "timestamp_epoch": "1631316657.139924000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 112, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-76499f66ba52e912a8833d16", "kind": "identity", "frame_number": 7666, "timestamp_epoch": "1631316657.140139000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 112, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-be97846acd72f5532b2de032", "kind": "identity", "frame_number": 7810, "timestamp_epoch": "1631317027.257377000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-355e20f5d9bcb5c94e9dab77", "kind": "identity", "frame_number": 7811, "timestamp_epoch": "1631317027.257633000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-6026381122535d2ad8274d48", "kind": "identity", "frame_number": 7833, "timestamp_epoch": "1631317161.090946000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 14, "fields": { "browser.server": "DESKTOP-KKITB6Q", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-4696831fbaabac1752d61293", "kind": "identity", "frame_number": 7898, "timestamp_epoch": "1631317546.466608000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 120, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-acb0227f0eaa96d6de201408", "kind": "identity", "frame_number": 7899, "timestamp_epoch": "1631317546.468116000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 120, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-bc2ff221f4dcb7a03b6337e6", "kind": "identity", "frame_number": 7900, "timestamp_epoch": "1631317546.468818000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 120, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-83406a2eaba1dd4617be415e", "kind": "identity", "frame_number": 7903, "timestamp_epoch": "1631317546.473068000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 120, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3", "kerberos.msg_type": "14" } }, { "event_id": "evt-d50e5870b2b22ceed7212a33", "kind": "identity", "frame_number": 7905, "timestamp_epoch": "1631317546.474791000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 120, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e", "kerberos.msg_type": "15" } }, { "event_id": "evt-5ea9b4a0c331b74c2bb14bc1", "kind": "identity", "frame_number": 7906, "timestamp_epoch": "1631317546.477566000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 120, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-7e17f738d5ead371e5aa9691", "kind": "identity", "frame_number": 7907, "timestamp_epoch": "1631317546.477749000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 120, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-1ec86b16956ec97f94122c42", "kind": "identity", "frame_number": 7908, "timestamp_epoch": "1631317546.479937000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 120, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-2cf6bc1bb8517d2f85665237", "kind": "identity", "frame_number": 7909, "timestamp_epoch": "1631317546.479938000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 120, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-25864a5db311b568b3526655", "kind": "identity", "frame_number": 7911, "timestamp_epoch": "1631317546.480221000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 120, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-fb1a8c2abf87a5d8764a3c41", "kind": "identity", "frame_number": 7912, "timestamp_epoch": "1631317546.480344000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 120, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-2cf1597f8593040b038bae8a", "kind": "identity", "frame_number": 7914, "timestamp_epoch": "1631317557.203342000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 120, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-d1fed135bfa7a1e656dc8353", "kind": "identity", "frame_number": 7915, "timestamp_epoch": "1631317557.203581000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 120, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-c65a8f8b1161b2f0ad83bb4d", "kind": "identity", "frame_number": 7918, "timestamp_epoch": "1631317557.562277000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 120, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-8e9603093f7df0c7d6f03f7d", "kind": "identity", "frame_number": 7919, "timestamp_epoch": "1631317557.562436000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 120, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-1c0fa6f2357226438783a866", "kind": "identity", "frame_number": 7927, "timestamp_epoch": "1631317627.604503000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-9e30daf2f90c4b91037620c4", "kind": "identity", "frame_number": 7928, "timestamp_epoch": "1631317627.604883000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-00fc8f05b221b3b5c3628130", "kind": "identity", "frame_number": 8022, "timestamp_epoch": "1631317883.331952000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 14, "fields": { "browser.server": "DESKTOP-KKITB6Q", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-100fab966e3c0d46aaffd6ae", "kind": "identity", "frame_number": 8131, "timestamp_epoch": "1631318227.964714000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-7aa2ab4892becbbb4c6b6781", "kind": "identity", "frame_number": 8132, "timestamp_epoch": "1631318227.964961000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-33e3bf488cd1b776ff312e7e", "kind": "identity", "frame_number": 8155, "timestamp_epoch": "1631318446.885526000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 128, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-55a3231e519cdb943efc0c5d", "kind": "identity", "frame_number": 8156, "timestamp_epoch": "1631318446.887061000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 128, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-758ec442fe3ccfe19e5413ce", "kind": "identity", "frame_number": 8157, "timestamp_epoch": "1631318446.887588000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 128, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-22d112b75d6ac6e2ce7ac63a", "kind": "identity", "frame_number": 8160, "timestamp_epoch": "1631318446.891646000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 128, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3", "kerberos.msg_type": "14" } }, { "event_id": "evt-160c0bb885e840015d4c0d67", "kind": "identity", "frame_number": 8162, "timestamp_epoch": "1631318446.892572000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 128, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e", "kerberos.msg_type": "15" } }, { "event_id": "evt-3ab2d434caad83cd1a42a9d2", "kind": "identity", "frame_number": 8163, "timestamp_epoch": "1631318446.894340000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 128, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-28d9126b8dfa27c10b1d1d8f", "kind": "identity", "frame_number": 8164, "timestamp_epoch": "1631318446.894547000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 128, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-7e50e8842fecdbe440580bc8", "kind": "identity", "frame_number": 8165, "timestamp_epoch": "1631318446.896189000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 128, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-732d54cb447f24dfea454577", "kind": "identity", "frame_number": 8166, "timestamp_epoch": "1631318446.896367000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 128, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-9e49401d60ce7b30d74c4969", "kind": "identity", "frame_number": 8168, "timestamp_epoch": "1631318446.896528000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 128, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-6ebe37b3ff346e0fbf3e89e5", "kind": "identity", "frame_number": 8169, "timestamp_epoch": "1631318446.896664000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 128, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-38bf838903603061c2e56e68", "kind": "identity", "frame_number": 8171, "timestamp_epoch": "1631318457.644726000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 128, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-a4cedb1283fdb6df3c84dae5", "kind": "identity", "frame_number": 8172, "timestamp_epoch": "1631318457.644977000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 128, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-dda5e4c5868475994d657f6b", "kind": "identity", "frame_number": 8173, "timestamp_epoch": "1631318457.864222000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 128, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-40c929af22c232c430060f21", "kind": "identity", "frame_number": 8174, "timestamp_epoch": "1631318457.864436000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 128, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-42c54b32468e96495024edb4", "kind": "identity", "frame_number": 8253, "timestamp_epoch": "1631318600.976844000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 14, "fields": { "browser.server": "DESKTOP-KKITB6Q", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-0d68d9f8f74a76a952eaf6f4", "kind": "identity", "frame_number": 8317, "timestamp_epoch": "1631318828.315446000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-fffc47e40b72e49c434f0a25", "kind": "identity", "frame_number": 8318, "timestamp_epoch": "1631318828.315731000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-a4b82587d5f1618fb3be12c0", "kind": "identity", "frame_number": 8532, "timestamp_epoch": "1631319323.573694000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 14, "fields": { "browser.server": "DESKTOP-KKITB6Q", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-9cf55c4eb52be95a3a5255cf", "kind": "identity", "frame_number": 8541, "timestamp_epoch": "1631319347.151377000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 140, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-e08e1b0b52d010c41185311e", "kind": "identity", "frame_number": 8542, "timestamp_epoch": "1631319347.152899000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 140, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-d33ff3594f82a1b2ce6a5209", "kind": "identity", "frame_number": 8543, "timestamp_epoch": "1631319347.153601000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 140, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-2a85fe7635d1cc1477259dce", "kind": "identity", "frame_number": 8546, "timestamp_epoch": "1631319347.157621000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 140, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3", "kerberos.msg_type": "14" } }, { "event_id": "evt-1c0b29faae25bf3bf287421c", "kind": "identity", "frame_number": 8548, "timestamp_epoch": "1631319347.159440000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 140, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e", "kerberos.msg_type": "15" } }, { "event_id": "evt-1df0539434935044a71738e1", "kind": "identity", "frame_number": 8549, "timestamp_epoch": "1631319347.162078000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 140, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-29fefb9b35229858d041c9f1", "kind": "identity", "frame_number": 8550, "timestamp_epoch": "1631319347.162336000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 140, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-34c154b588c11583f90fefe2", "kind": "identity", "frame_number": 8551, "timestamp_epoch": "1631319347.163998000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 140, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-4357e04b799faabd4a770a37", "kind": "identity", "frame_number": 8552, "timestamp_epoch": "1631319347.164089000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 140, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-25af75a98067aea99856b3a7", "kind": "identity", "frame_number": 8554, "timestamp_epoch": "1631319347.164282000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 140, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-6258a7973c32bb95f6f590c7", "kind": "identity", "frame_number": 8555, "timestamp_epoch": "1631319347.164463000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 140, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-8d5789c65f559b86f8d60a47", "kind": "identity", "frame_number": 8557, "timestamp_epoch": "1631319357.892974000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 140, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-0617073b83555d5fb834b4bd", "kind": "identity", "frame_number": 8558, "timestamp_epoch": "1631319357.893139000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 140, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-bfb7e0a64e1685aeba6d63ff", "kind": "identity", "frame_number": 8561, "timestamp_epoch": "1631319358.219571000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 140, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-aef2377c2484769f218e895d", "kind": "identity", "frame_number": 8562, "timestamp_epoch": "1631319358.219769000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 140, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-2eab00a4c0e0daa3909cc37a", "kind": "identity", "frame_number": 8568, "timestamp_epoch": "1631319428.678249000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-c922188bf22c04f7ea848582", "kind": "identity", "frame_number": 8569, "timestamp_epoch": "1631319428.678589000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-607aad5a78c095caddbfcf48", "kind": "identity", "frame_number": 8697, "timestamp_epoch": "1631319741.442067000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 146, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3", "kerberos.msg_type": "14" } }, { "event_id": "evt-c09892011f9100899a596783", "kind": "identity", "frame_number": 8699, "timestamp_epoch": "1631319741.443328000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 146, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e", "kerberos.msg_type": "15" } }, { "event_id": "evt-d37db9a3fc9f7b2ee9badc99", "kind": "identity", "frame_number": 8700, "timestamp_epoch": "1631319741.445895000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 146, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3", "kerberos.msg_type": "15" } }, { "event_id": "evt-9f1ed121304c2ee72d8898cf", "kind": "identity", "frame_number": 8730, "timestamp_epoch": "1631319742.094653000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 147, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3", "kerberos.msg_type": "14" } }, { "event_id": "evt-519396fa024aebadf4f1a7cc", "kind": "identity", "frame_number": 8732, "timestamp_epoch": "1631319742.096110000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 147, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e", "kerberos.msg_type": "15" } }, { "event_id": "evt-2d78add9e9828f142591a2ea", "kind": "identity", "frame_number": 8744, "timestamp_epoch": "1631319742.157383000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 148, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3", "kerberos.msg_type": "14" } }, { "event_id": "evt-e91fa466c680855be0557ace", "kind": "identity", "frame_number": 8746, "timestamp_epoch": "1631319742.158067000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 148, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e", "kerberos.msg_type": "15" } }, { "event_id": "evt-f07c7453c5110a80cee55369", "kind": "identity", "frame_number": 8831, "timestamp_epoch": "1631320029.034685000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-a01694b752db83bfd8b6906e", "kind": "identity", "frame_number": 8832, "timestamp_epoch": "1631320029.034920000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-c1fdefc9c829564ef07b25cb", "kind": "identity", "frame_number": 8874, "timestamp_epoch": "1631320040.658572000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 14, "fields": { "browser.server": "DESKTOP-KKITB6Q", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-f52188b62ff9f0124b0652cb", "kind": "identity", "frame_number": 8896, "timestamp_epoch": "1631320086.161009000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 154, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3", "kerberos.msg_type": "14" } }, { "event_id": "evt-0894194cc1fb026deda570b2", "kind": "identity", "frame_number": 8899, "timestamp_epoch": "1631320086.162274000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 154, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e", "kerberos.msg_type": "15" } }, { "event_id": "evt-20c6f51893a249858bd3df5c", "kind": "identity", "frame_number": 8900, "timestamp_epoch": "1631320086.163845000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 154, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3", "kerberos.msg_type": "15" } }, { "event_id": "evt-b8ef7d524fc656f3199b27b1", "kind": "identity", "frame_number": 8917, "timestamp_epoch": "1631320086.887609000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 155, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3", "kerberos.msg_type": "14" } }, { "event_id": "evt-56f28255f29e6752804ffa54", "kind": "identity", "frame_number": 8919, "timestamp_epoch": "1631320086.889082000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 155, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e", "kerberos.msg_type": "15" } }, { "event_id": "evt-14161f74f522272d3bf6db7e", "kind": "identity", "frame_number": 8930, "timestamp_epoch": "1631320087.069008000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 156, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3", "kerberos.msg_type": "14" } }, { "event_id": "evt-2cc612840e9854148d9c0815", "kind": "identity", "frame_number": 8932, "timestamp_epoch": "1631320087.070473000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 156, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e", "kerberos.msg_type": "15" } }, { "event_id": "evt-f16e798c357b31b8a9cdf1b9", "kind": "identity", "frame_number": 8945, "timestamp_epoch": "1631320087.592152000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-c946b04b166f74832c5ce223", "kind": "identity", "frame_number": 8946, "timestamp_epoch": "1631320087.593634000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-86b0d8e9b0ecb8372f3a2c96", "kind": "identity", "frame_number": 8947, "timestamp_epoch": "1631320087.594389000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-cf44381488a275d2ae8446e0", "kind": "identity", "frame_number": 8950, "timestamp_epoch": "1631320087.598395000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3", "kerberos.msg_type": "14" } }, { "event_id": "evt-8c74fbe32a06c63b0d476025", "kind": "identity", "frame_number": 8952, "timestamp_epoch": "1631320087.600218000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e", "kerberos.msg_type": "15" } }, { "event_id": "evt-f8d2062276442afc16079c6c", "kind": "identity", "frame_number": 8953, "timestamp_epoch": "1631320087.602959000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-e8967aac89045c29a82e7f05", "kind": "identity", "frame_number": 8954, "timestamp_epoch": "1631320087.603404000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-041f4a6e46764d304ac17811", "kind": "identity", "frame_number": 8955, "timestamp_epoch": "1631320087.604964000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-c3f31b9cfd544842b5deb559", "kind": "identity", "frame_number": 8956, "timestamp_epoch": "1631320087.605223000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-efe20afeadfb725c1bbce738", "kind": "identity", "frame_number": 8957, "timestamp_epoch": "1631320087.605297000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-98887fc47008cffe87388e43", "kind": "identity", "frame_number": 8958, "timestamp_epoch": "1631320087.605959000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-3eec3b1f5cd0aa1a7a592369", "kind": "identity", "frame_number": 8960, "timestamp_epoch": "1631320087.607077000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-5bc9856d496630333df6dadd", "kind": "identity", "frame_number": 8961, "timestamp_epoch": "1631320087.607314000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-36c3f4cac1dae48c9c2e4795", "kind": "identity", "frame_number": 8962, "timestamp_epoch": "1631320087.609529000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-d8dcfbbe552d349827881381", "kind": "identity", "frame_number": 8963, "timestamp_epoch": "1631320087.609827000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-4b5de29ef38fa0bd827711cb", "kind": "identity", "frame_number": 8964, "timestamp_epoch": "1631320087.612076000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-eac99aabfdad38bbd172bebf", "kind": "identity", "frame_number": 8965, "timestamp_epoch": "1631320087.612436000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-e42c66890cfb1f845ec94b1c", "kind": "identity", "frame_number": 8966, "timestamp_epoch": "1631320087.623004000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-ca95e0fa1d5dacfd4553b8fc", "kind": "identity", "frame_number": 8967, "timestamp_epoch": "1631320087.623597000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-2efe147e9a4d1af925e45636", "kind": "identity", "frame_number": 8968, "timestamp_epoch": "1631320087.625657000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-0c40e755d3c73fe923140854", "kind": "identity", "frame_number": 8969, "timestamp_epoch": "1631320087.625899000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-5904c6c60689021d0fa593be", "kind": "identity", "frame_number": 8970, "timestamp_epoch": "1631320087.627570000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-9456746107f81c30b223e194", "kind": "identity", "frame_number": 8971, "timestamp_epoch": "1631320087.627971000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-e2276947fd6efbb0143435ff", "kind": "identity", "frame_number": 8972, "timestamp_epoch": "1631320087.631633000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-43001e1f5455a69ecdcdadad", "kind": "identity", "frame_number": 8973, "timestamp_epoch": "1631320087.632022000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-d5a5fcbc88b53fbadc14644d", "kind": "identity", "frame_number": 8974, "timestamp_epoch": "1631320087.634154000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-d21f323766d64edf6357f094", "kind": "identity", "frame_number": 8975, "timestamp_epoch": "1631320087.634458000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-b2bd5bcfda474c41ccdb357d", "kind": "identity", "frame_number": 8976, "timestamp_epoch": "1631320087.636593000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-2ac29c2197a61b3adf4d4d37", "kind": "identity", "frame_number": 8977, "timestamp_epoch": "1631320087.636978000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-364fab0519670ba30aff2ccf", "kind": "identity", "frame_number": 8978, "timestamp_epoch": "1631320087.640887000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-227891963dd0dc12e0718603", "kind": "identity", "frame_number": 8979, "timestamp_epoch": "1631320087.641164000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-d3bed2b2c12f1f09933f9fd8", "kind": "identity", "frame_number": 8980, "timestamp_epoch": "1631320087.643323000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-fedb04ec12d7d228eb808985", "kind": "identity", "frame_number": 8981, "timestamp_epoch": "1631320087.643444000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-8eab47443b47995d378b320c", "kind": "identity", "frame_number": 8982, "timestamp_epoch": "1631320087.645546000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-00e4433a4a6808056a1ba459", "kind": "identity", "frame_number": 8983, "timestamp_epoch": "1631320087.645954000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-c6b2c2805194867a1ff5804e", "kind": "identity", "frame_number": 8984, "timestamp_epoch": "1631320087.650015000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-3ce342f7933fab92e1356f75", "kind": "identity", "frame_number": 8985, "timestamp_epoch": "1631320087.650427000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-dc91ca37b3be9c333d65f852", "kind": "identity", "frame_number": 8986, "timestamp_epoch": "1631320087.652574000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-8f6d7c83eaa623b11c42ca67", "kind": "identity", "frame_number": 8987, "timestamp_epoch": "1631320087.652850000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-678a2e2c9c6505123109af7f", "kind": "identity", "frame_number": 8988, "timestamp_epoch": "1631320087.655048000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-ee63984bfcc86d5086aad21e", "kind": "identity", "frame_number": 8989, "timestamp_epoch": "1631320087.655455000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-b8078da55669b01dae105052", "kind": "identity", "frame_number": 8990, "timestamp_epoch": "1631320087.657905000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-314709347766cca8e6ba0592", "kind": "identity", "frame_number": 8991, "timestamp_epoch": "1631320087.658320000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-ee3e08a4f2e4d6b539397e13", "kind": "identity", "frame_number": 8994, "timestamp_epoch": "1631320087.872038000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-1637d13a492a30b762b4ef14", "kind": "identity", "frame_number": 8995, "timestamp_epoch": "1631320087.872109000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-1c35211c5b9dea15156dfe37", "kind": "identity", "frame_number": 8996, "timestamp_epoch": "1631320087.873692000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-ce4611547b0cda414dce9e0c", "kind": "identity", "frame_number": 8997, "timestamp_epoch": "1631320087.873945000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-eab59b5a332401afa724ed00", "kind": "identity", "frame_number": 8998, "timestamp_epoch": "1631320087.876192000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-1cab4e0d7cefa8d89edfc341", "kind": "identity", "frame_number": 8999, "timestamp_epoch": "1631320087.876298000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-47a9a4914c0b9b0a51d56744", "kind": "identity", "frame_number": 9000, "timestamp_epoch": "1631320087.878606000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-60c8183b012ff498ff16552b", "kind": "identity", "frame_number": 9001, "timestamp_epoch": "1631320087.878970000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-0f38dc3c5f7d402d921f4247", "kind": "identity", "frame_number": 9002, "timestamp_epoch": "1631320087.881191000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-c7b169ed1b2f9a28ba2bd726", "kind": "identity", "frame_number": 9003, "timestamp_epoch": "1631320087.881485000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-ddfee58a8c865b992439f887", "kind": "identity", "frame_number": 9004, "timestamp_epoch": "1631320087.883691000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-f0c9546e6eaf3f334aa20afa", "kind": "identity", "frame_number": 9005, "timestamp_epoch": "1631320087.883993000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-d0eff7ec428ef78985bf7a4c", "kind": "identity", "frame_number": 9006, "timestamp_epoch": "1631320087.886191000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-cce968b071e5d88c42325ae1", "kind": "identity", "frame_number": 9007, "timestamp_epoch": "1631320087.886403000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-c378c01c66824285516f7c99", "kind": "identity", "frame_number": 9008, "timestamp_epoch": "1631320087.888566000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-a955213c66a80f64067d3e5d", "kind": "identity", "frame_number": 9009, "timestamp_epoch": "1631320087.888864000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-8becfa41bb2657f2835989d1", "kind": "identity", "frame_number": 9010, "timestamp_epoch": "1631320087.891066000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-f35d868632ef2505883030bf", "kind": "identity", "frame_number": 9011, "timestamp_epoch": "1631320087.891326000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-5774c289226a4f9d0ce26c1a", "kind": "identity", "frame_number": 9014, "timestamp_epoch": "1631320088.108288000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-ed0b37bc396c531eb9683e7e", "kind": "identity", "frame_number": 9015, "timestamp_epoch": "1631320088.108663000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-11beba1c70553a9093dbaba5", "kind": "identity", "frame_number": 9016, "timestamp_epoch": "1631320088.112059000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-d40c9e5d04dd55ebc202cb01", "kind": "identity", "frame_number": 9017, "timestamp_epoch": "1631320088.112288000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-1379768994aeaae80d4c4969", "kind": "identity", "frame_number": 9018, "timestamp_epoch": "1631320088.114936000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-c3abac54d68206cf6a7421bd", "kind": "identity", "frame_number": 9019, "timestamp_epoch": "1631320088.115458000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-8f418699b2c280f358630f79", "kind": "identity", "frame_number": 9020, "timestamp_epoch": "1631320088.118180000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-f99f936eab63ba536b6870c2", "kind": "identity", "frame_number": 9021, "timestamp_epoch": "1631320088.118530000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-7dec5b9d5fb570d8440e3885", "kind": "identity", "frame_number": 9022, "timestamp_epoch": "1631320088.121380000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-22bed97756898d2f013bd8fc", "kind": "identity", "frame_number": 9023, "timestamp_epoch": "1631320088.121982000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-2f6beaf746b9c8eaad3dde1d", "kind": "identity", "frame_number": 9024, "timestamp_epoch": "1631320088.124309000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-f9f483789f726be4f4c22da5", "kind": "identity", "frame_number": 9025, "timestamp_epoch": "1631320088.124552000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-f2fe908fa7ecaa0463ab618f", "kind": "identity", "frame_number": 9026, "timestamp_epoch": "1631320088.126808000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-e668aea48fb0e3b73ad5f599", "kind": "identity", "frame_number": 9027, "timestamp_epoch": "1631320088.127089000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-041d6bdfd71b9df0b4a4e0dc", "kind": "identity", "frame_number": 9028, "timestamp_epoch": "1631320088.129308000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-2910957abfecf7ed365393e7", "kind": "identity", "frame_number": 9029, "timestamp_epoch": "1631320088.129588000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-a738609bd80c5e89f246320a", "kind": "identity", "frame_number": 9030, "timestamp_epoch": "1631320088.131848000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-ed07bc299bd6a34b28c8f07e", "kind": "identity", "frame_number": 9031, "timestamp_epoch": "1631320088.132215000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-dd3b1feb7ac87650e0d72360", "kind": "identity", "frame_number": 9032, "timestamp_epoch": "1631320088.134558000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-01914bd88c79cdce3bd31a7b", "kind": "identity", "frame_number": 9033, "timestamp_epoch": "1631320088.134788000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-4c26885802996aad979bc0e1", "kind": "identity", "frame_number": 9034, "timestamp_epoch": "1631320088.137059000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-e0d4bc9e3684ddd73343b7b9", "kind": "identity", "frame_number": 9035, "timestamp_epoch": "1631320088.137246000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-8d9a507abccab498356c8a96", "kind": "identity", "frame_number": 9036, "timestamp_epoch": "1631320088.139390000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-89afc5fbf3fdb7b1423852dd", "kind": "identity", "frame_number": 9037, "timestamp_epoch": "1631320088.139691000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-526091083acd6a22539dc6ea", "kind": "identity", "frame_number": 9038, "timestamp_epoch": "1631320088.141933000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-94d88b49be41b95fed31d573", "kind": "identity", "frame_number": 9039, "timestamp_epoch": "1631320088.142165000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-0f8d5da434776f6df068bb25", "kind": "identity", "frame_number": 9040, "timestamp_epoch": "1631320088.144433000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-b0084698ff57e2057fff943a", "kind": "identity", "frame_number": 9041, "timestamp_epoch": "1631320088.144611000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-6720f2d545c8c0ba1dc6adb1", "kind": "identity", "frame_number": 9042, "timestamp_epoch": "1631320088.150807000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-38e056d367882153490a0d9d", "kind": "identity", "frame_number": 9043, "timestamp_epoch": "1631320088.151078000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-cf598cc9cba607835c8fc9bc", "kind": "identity", "frame_number": 9044, "timestamp_epoch": "1631320088.153310000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-8e41a3659e09cb73c0fbcb92", "kind": "identity", "frame_number": 9046, "timestamp_epoch": "1631320088.153953000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-dfc8df967271ae07ffd3a8d0", "kind": "identity", "frame_number": 9048, "timestamp_epoch": "1631320088.156554000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-ac54e0df8ea894b49bf9dbab", "kind": "identity", "frame_number": 9049, "timestamp_epoch": "1631320088.156837000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-2efab5abbb7310379bf22e6e", "kind": "identity", "frame_number": 9050, "timestamp_epoch": "1631320088.159368000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-ec5984aa9ea83d43107735eb", "kind": "identity", "frame_number": 9051, "timestamp_epoch": "1631320088.159789000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-e8df186fac730fff3184647e", "kind": "identity", "frame_number": 9052, "timestamp_epoch": "1631320088.161932000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-264adebd0bdf625ec5dc6e03", "kind": "identity", "frame_number": 9053, "timestamp_epoch": "1631320088.162174000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-010e04c82ede5435b06318a5", "kind": "identity", "frame_number": 9054, "timestamp_epoch": "1631320088.163819000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-084dce938eb5a52b5f8c1be9", "kind": "identity", "frame_number": 9055, "timestamp_epoch": "1631320088.164065000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-46f566dafd82083e930e2ae4", "kind": "identity", "frame_number": 9056, "timestamp_epoch": "1631320088.166182000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-3edb4d03a878ce186af1b57f", "kind": "identity", "frame_number": 9057, "timestamp_epoch": "1631320088.166426000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-9e69f6a9262176a0d9899886", "kind": "identity", "frame_number": 9058, "timestamp_epoch": "1631320088.168071000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-c8712134f47e26aa685d1f51", "kind": "identity", "frame_number": 9059, "timestamp_epoch": "1631320088.168272000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-aa40ade6348db6c73c1031c4", "kind": "identity", "frame_number": 9060, "timestamp_epoch": "1631320088.170474000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-470fb49c38cba4b9efeda282", "kind": "identity", "frame_number": 9061, "timestamp_epoch": "1631320088.170821000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-db0cdcd86a3d11c19a707ce7", "kind": "identity", "frame_number": 9062, "timestamp_epoch": "1631320088.172933000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-2d55991611edaddaf4b2c7d9", "kind": "identity", "frame_number": 9063, "timestamp_epoch": "1631320088.173176000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-d2f9b8f9a52095289be51e6d", "kind": "identity", "frame_number": 9064, "timestamp_epoch": "1631320088.174796000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-2499f35078a8cabb362a4a0c", "kind": "identity", "frame_number": 9065, "timestamp_epoch": "1631320088.174985000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-4340b8949895c4c862d1f4df", "kind": "identity", "frame_number": 9066, "timestamp_epoch": "1631320088.176623000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-262082c344d50336b9e6f115", "kind": "identity", "frame_number": 9067, "timestamp_epoch": "1631320088.176792000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-7db2dae5d91c5b282af75e4b", "kind": "identity", "frame_number": 9068, "timestamp_epoch": "1631320088.178410000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-3924e7ee618a7eb8584ddd1d", "kind": "identity", "frame_number": 9069, "timestamp_epoch": "1631320088.178642000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-e48f912f7eb3ab1979eb909c", "kind": "identity", "frame_number": 9070, "timestamp_epoch": "1631320088.180237000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-4445259fc3ef6d9242981ea5", "kind": "identity", "frame_number": 9071, "timestamp_epoch": "1631320088.180563000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-c4ec4c970302c5318a8b1094", "kind": "identity", "frame_number": 9072, "timestamp_epoch": "1631320088.294806000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-637d2a979f6f8cabcc82bea0", "kind": "identity", "frame_number": 9073, "timestamp_epoch": "1631320088.295022000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-edf8e8c64dfdff1326a648e3", "kind": "identity", "frame_number": 9074, "timestamp_epoch": "1631320088.297555000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-80f0e726306ba07a0a4414f0", "kind": "identity", "frame_number": 9075, "timestamp_epoch": "1631320088.297776000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-d0f8a28a95123724507ea36e", "kind": "identity", "frame_number": 9076, "timestamp_epoch": "1631320088.300675000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-a485c5dc142e3fc3b5d6a3c9", "kind": "identity", "frame_number": 9077, "timestamp_epoch": "1631320088.300780000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-f21af9d49dfb665f51c0b8b2", "kind": "identity", "frame_number": 9163, "timestamp_epoch": "1631320247.158688000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3", "kerberos.msg_type": "14" } }, { "event_id": "evt-dd13b2aee2a6e0ef7ed7aca6", "kind": "identity", "frame_number": 9165, "timestamp_epoch": "1631320247.160559000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e", "kerberos.msg_type": "15" } }, { "event_id": "evt-c7a87197cab86a4da58c1f80", "kind": "identity", "frame_number": 9166, "timestamp_epoch": "1631320247.163303000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-a85a25779866b0652623ef05", "kind": "identity", "frame_number": 9167, "timestamp_epoch": "1631320247.163562000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-8ac73a39abb836b31991b1ec", "kind": "identity", "frame_number": 9168, "timestamp_epoch": "1631320247.166048000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-3875cc3ddc8794a661161971", "kind": "identity", "frame_number": 9169, "timestamp_epoch": "1631320247.166480000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-3a765d17208eae276d618172", "kind": "identity", "frame_number": 9171, "timestamp_epoch": "1631320259.311533000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-760e4a166292eae5acc3d672", "kind": "identity", "frame_number": 9172, "timestamp_epoch": "1631320259.311894000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-199f38f292be4d71dea03131", "kind": "identity", "frame_number": 9173, "timestamp_epoch": "1631320259.314034000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-6d099e00d58a898621bfc4ce", "kind": "identity", "frame_number": 9174, "timestamp_epoch": "1631320259.314401000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-e2eb6023473686c2ca834468", "kind": "identity", "frame_number": 9175, "timestamp_epoch": "1631320259.316533000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-ec007638caf0d1059df23c48", "kind": "identity", "frame_number": 9176, "timestamp_epoch": "1631320259.316903000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-d4b7defa1961c98bc5ddc1db", "kind": "identity", "frame_number": 9177, "timestamp_epoch": "1631320259.319033000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-d84ca44708af7b4f2f75b7e5", "kind": "identity", "frame_number": 9178, "timestamp_epoch": "1631320259.319299000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-2b2f5ea7b74cf1881d62e83c", "kind": "identity", "frame_number": 9179, "timestamp_epoch": "1631320259.321404000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-24df4819dd03662f5208c246", "kind": "identity", "frame_number": 9180, "timestamp_epoch": "1631320259.321601000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-7d72c98502e63f2f9e5137a0", "kind": "identity", "frame_number": 9181, "timestamp_epoch": "1631320259.323239000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-208a72895aec04254183eb00", "kind": "identity", "frame_number": 9182, "timestamp_epoch": "1631320259.323448000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-7c65e470b488d7716349b322", "kind": "identity", "frame_number": 9186, "timestamp_epoch": "1631320270.043816000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-536aab49b4eaad6c6ce60966", "kind": "identity", "frame_number": 9187, "timestamp_epoch": "1631320270.043975000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } }, { "event_id": "evt-dd75cf31a547c3d1a44279a7", "kind": "identity", "frame_number": 9190, "timestamp_epoch": "1631320270.277900000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "14:18:77:0f:c6:9e", "eth.src": "00:4f:49:b1:e8:c3" } }, { "event_id": "evt-210af6e0e75dbbdc21b1bc4c", "kind": "identity", "frame_number": 9191, "timestamp_epoch": "1631320270.278115000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 157, "udp_stream": null, "fields": { "eth.dst": "00:4f:49:b1:e8:c3", "eth.src": "14:18:77:0f:c6:9e" } } ], "directory_service": [ { "event_id": "evt-bb90a5e9d0fdecd834759cf0", "kind": "directory_service", "frame_number": 80, "timestamp_epoch": "1631315714.903567000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-937f5c0d0b5ad4954881ed6a", "kind": "directory_service", "frame_number": 82, "timestamp_epoch": "1631315714.905140000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-46a8b4074a2fbd96f43c9409", "kind": "directory_service", "frame_number": 83, "timestamp_epoch": "1631315714.907528000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "ldap.protocolOp": "2" } }, { "event_id": "evt-0b007acaa30905a153a1774a", "kind": "directory_service", "frame_number": 389, "timestamp_epoch": "1631315816.202252000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 15, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-6c9bf7a1e450efaeaecb4771", "kind": "directory_service", "frame_number": 391, "timestamp_epoch": "1631315816.202503000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 15, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-078121b6bc040c097d264b23", "kind": "directory_service", "frame_number": 398, "timestamp_epoch": "1631315816.203725000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 15, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-af48c7c668f525c87c563f60", "kind": "directory_service", "frame_number": 401, "timestamp_epoch": "1631315816.204127000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 15, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-4113c683d51ef429ac783a74", "kind": "directory_service", "frame_number": 404, "timestamp_epoch": "1631315816.205311000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 15, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-bfc544107ca3f0a05cb0984d", "kind": "directory_service", "frame_number": 406, "timestamp_epoch": "1631315816.205807000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 15, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-db8c3bfa58aba962df1f29ff", "kind": "directory_service", "frame_number": 417, "timestamp_epoch": "1631315816.208329000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 15, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-9d0cb05c80d34cce8a59b12a", "kind": "directory_service", "frame_number": 418, "timestamp_epoch": "1631315816.208461000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 15, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-38f1dbd088c5ec93b93da40e", "kind": "directory_service", "frame_number": 440, "timestamp_epoch": "1631315816.243133000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "samr.opnum": "64" } }, { "event_id": "evt-c380f60fef6982de2e263210", "kind": "directory_service", "frame_number": 441, "timestamp_epoch": "1631315816.243557000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "samr.opnum": "64" } }, { "event_id": "evt-f1862c4f2099e3a3a8f57e54", "kind": "directory_service", "frame_number": 442, "timestamp_epoch": "1631315816.245054000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "samr.opnum": "6" } }, { "event_id": "evt-0c88968131f3d39f1e9e8766", "kind": "directory_service", "frame_number": 443, "timestamp_epoch": "1631315816.245465000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "samr.opnum": "6" } }, { "event_id": "evt-3c0d407210765dd6eb112d17", "kind": "directory_service", "frame_number": 444, "timestamp_epoch": "1631315816.246899000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "samr.opnum": "5" } }, { "event_id": "evt-ca9f38447869be71349719f4", "kind": "directory_service", "frame_number": 445, "timestamp_epoch": "1631315816.247380000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "samr.opnum": "5" } }, { "event_id": "evt-77be04215bbe690b508be26f", "kind": "directory_service", "frame_number": 446, "timestamp_epoch": "1631315816.248730000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "samr.opnum": "7" } }, { "event_id": "evt-35edc58184d4e858949e520b", "kind": "directory_service", "frame_number": 447, "timestamp_epoch": "1631315816.249191000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "samr.opnum": "7" } }, { "event_id": "evt-3fe4168456b64614c098e568", "kind": "directory_service", "frame_number": 448, "timestamp_epoch": "1631315816.250617000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "samr.opnum": "7" } }, { "event_id": "evt-6c5df0d920ee576cd27972fa", "kind": "directory_service", "frame_number": 449, "timestamp_epoch": "1631315816.250931000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "samr.opnum": "7" } }, { "event_id": "evt-5c6af1660873e989931b0df3", "kind": "directory_service", "frame_number": 450, "timestamp_epoch": "1631315816.252375000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "samr.opnum": "17" } }, { "event_id": "evt-5031f1d6e16bd3b972a1581e", "kind": "directory_service", "frame_number": 451, "timestamp_epoch": "1631315816.252925000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "samr.opnum": "17" } }, { "event_id": "evt-d0bc649b7236f607c3ae28c8", "kind": "directory_service", "frame_number": 452, "timestamp_epoch": "1631315816.254369000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "samr.opnum": "34" } }, { "event_id": "evt-ca03daba78ee33b1dbf0a53b", "kind": "directory_service", "frame_number": 453, "timestamp_epoch": "1631315816.254812000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "samr.opnum": "34" } }, { "event_id": "evt-450f42edc6dc1e0eba43272e", "kind": "directory_service", "frame_number": 454, "timestamp_epoch": "1631315816.256268000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "samr.opnum": "36" } }, { "event_id": "evt-275a1fd7b43551b6067d76fd", "kind": "directory_service", "frame_number": 455, "timestamp_epoch": "1631315816.256961000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "samr.opnum": "36", "samr.samr_UserInfo21.account_name": "hobart.gunnarsson", "samr.samr_UserInfo21.full_name": "Hobart Gunnarsson" } }, { "event_id": "evt-c37be9937191cc8f4bc5e9d2", "kind": "directory_service", "frame_number": 456, "timestamp_epoch": "1631315816.258395000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "samr.opnum": "3" } }, { "event_id": "evt-24347af3987ed339116db05f", "kind": "directory_service", "frame_number": 457, "timestamp_epoch": "1631315816.258946000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "samr.opnum": "3" } }, { "event_id": "evt-1d01959c61af2720193cb0bb", "kind": "directory_service", "frame_number": 458, "timestamp_epoch": "1631315816.260346000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "samr.opnum": "39" } }, { "event_id": "evt-96efb95a83ac2fcfe996afb4", "kind": "directory_service", "frame_number": 459, "timestamp_epoch": "1631315816.260793000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "samr.opnum": "39" } }, { "event_id": "evt-6ee25c6319e2534ad3d7650b", "kind": "directory_service", "frame_number": 460, "timestamp_epoch": "1631315816.262280000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "samr.opnum": "16" } }, { "event_id": "evt-931d0524db81f5affb8fe8d5", "kind": "directory_service", "frame_number": 461, "timestamp_epoch": "1631315816.262733000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "samr.opnum": "16" } }, { "event_id": "evt-4db2a08d2bc21a2c9a60b5f9", "kind": "directory_service", "frame_number": 462, "timestamp_epoch": "1631315816.264186000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "samr.opnum": "1" } }, { "event_id": "evt-e1fe2d8f600f615105349b74", "kind": "directory_service", "frame_number": 463, "timestamp_epoch": "1631315816.264601000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "samr.opnum": "1" } }, { "event_id": "evt-848e9d4521531985426ee30e", "kind": "directory_service", "frame_number": 464, "timestamp_epoch": "1631315816.265989000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "samr.opnum": "1" } }, { "event_id": "evt-b35a5c4a00b0964649432b9a", "kind": "directory_service", "frame_number": 465, "timestamp_epoch": "1631315816.266340000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "samr.opnum": "1" } }, { "event_id": "evt-463b56431208a4f2f8c67815", "kind": "directory_service", "frame_number": 466, "timestamp_epoch": "1631315816.267805000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "samr.opnum": "1" } }, { "event_id": "evt-da21dc4bd4311248c90165bb", "kind": "directory_service", "frame_number": 467, "timestamp_epoch": "1631315816.268210000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "samr.opnum": "1" } }, { "event_id": "evt-8bddd81de8a06925a92cb810", "kind": "directory_service", "frame_number": 468, "timestamp_epoch": "1631315816.269633000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "samr.opnum": "1" } }, { "event_id": "evt-b425cde024735703987c15d4", "kind": "directory_service", "frame_number": 469, "timestamp_epoch": "1631315816.269868000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "samr.opnum": "1" } }, { "event_id": "evt-a3e86acc253fbc34db42bee3", "kind": "directory_service", "frame_number": 478, "timestamp_epoch": "1631315816.964061000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 22, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-f4cc63c53857314d7ebfcb13", "kind": "directory_service", "frame_number": 480, "timestamp_epoch": "1631315816.964799000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 22, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-59a217ff8afd820879e99add", "kind": "directory_service", "frame_number": 483, "timestamp_epoch": "1631315816.973775000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 22, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-f424cb732b58a51927ff5ecd", "kind": "directory_service", "frame_number": 485, "timestamp_epoch": "1631315816.975285000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 22, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-b6e4b6ca0bc7a24e981a7c58", "kind": "directory_service", "frame_number": 486, "timestamp_epoch": "1631315817.013900000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 22, "udp_stream": null, "fields": { "ldap.baseObject": "DC=angrypoutine,DC=com", "ldap.filter": "1", "ldap.protocolOp": "3" } }, { "event_id": "evt-2c42d14d71f7b529071267f5", "kind": "directory_service", "frame_number": 487, "timestamp_epoch": "1631315817.014530000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 22, "udp_stream": null, "fields": { "ldap.protocolOp": "4,19,19,19,5" } }, { "event_id": "evt-53e25ad5dea95454c4d287cf", "kind": "directory_service", "frame_number": 493, "timestamp_epoch": "1631315817.083271000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 23, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-d7f34d7fbfaf89f705093ab8", "kind": "directory_service", "frame_number": 495, "timestamp_epoch": "1631315817.084711000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 23, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-4c36a6631affa7f386c45447", "kind": "directory_service", "frame_number": 496, "timestamp_epoch": "1631315817.092275000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 23, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-2c7f3ab437d9796166032c83", "kind": "directory_service", "frame_number": 497, "timestamp_epoch": "1631315817.092525000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 23, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-f301115e53383c6b03391243", "kind": "directory_service", "frame_number": 498, "timestamp_epoch": "1631315817.096649000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 23, "udp_stream": null, "fields": { "ldap.baseObject": "CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=angrypoutine,DC=com", "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-3a48d4aa2ff4e3f58739d80e", "kind": "directory_service", "frame_number": 499, "timestamp_epoch": "1631315817.097104000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 23, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-a4a1c0e7f280a316b1d8381d", "kind": "directory_service", "frame_number": 500, "timestamp_epoch": "1631315817.117237000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 22, "udp_stream": null, "fields": { "ldap.baseObject": "cn=policies,cn=system,DC=angrypoutine,DC=com", "ldap.filter": "0", "ldap.protocolOp": "3" } }, { "event_id": "evt-da64ff02207ae573e83615f3", "kind": "directory_service", "frame_number": 501, "timestamp_epoch": "1631315817.117819000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 22, "udp_stream": null, "fields": { "ldap.protocolOp": "5" } }, { "event_id": "evt-2edafd0cdaf18f5602846c47", "kind": "directory_service", "frame_number": 502, "timestamp_epoch": "1631315817.146873000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 23, "udp_stream": null, "fields": { "ldap.protocolOp": "2" } }, { "event_id": "evt-e5b4a1c5f5294f09d0ddf60d", "kind": "directory_service", "frame_number": 506, "timestamp_epoch": "1631315817.172122000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 22, "udp_stream": null, "fields": { "ldap.protocolOp": "2" } }, { "event_id": "evt-7fa54d3b0bd803c1be3dcc0c", "kind": "directory_service", "frame_number": 2059, "timestamp_epoch": "1631315877.056698000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 67, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-3c90a8016e132d042cb1b8b0", "kind": "directory_service", "frame_number": 2060, "timestamp_epoch": "1631315877.057161000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 67, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-5130f50eb45b2c011d045b7d", "kind": "directory_service", "frame_number": 2067, "timestamp_epoch": "1631315877.061719000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 67, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-cf03c940ba2bfd6033188d2b", "kind": "directory_service", "frame_number": 2068, "timestamp_epoch": "1631315877.062420000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 67, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-3fc452b5e948d192921c2cb5", "kind": "directory_service", "frame_number": 2069, "timestamp_epoch": "1631315877.064549000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 67, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-4daae9c15f2a6bf07f30202c", "kind": "directory_service", "frame_number": 2070, "timestamp_epoch": "1631315877.064849000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 67, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-3c1003a93712cce139c17e71", "kind": "directory_service", "frame_number": 2073, "timestamp_epoch": "1631315877.070451000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 67, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-061a842a2c7386847018e093", "kind": "directory_service", "frame_number": 2074, "timestamp_epoch": "1631315877.070829000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 67, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-7b2d849824799069976688a8", "kind": "directory_service", "frame_number": 2075, "timestamp_epoch": "1631315877.073075000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 67, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-56c1c48e333448ab1e9aebd7", "kind": "directory_service", "frame_number": 2076, "timestamp_epoch": "1631315877.073778000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 67, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-603585af45bd7b32ad2197d3", "kind": "directory_service", "frame_number": 2077, "timestamp_epoch": "1631315877.075923000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 67, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-3c5effbc6f7dae6b7838d455", "kind": "directory_service", "frame_number": 2078, "timestamp_epoch": "1631315877.076183000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 67, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-a925701c8c045ea66ca14d8a", "kind": "directory_service", "frame_number": 2114, "timestamp_epoch": "1631315877.084598000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 68, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-03f2863fb437ecb63b05a8fb", "kind": "directory_service", "frame_number": 2116, "timestamp_epoch": "1631315877.085324000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 68, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-1cb3802fdc57e7f4a3ed79f6", "kind": "directory_service", "frame_number": 2119, "timestamp_epoch": "1631315877.088427000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 68, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-e4fa19384016233ef0aa9c19", "kind": "directory_service", "frame_number": 2121, "timestamp_epoch": "1631315877.089901000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 68, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-f30c9031641d8a2062477780", "kind": "directory_service", "frame_number": 2122, "timestamp_epoch": "1631315877.092174000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 68, "udp_stream": null, "fields": { "ldap.baseObject": "CN=DESKTOP-KKITB6Q,CN=Computers,DC=angrypoutine,DC=com", "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-8e25e75a267d1c3c95630bf4", "kind": "directory_service", "frame_number": 2123, "timestamp_epoch": "1631315877.092602000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 68, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-03dc6d95af6563bb1108d7f1", "kind": "directory_service", "frame_number": 2124, "timestamp_epoch": "1631315877.095051000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 68, "udp_stream": null, "fields": { "ldap.baseObject": "CN=DESKTOP-KKITB6Q,CN=Computers,DC=angrypoutine,DC=com", "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-6d135e9b1cd82849489b9684", "kind": "directory_service", "frame_number": 2125, "timestamp_epoch": "1631315877.095417000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 68, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-258b0ebb36588b618c64bfde", "kind": "directory_service", "frame_number": 2126, "timestamp_epoch": "1631315877.096954000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 68, "udp_stream": null, "fields": { "ldap.baseObject": "CN=DESKTOP-KKITB6Q,CN=Computers,DC=angrypoutine,DC=com", "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-73a99ac70573761e957485d3", "kind": "directory_service", "frame_number": 2127, "timestamp_epoch": "1631315877.097372000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 68, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-5108761fb8f8abea4969cf07", "kind": "directory_service", "frame_number": 2133, "timestamp_epoch": "1631315877.114050000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 69, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-85bbeac2af0d695cb57d8a32", "kind": "directory_service", "frame_number": 2135, "timestamp_epoch": "1631315877.114813000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 69, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-19c21ef7e123ffdd1062768c", "kind": "directory_service", "frame_number": 2137, "timestamp_epoch": "1631315877.116412000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 69, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-6bd67a0dc5684f9a9d374e29", "kind": "directory_service", "frame_number": 2140, "timestamp_epoch": "1631315877.117000000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 69, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-0afed3b8a81450faea3c65d6", "kind": "directory_service", "frame_number": 2143, "timestamp_epoch": "1631315877.117625000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 69, "udp_stream": null, "fields": { "ldap.baseObject": "CN=62a0ff2e-97b9-4513-943f-0d221bd30080,CN=Device Registration Configuration,CN=services,CN=Configuration,DC=angrypoutine,DC=com", "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-f02afd8aaa59f7cd3742a309", "kind": "directory_service", "frame_number": 2144, "timestamp_epoch": "1631315877.117965000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 69, "udp_stream": null, "fields": { "ldap.protocolOp": "5" } }, { "event_id": "evt-2bcc85afa4c1471208c0eacc", "kind": "directory_service", "frame_number": 2145, "timestamp_epoch": "1631315877.119480000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 69, "udp_stream": null, "fields": { "ldap.protocolOp": "2" } }, { "event_id": "evt-8b01561a5e344264ea81a78f", "kind": "directory_service", "frame_number": 2149, "timestamp_epoch": "1631315877.119841000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 68, "udp_stream": null, "fields": { "ldap.protocolOp": "2" } }, { "event_id": "evt-c5e55f3f266242c18abd3c50", "kind": "directory_service", "frame_number": 2705, "timestamp_epoch": "1631315966.505945000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "samr.opnum": "64" } }, { "event_id": "evt-9381c8a61c964314b8ac3a54", "kind": "directory_service", "frame_number": 2706, "timestamp_epoch": "1631315966.506606000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "samr.opnum": "64" } }, { "event_id": "evt-3fcc853853cceb8672bc7224", "kind": "directory_service", "frame_number": 2707, "timestamp_epoch": "1631315966.508802000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "samr.opnum": "6" } }, { "event_id": "evt-5d30d92814dda84d52ba4ea3", "kind": "directory_service", "frame_number": 2708, "timestamp_epoch": "1631315966.509355000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "samr.opnum": "6" } }, { "event_id": "evt-14bf7e6ae2cdb03ba3535488", "kind": "directory_service", "frame_number": 2709, "timestamp_epoch": "1631315966.511562000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "samr.opnum": "5" } }, { "event_id": "evt-8a5b26096d6ea5d2ba81be7b", "kind": "directory_service", "frame_number": 2710, "timestamp_epoch": "1631315966.512048000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "samr.opnum": "5" } }, { "event_id": "evt-8b68a2e03d119190fab49226", "kind": "directory_service", "frame_number": 2711, "timestamp_epoch": "1631315966.514181000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "samr.opnum": "7" } }, { "event_id": "evt-37ec9d0511928e6bc4fd92f0", "kind": "directory_service", "frame_number": 2712, "timestamp_epoch": "1631315966.514600000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "samr.opnum": "7" } }, { "event_id": "evt-e9eed14a346be9ce40780df8", "kind": "directory_service", "frame_number": 2713, "timestamp_epoch": "1631315966.516818000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "samr.opnum": "17" } }, { "event_id": "evt-a156648df216333e968df7e1", "kind": "directory_service", "frame_number": 2714, "timestamp_epoch": "1631315966.517327000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "samr.opnum": "17" } }, { "event_id": "evt-9e9c93407665bfdb39d1ca82", "kind": "directory_service", "frame_number": 2717, "timestamp_epoch": "1631315966.895289000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "samr.opnum": "19" } }, { "event_id": "evt-fd2b394254edef0b6c1d6249", "kind": "directory_service", "frame_number": 2718, "timestamp_epoch": "1631315966.896127000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "samr.opnum": "19" } }, { "event_id": "evt-fd19508b6a33ee30fe1edc31", "kind": "directory_service", "frame_number": 2719, "timestamp_epoch": "1631315966.897682000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "samr.opnum": "20" } }, { "event_id": "evt-5a9a4836f6409ff10b667fb0", "kind": "directory_service", "frame_number": 2720, "timestamp_epoch": "1631315966.898450000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "samr.opnum": "20" } }, { "event_id": "evt-47433e637d33db784ce7c915", "kind": "directory_service", "frame_number": 2721, "timestamp_epoch": "1631315966.900014000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "samr.opnum": "1" } }, { "event_id": "evt-46a53cb5a7681eab637df44e", "kind": "directory_service", "frame_number": 2722, "timestamp_epoch": "1631315966.900524000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "samr.opnum": "1" } }, { "event_id": "evt-016ceecf6805603a1151c224", "kind": "directory_service", "frame_number": 2723, "timestamp_epoch": "1631315966.902012000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "samr.opnum": "1" } }, { "event_id": "evt-f5cd56775b854202e89913ee", "kind": "directory_service", "frame_number": 2724, "timestamp_epoch": "1631315966.902430000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "samr.opnum": "1" } }, { "event_id": "evt-e4515f1eed477bab13f8aed3", "kind": "directory_service", "frame_number": 2725, "timestamp_epoch": "1631315966.903988000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "samr.opnum": "1" } }, { "event_id": "evt-96980c1fedc4a406b6e7e292", "kind": "directory_service", "frame_number": 2726, "timestamp_epoch": "1631315966.904500000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "samr.opnum": "1" } }, { "event_id": "evt-be2d05da0157fac2e4909584", "kind": "directory_service", "frame_number": 2737, "timestamp_epoch": "1631315966.916394000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "samr.opnum": "64" } }, { "event_id": "evt-fa44d7868a5f97c24ecb637e", "kind": "directory_service", "frame_number": 2738, "timestamp_epoch": "1631315966.916801000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "samr.opnum": "64" } }, { "event_id": "evt-568cf1f5f24e53768889aa84", "kind": "directory_service", "frame_number": 2739, "timestamp_epoch": "1631315966.918290000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "samr.opnum": "6" } }, { "event_id": "evt-4caa144983771ece5d705ef7", "kind": "directory_service", "frame_number": 2740, "timestamp_epoch": "1631315966.918651000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "samr.opnum": "6" } }, { "event_id": "evt-177f748bc8d19266af85e153", "kind": "directory_service", "frame_number": 2741, "timestamp_epoch": "1631315966.920310000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "samr.opnum": "5" } }, { "event_id": "evt-b7bfc3487ac4d7de792c2d07", "kind": "directory_service", "frame_number": 2742, "timestamp_epoch": "1631315966.920672000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "samr.opnum": "5" } }, { "event_id": "evt-44b8a24a7d66cfa90a532617", "kind": "directory_service", "frame_number": 2743, "timestamp_epoch": "1631315966.922243000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "samr.opnum": "7" } }, { "event_id": "evt-519770fcc98a3cbd16a9417f", "kind": "directory_service", "frame_number": 2744, "timestamp_epoch": "1631315966.922457000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "samr.opnum": "7" } }, { "event_id": "evt-a2d3f8b8cc86eb4380a2f3bb", "kind": "directory_service", "frame_number": 2745, "timestamp_epoch": "1631315966.923956000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "samr.opnum": "17" } }, { "event_id": "evt-34ce49940348c35d436b8e10", "kind": "directory_service", "frame_number": 2746, "timestamp_epoch": "1631315966.924393000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "samr.opnum": "17" } }, { "event_id": "evt-7b9d2b5c4d37bcacfae7a0c7", "kind": "directory_service", "frame_number": 2747, "timestamp_epoch": "1631315966.925841000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "samr.opnum": "19" } }, { "event_id": "evt-3d59c8e34cf929917a6873ac", "kind": "directory_service", "frame_number": 2748, "timestamp_epoch": "1631315966.926357000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "samr.opnum": "19" } }, { "event_id": "evt-30d99135ef945be5f6430cb3", "kind": "directory_service", "frame_number": 2749, "timestamp_epoch": "1631315966.927916000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "samr.opnum": "25" } }, { "event_id": "evt-1f7334fe2374eca787cc0e4a", "kind": "directory_service", "frame_number": 2750, "timestamp_epoch": "1631315966.928378000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "samr.opnum": "25" } }, { "event_id": "evt-9b199949b8a4f1402eca35ca", "kind": "directory_service", "frame_number": 2751, "timestamp_epoch": "1631315966.929933000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "samr.opnum": "18" } }, { "event_id": "evt-aa66b3aeffc4ced9e2ffc56c", "kind": "directory_service", "frame_number": 2752, "timestamp_epoch": "1631315966.930497000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "samr.opnum": "18" } }, { "event_id": "evt-f7e2151e9782beef547303ba", "kind": "directory_service", "frame_number": 2753, "timestamp_epoch": "1631315966.932162000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "samr.opnum": "1" } }, { "event_id": "evt-66a2679eed5ee45474ebb57c", "kind": "directory_service", "frame_number": 2754, "timestamp_epoch": "1631315966.932520000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "samr.opnum": "1" } }, { "event_id": "evt-0d814520c87de1beb1f7fbdb", "kind": "directory_service", "frame_number": 2755, "timestamp_epoch": "1631315966.934106000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "samr.opnum": "1" } }, { "event_id": "evt-a3d884b331346ca6b8b64ff5", "kind": "directory_service", "frame_number": 2756, "timestamp_epoch": "1631315966.934472000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "samr.opnum": "1" } }, { "event_id": "evt-9ab1c244a58d8406baab06cf", "kind": "directory_service", "frame_number": 2757, "timestamp_epoch": "1631315966.936076000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "samr.opnum": "1" } }, { "event_id": "evt-24d193f8bb421945d6d591ba", "kind": "directory_service", "frame_number": 2758, "timestamp_epoch": "1631315966.936436000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "samr.opnum": "1" } }, { "event_id": "evt-de6a5d2667aff287ac55cd01", "kind": "directory_service", "frame_number": 2770, "timestamp_epoch": "1631315967.107975000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "samr.opnum": "64" } }, { "event_id": "evt-2d9ce8c274d37b1a57ce7f47", "kind": "directory_service", "frame_number": 2771, "timestamp_epoch": "1631315967.108357000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "samr.opnum": "64" } }, { "event_id": "evt-ad4143f8ddbaa069895fa583", "kind": "directory_service", "frame_number": 2772, "timestamp_epoch": "1631315967.109802000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "samr.opnum": "6" } }, { "event_id": "evt-453e64f54baab5a6a50c70e2", "kind": "directory_service", "frame_number": 2773, "timestamp_epoch": "1631315967.110185000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "samr.opnum": "6" } }, { "event_id": "evt-6d7da6d674483da46988f744", "kind": "directory_service", "frame_number": 2774, "timestamp_epoch": "1631315967.111638000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "samr.opnum": "5" } }, { "event_id": "evt-2900c90b7f8314a2240d2d4b", "kind": "directory_service", "frame_number": 2775, "timestamp_epoch": "1631315967.112004000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "samr.opnum": "5" } }, { "event_id": "evt-174609fa20b290bd7c7b181a", "kind": "directory_service", "frame_number": 2776, "timestamp_epoch": "1631315967.113444000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "samr.opnum": "7" } }, { "event_id": "evt-de72f5c6ea4656a8028c141c", "kind": "directory_service", "frame_number": 2777, "timestamp_epoch": "1631315967.113908000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "samr.opnum": "7" } }, { "event_id": "evt-a3d66d366814c6fd59e9b561", "kind": "directory_service", "frame_number": 2778, "timestamp_epoch": "1631315967.115360000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "samr.opnum": "17" } }, { "event_id": "evt-a26557df0b31c54ec6ba491e", "kind": "directory_service", "frame_number": 2779, "timestamp_epoch": "1631315967.115884000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "samr.opnum": "17" } }, { "event_id": "evt-56b2ad3a05bce378cabadeae", "kind": "directory_service", "frame_number": 2780, "timestamp_epoch": "1631315967.117411000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "samr.opnum": "19" } }, { "event_id": "evt-d7d5f2ce6e57b938c7fc5cc4", "kind": "directory_service", "frame_number": 2781, "timestamp_epoch": "1631315967.117894000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "samr.opnum": "19" } }, { "event_id": "evt-0a4822885b9b877f99b44c9f", "kind": "directory_service", "frame_number": 2782, "timestamp_epoch": "1631315967.119332000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "samr.opnum": "20" } }, { "event_id": "evt-e0c0657ba2f21f97f5bd2b77", "kind": "directory_service", "frame_number": 2783, "timestamp_epoch": "1631315967.119790000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "samr.opnum": "20" } }, { "event_id": "evt-1c2d757db57a8a7d79ce0f24", "kind": "directory_service", "frame_number": 2784, "timestamp_epoch": "1631315967.121257000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "samr.opnum": "1" } }, { "event_id": "evt-f31acdf8ab932f765b70799b", "kind": "directory_service", "frame_number": 2785, "timestamp_epoch": "1631315967.121621000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "samr.opnum": "1" } }, { "event_id": "evt-bc739d6e5ff88e51d147e05c", "kind": "directory_service", "frame_number": 2786, "timestamp_epoch": "1631315967.123094000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "samr.opnum": "1" } }, { "event_id": "evt-c2b30017984962285f991164", "kind": "directory_service", "frame_number": 2787, "timestamp_epoch": "1631315967.123453000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "samr.opnum": "1" } }, { "event_id": "evt-771c40d35b6e8dce82d4b6d1", "kind": "directory_service", "frame_number": 2788, "timestamp_epoch": "1631315967.124946000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "samr.opnum": "1" } }, { "event_id": "evt-868246f6f28b801a6eb49cd7", "kind": "directory_service", "frame_number": 2789, "timestamp_epoch": "1631315967.125283000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "samr.opnum": "1" } }, { "event_id": "evt-622630a8b5cc7d6b0576bc5a", "kind": "directory_service", "frame_number": 2800, "timestamp_epoch": "1631315967.137311000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "samr.opnum": "64" } }, { "event_id": "evt-bdd50bc6ef2043d46de089d3", "kind": "directory_service", "frame_number": 2801, "timestamp_epoch": "1631315967.137715000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "samr.opnum": "64" } }, { "event_id": "evt-ff991ae8d834775b648d4980", "kind": "directory_service", "frame_number": 2802, "timestamp_epoch": "1631315967.139190000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "samr.opnum": "6" } }, { "event_id": "evt-9ba78295bc60a61bc31ac07a", "kind": "directory_service", "frame_number": 2803, "timestamp_epoch": "1631315967.139701000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "samr.opnum": "6" } }, { "event_id": "evt-8d31764fb05a0c27efc5cfbe", "kind": "directory_service", "frame_number": 2804, "timestamp_epoch": "1631315967.141123000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "samr.opnum": "5" } }, { "event_id": "evt-145ec41f4c89d1160e632ff1", "kind": "directory_service", "frame_number": 2805, "timestamp_epoch": "1631315967.141536000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "samr.opnum": "5" } }, { "event_id": "evt-227e6f24c548e984da78b12f", "kind": "directory_service", "frame_number": 2806, "timestamp_epoch": "1631315967.142993000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "samr.opnum": "7" } }, { "event_id": "evt-cf375bb572eed55c254b073d", "kind": "directory_service", "frame_number": 2807, "timestamp_epoch": "1631315967.143458000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "samr.opnum": "7" } }, { "event_id": "evt-0bc103144aa13fa33cf76666", "kind": "directory_service", "frame_number": 2808, "timestamp_epoch": "1631315967.144878000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "samr.opnum": "17" } }, { "event_id": "evt-1602ddc70eec9bd5252d8568", "kind": "directory_service", "frame_number": 2809, "timestamp_epoch": "1631315967.145402000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "samr.opnum": "17" } }, { "event_id": "evt-09b69019f51e755f17b8d21d", "kind": "directory_service", "frame_number": 2810, "timestamp_epoch": "1631315967.146886000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "samr.opnum": "19" } }, { "event_id": "evt-a920399ca460ec4a80a50403", "kind": "directory_service", "frame_number": 2811, "timestamp_epoch": "1631315967.147382000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "samr.opnum": "19" } }, { "event_id": "evt-d0ebf503201401f79aeb9d06", "kind": "directory_service", "frame_number": 2812, "timestamp_epoch": "1631315967.148810000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "samr.opnum": "25" } }, { "event_id": "evt-473e9fa17785ee47081e38fc", "kind": "directory_service", "frame_number": 2813, "timestamp_epoch": "1631315967.149337000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "samr.opnum": "25" } }, { "event_id": "evt-67e2c3db2a9f2da4456a180f", "kind": "directory_service", "frame_number": 2814, "timestamp_epoch": "1631315967.150926000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "samr.opnum": "18" } }, { "event_id": "evt-40a53c73880ab008ce625144", "kind": "directory_service", "frame_number": 2815, "timestamp_epoch": "1631315967.151339000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "samr.opnum": "18" } }, { "event_id": "evt-6579f7d1b6a546b335064904", "kind": "directory_service", "frame_number": 2816, "timestamp_epoch": "1631315967.152894000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "samr.opnum": "1" } }, { "event_id": "evt-bd16aaedc270427a9c5e8d48", "kind": "directory_service", "frame_number": 2817, "timestamp_epoch": "1631315967.153273000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "samr.opnum": "1" } }, { "event_id": "evt-9b8cd5a52475b816458d8cfe", "kind": "directory_service", "frame_number": 2818, "timestamp_epoch": "1631315967.154700000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "samr.opnum": "1" } }, { "event_id": "evt-ddeef37806c2c60e1567383c", "kind": "directory_service", "frame_number": 2819, "timestamp_epoch": "1631315967.155105000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "samr.opnum": "1" } }, { "event_id": "evt-77920b0f7420f4b09955082b", "kind": "directory_service", "frame_number": 2820, "timestamp_epoch": "1631315967.156536000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "samr.opnum": "1" } }, { "event_id": "evt-ebfb1f8410e168a6e37b0100", "kind": "directory_service", "frame_number": 2821, "timestamp_epoch": "1631315967.156946000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 80, "udp_stream": null, "fields": { "samr.opnum": "1" } }, { "event_id": "evt-5068759a1dbbf3c9208ea7f9", "kind": "directory_service", "frame_number": 2962, "timestamp_epoch": "1631316142.057390000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 86, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-e987ffcf3994ad814e769e82", "kind": "directory_service", "frame_number": 2963, "timestamp_epoch": "1631316142.057859000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 86, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-7c80fe1d6579cb9f69fbe5b0", "kind": "directory_service", "frame_number": 2966, "timestamp_epoch": "1631316142.301058000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 86, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-a73732e30ccb7abedcf240f8", "kind": "directory_service", "frame_number": 2967, "timestamp_epoch": "1631316142.301796000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 86, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-4b12e71effa62c59bb927ea8", "kind": "directory_service", "frame_number": 2968, "timestamp_epoch": "1631316142.303973000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 86, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-1a814d083065660aa4a6eb01", "kind": "directory_service", "frame_number": 2969, "timestamp_epoch": "1631316142.304324000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 86, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-a621bbfa0001db16b6774198", "kind": "directory_service", "frame_number": 2972, "timestamp_epoch": "1631316142.310485000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 86, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-1b50b5a9a73e4a48b08a31c2", "kind": "directory_service", "frame_number": 2973, "timestamp_epoch": "1631316142.310861000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 86, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-9a8cd742368452ffac6f2583", "kind": "directory_service", "frame_number": 2974, "timestamp_epoch": "1631316142.313000000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 86, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-0f90bbf2b810bcfb61734527", "kind": "directory_service", "frame_number": 2975, "timestamp_epoch": "1631316142.313717000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 86, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-f84c962474fb2e41f2cbbe10", "kind": "directory_service", "frame_number": 2976, "timestamp_epoch": "1631316142.315848000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 86, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-1e4aac7c8a21d791f2deb501", "kind": "directory_service", "frame_number": 2977, "timestamp_epoch": "1631316142.316213000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 86, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-ec2cc9aa4c2de6c213596bed", "kind": "directory_service", "frame_number": 2982, "timestamp_epoch": "1631316142.356887000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 87, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-b639f665fc683375a17c90b4", "kind": "directory_service", "frame_number": 2984, "timestamp_epoch": "1631316142.357695000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 87, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-5bb9d9c06dc99439381d761d", "kind": "directory_service", "frame_number": 2987, "timestamp_epoch": "1631316142.361415000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 87, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-9d151c0cfb43e9a1b1e080da", "kind": "directory_service", "frame_number": 2989, "timestamp_epoch": "1631316142.363093000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 87, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-82c81024aaa58337a224ff25", "kind": "directory_service", "frame_number": 2990, "timestamp_epoch": "1631316142.365679000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 87, "udp_stream": null, "fields": { "ldap.baseObject": "CN=DESKTOP-KKITB6Q,CN=Computers,DC=angrypoutine,DC=com", "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-d6475a5cbefef3b2187e0c4a", "kind": "directory_service", "frame_number": 2991, "timestamp_epoch": "1631316142.366144000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 87, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-de8086b8ae771f4f2d84c21d", "kind": "directory_service", "frame_number": 2992, "timestamp_epoch": "1631316142.368425000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 87, "udp_stream": null, "fields": { "ldap.baseObject": "CN=DESKTOP-KKITB6Q,CN=Computers,DC=angrypoutine,DC=com", "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-15de0224d05808eaeca056d4", "kind": "directory_service", "frame_number": 2993, "timestamp_epoch": "1631316142.368873000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 87, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-bcb098127d990f10f1af9bab", "kind": "directory_service", "frame_number": 2995, "timestamp_epoch": "1631316142.370645000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 87, "udp_stream": null, "fields": { "ldap.baseObject": "CN=DESKTOP-KKITB6Q,CN=Computers,DC=angrypoutine,DC=com", "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-1e259b9287754d2a40563b35", "kind": "directory_service", "frame_number": 2996, "timestamp_epoch": "1631316142.370955000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 87, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-ffd33ab9a75f5414c390db49", "kind": "directory_service", "frame_number": 3001, "timestamp_epoch": "1631316142.407882000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 88, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-245c81809ca066be0c73df2e", "kind": "directory_service", "frame_number": 3003, "timestamp_epoch": "1631316142.409360000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 88, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-e9c3dbadf0a4da526e9ec57c", "kind": "directory_service", "frame_number": 3004, "timestamp_epoch": "1631316142.411917000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 88, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-f2e9e52f8139a7220a2dc806", "kind": "directory_service", "frame_number": 3007, "timestamp_epoch": "1631316142.412719000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 88, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-5a703954713de988b3f95df5", "kind": "directory_service", "frame_number": 3009, "timestamp_epoch": "1631316142.414145000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 88, "udp_stream": null, "fields": { "ldap.baseObject": "CN=62a0ff2e-97b9-4513-943f-0d221bd30080,CN=Device Registration Configuration,CN=services,CN=Configuration,DC=angrypoutine,DC=com", "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-8aae03ec947027f7817781b0", "kind": "directory_service", "frame_number": 3010, "timestamp_epoch": "1631316142.414320000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 88, "udp_stream": null, "fields": { "ldap.protocolOp": "5" } }, { "event_id": "evt-2176261857c1830ace71b87e", "kind": "directory_service", "frame_number": 3011, "timestamp_epoch": "1631316142.416576000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 88, "udp_stream": null, "fields": { "ldap.protocolOp": "2" } }, { "event_id": "evt-8856315d445b59122c30e8db", "kind": "directory_service", "frame_number": 3014, "timestamp_epoch": "1631316142.416733000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 87, "udp_stream": null, "fields": { "ldap.protocolOp": "2" } }, { "event_id": "evt-9a7992930a867f5cc0290de8", "kind": "directory_service", "frame_number": 8702, "timestamp_epoch": "1631319741.451904000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 146, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-014a5506e06b8064155b8806", "kind": "directory_service", "frame_number": 8703, "timestamp_epoch": "1631319741.452370000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 146, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-51a5afd50a4927dc5c017944", "kind": "directory_service", "frame_number": 8706, "timestamp_epoch": "1631319741.698651000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 146, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-b80563828afc662da5ad8307", "kind": "directory_service", "frame_number": 8707, "timestamp_epoch": "1631319741.699401000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 146, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-2552391c02702dbc819eb5aa", "kind": "directory_service", "frame_number": 8708, "timestamp_epoch": "1631319741.701621000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 146, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-47243d9a9cb745c5ac4731cd", "kind": "directory_service", "frame_number": 8709, "timestamp_epoch": "1631319741.701932000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 146, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-3a1db70518c35bf9975cee62", "kind": "directory_service", "frame_number": 8712, "timestamp_epoch": "1631319741.708133000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 146, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-1215a8bb4da06b41e635631b", "kind": "directory_service", "frame_number": 8713, "timestamp_epoch": "1631319741.708518000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 146, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-077bdc5d45513738121c5b4f", "kind": "directory_service", "frame_number": 8714, "timestamp_epoch": "1631319741.710774000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 146, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-30b90b73c5859897351f3de5", "kind": "directory_service", "frame_number": 8715, "timestamp_epoch": "1631319741.711246000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 146, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-53542644078406a3973fb175", "kind": "directory_service", "frame_number": 8717, "timestamp_epoch": "1631319741.761245000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 146, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-ab4b119815ecdbd5c66e8348", "kind": "directory_service", "frame_number": 8718, "timestamp_epoch": "1631319741.761575000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 146, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-181d2d388014b20bdcef32a5", "kind": "directory_service", "frame_number": 8725, "timestamp_epoch": "1631319742.090149000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 147, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-8640b64ee2600521b99fbd41", "kind": "directory_service", "frame_number": 8727, "timestamp_epoch": "1631319742.090941000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 147, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-8174ba891d389474dbf25e4c", "kind": "directory_service", "frame_number": 8730, "timestamp_epoch": "1631319742.094653000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 147, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-169c0400acce382ad3d99a0e", "kind": "directory_service", "frame_number": 8732, "timestamp_epoch": "1631319742.096110000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 147, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-d2a1a1c46bd3a9f2a55a1f93", "kind": "directory_service", "frame_number": 8733, "timestamp_epoch": "1631319742.098736000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 147, "udp_stream": null, "fields": { "ldap.baseObject": "CN=DESKTOP-KKITB6Q,CN=Computers,DC=angrypoutine,DC=com", "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-9e9a5f345300ad78035f1ef7", "kind": "directory_service", "frame_number": 8734, "timestamp_epoch": "1631319742.099162000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 147, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-b675838984f180b6432c2156", "kind": "directory_service", "frame_number": 8735, "timestamp_epoch": "1631319742.101487000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 147, "udp_stream": null, "fields": { "ldap.baseObject": "CN=DESKTOP-KKITB6Q,CN=Computers,DC=angrypoutine,DC=com", "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-21a2ea40040bc41a88a0185c", "kind": "directory_service", "frame_number": 8736, "timestamp_epoch": "1631319742.101962000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 147, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-849025a3242e3441d214b11f", "kind": "directory_service", "frame_number": 8737, "timestamp_epoch": "1631319742.104235000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 147, "udp_stream": null, "fields": { "ldap.baseObject": "CN=DESKTOP-KKITB6Q,CN=Computers,DC=angrypoutine,DC=com", "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-afb4459699931d15249f7512", "kind": "directory_service", "frame_number": 8738, "timestamp_epoch": "1631319742.104757000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 147, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-9c0ff1776843814bc27b9eac", "kind": "directory_service", "frame_number": 8744, "timestamp_epoch": "1631319742.157383000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 148, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-d52a525461340c731a4f37d4", "kind": "directory_service", "frame_number": 8746, "timestamp_epoch": "1631319742.158067000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 148, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-f82f6ef3e00734ecee50786e", "kind": "directory_service", "frame_number": 8747, "timestamp_epoch": "1631319742.160222000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 148, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-185a476fe250ea8fb7f056c8", "kind": "directory_service", "frame_number": 8750, "timestamp_epoch": "1631319742.160990000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 148, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-db28c6fe2790785e345adcfb", "kind": "directory_service", "frame_number": 8752, "timestamp_epoch": "1631319742.162360000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 148, "udp_stream": null, "fields": { "ldap.baseObject": "CN=62a0ff2e-97b9-4513-943f-0d221bd30080,CN=Device Registration Configuration,CN=services,CN=Configuration,DC=angrypoutine,DC=com", "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-665996058a5e73d83f28b424", "kind": "directory_service", "frame_number": 8753, "timestamp_epoch": "1631319742.162606000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 148, "udp_stream": null, "fields": { "ldap.protocolOp": "5" } }, { "event_id": "evt-ee293a82de6fd527b362d59f", "kind": "directory_service", "frame_number": 8754, "timestamp_epoch": "1631319742.164839000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 148, "udp_stream": null, "fields": { "ldap.protocolOp": "2" } }, { "event_id": "evt-58b811f68fc79965b9ffef59", "kind": "directory_service", "frame_number": 8756, "timestamp_epoch": "1631319742.164919000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 147, "udp_stream": null, "fields": { "ldap.protocolOp": "2" } }, { "event_id": "evt-72edc43438c61da99f996339", "kind": "directory_service", "frame_number": 8902, "timestamp_epoch": "1631320086.166099000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 154, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-f53ab2c4ed0e4603aa464029", "kind": "directory_service", "frame_number": 8903, "timestamp_epoch": "1631320086.166565000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 154, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-ccb96a091f6fc0676609f1e0", "kind": "directory_service", "frame_number": 8904, "timestamp_epoch": "1631320086.168219000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 154, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-e54d6da1382357b8e1c13262", "kind": "directory_service", "frame_number": 8905, "timestamp_epoch": "1631320086.168976000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 154, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-1427f65a342f9c926e8b9ce9", "kind": "directory_service", "frame_number": 8906, "timestamp_epoch": "1631320086.170454000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 154, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-caabfb4a775949625cd60b06", "kind": "directory_service", "frame_number": 8907, "timestamp_epoch": "1631320086.170812000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 154, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-96edec084a18667b0c11be1b", "kind": "directory_service", "frame_number": 8912, "timestamp_epoch": "1631320086.882518000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 155, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-66fef7545c03d5e93d83428c", "kind": "directory_service", "frame_number": 8914, "timestamp_epoch": "1631320086.883277000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 155, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-860093ef602c5d65980b20f0", "kind": "directory_service", "frame_number": 8917, "timestamp_epoch": "1631320086.887609000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 155, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-685bcff13e79d50d4e68b2f5", "kind": "directory_service", "frame_number": 8919, "timestamp_epoch": "1631320086.889082000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 155, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-4385ae6b4e7d995bdf6da321", "kind": "directory_service", "frame_number": 8923, "timestamp_epoch": "1631320087.008355000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 155, "udp_stream": null, "fields": { "ldap.baseObject": "DC=angrypoutine,DC=com", "ldap.filter": "1", "ldap.protocolOp": "3" } }, { "event_id": "evt-3a658c5b7c9ca8526965373d", "kind": "directory_service", "frame_number": 8924, "timestamp_epoch": "1631320087.008995000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 155, "udp_stream": null, "fields": { "ldap.protocolOp": "4,19,19,19,5" } }, { "event_id": "evt-4d06d0b57e1aaae438ce41b0", "kind": "directory_service", "frame_number": 8930, "timestamp_epoch": "1631320087.069008000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 156, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-2d3b27d0007381cb05bb1a9d", "kind": "directory_service", "frame_number": 8932, "timestamp_epoch": "1631320087.070473000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 156, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-c0b3cb5bd011eee81bbbf777", "kind": "directory_service", "frame_number": 8933, "timestamp_epoch": "1631320087.073105000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 156, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-85ccb5503a7b3dc71116398e", "kind": "directory_service", "frame_number": 8934, "timestamp_epoch": "1631320087.073375000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 156, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-0ee7559f1d684b4bf8be8b1c", "kind": "directory_service", "frame_number": 8935, "timestamp_epoch": "1631320087.075730000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 156, "udp_stream": null, "fields": { "ldap.baseObject": "CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=angrypoutine,DC=com", "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-368876a03c880069834de8b3", "kind": "directory_service", "frame_number": 8936, "timestamp_epoch": "1631320087.076111000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 156, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-6a64a26cefbbcb654d614b65", "kind": "directory_service", "frame_number": 8937, "timestamp_epoch": "1631320087.079435000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 155, "udp_stream": null, "fields": { "ldap.baseObject": "cn=policies,cn=system,DC=angrypoutine,DC=com", "ldap.filter": "0", "ldap.protocolOp": "3" } }, { "event_id": "evt-f7b7a168b2911b9f995ebc35", "kind": "directory_service", "frame_number": 8938, "timestamp_epoch": "1631320087.080419000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": null, "dst_port": null, "tcp_stream": 155, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-37ef28f2df8c49f72f32fd08", "kind": "directory_service", "frame_number": 9078, "timestamp_epoch": "1631320088.311246000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 156, "udp_stream": null, "fields": { "ldap.protocolOp": "2" } }, { "event_id": "evt-9feb4dff487c26db5701a21c", "kind": "directory_service", "frame_number": 9082, "timestamp_epoch": "1631320088.319916000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": null, "dst_port": null, "tcp_stream": 155, "udp_stream": null, "fields": { "ldap.protocolOp": "2" } } ], "unclassified_tcp": [ { "event_id": "evt-d962b86342fb32e081d657ba", "kind": "unclassified_tcp", "frame_number": 1927, "timestamp_epoch": "1631315868.427662000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 58100, "dst_port": 445, "tcp_stream": 19, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-23087c957808b61c051184f5", "kind": "unclassified_tcp", "frame_number": 2512, "timestamp_epoch": "1631315898.611862000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 58100, "dst_port": 445, "tcp_stream": 19, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-0ead7103ec11ce2ab11c7670", "kind": "unclassified_tcp", "frame_number": 2895, "timestamp_epoch": "1631315973.428054000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 58100, "dst_port": 445, "tcp_stream": 19, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-c2d7dac23dffb8f39d2c9355", "kind": "unclassified_tcp", "frame_number": 2914, "timestamp_epoch": "1631316003.487251000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 58100, "dst_port": 445, "tcp_stream": 19, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-4dc8af84915466021a1f1597", "kind": "unclassified_tcp", "frame_number": 2925, "timestamp_epoch": "1631316063.461977000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 445, "dst_port": 58100, "tcp_stream": 19, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-15f8c770c5c0c878efc4afed", "kind": "unclassified_tcp", "frame_number": 3021, "timestamp_epoch": "1631316183.851719000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 445, "dst_port": 58100, "tcp_stream": 19, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-4a09cabb55a7036b18c096cb", "kind": "unclassified_tcp", "frame_number": 7423, "timestamp_epoch": "1631316303.938071000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 445, "dst_port": 58100, "tcp_stream": 19, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-dbfd7a068be58b84f67fed3a", "kind": "unclassified_tcp", "frame_number": 7625, "timestamp_epoch": "1631316423.952896000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 445, "dst_port": 58100, "tcp_stream": 19, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-8986586217f047d57588e48b", "kind": "unclassified_tcp", "frame_number": 7631, "timestamp_epoch": "1631316456.924425000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 58100, "dst_port": 445, "tcp_stream": 19, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-8701addec2039b5b929b245b", "kind": "unclassified_tcp", "frame_number": 7635, "timestamp_epoch": "1631316486.985239000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 58100, "dst_port": 445, "tcp_stream": 19, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-ae939c56c80c3a797d04d2a0", "kind": "unclassified_tcp", "frame_number": 7639, "timestamp_epoch": "1631316546.971678000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 445, "dst_port": 58100, "tcp_stream": 19, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-106ffb7a711d95d16e0bdcc0", "kind": "unclassified_tcp", "frame_number": 7669, "timestamp_epoch": "1631316667.046956000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 445, "dst_port": 58100, "tcp_stream": 19, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-61a2d8adaf1f480d1e8b1f43", "kind": "unclassified_tcp", "frame_number": 7729, "timestamp_epoch": "1631316787.256878000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 445, "dst_port": 58100, "tcp_stream": 19, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-7dd2717493cea09f5a5a35e5", "kind": "unclassified_tcp", "frame_number": 7733, "timestamp_epoch": "1631316907.940169000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 445, "dst_port": 58100, "tcp_stream": 19, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-0792c1ff06a49e2e7f3fce51", "kind": "unclassified_tcp", "frame_number": 7814, "timestamp_epoch": "1631317057.272165000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 58100, "dst_port": 445, "tcp_stream": 19, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-8128eb1c461cc0caf2e1f769", "kind": "unclassified_tcp", "frame_number": 7823, "timestamp_epoch": "1631317087.475969000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 58100, "dst_port": 445, "tcp_stream": 19, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-5c43a5b5b8e595ace250eeb0", "kind": "unclassified_tcp", "frame_number": 7829, "timestamp_epoch": "1631317147.304487000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 445, "dst_port": 58100, "tcp_stream": 19, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-0adac98cf117be220852adf9", "kind": "unclassified_tcp", "frame_number": 7834, "timestamp_epoch": "1631317267.576839000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 445, "dst_port": 58100, "tcp_stream": 19, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-4d9b3e99d6de0573f9528fd4", "kind": "unclassified_tcp", "frame_number": 7879, "timestamp_epoch": "1631317387.648328000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 445, "dst_port": 58100, "tcp_stream": 19, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-40939c058f904fdfe067916f", "kind": "unclassified_tcp", "frame_number": 7890, "timestamp_epoch": "1631317508.098564000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 445, "dst_port": 58100, "tcp_stream": 19, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-7085a0661669606647e9fef4", "kind": "unclassified_tcp", "frame_number": 7930, "timestamp_epoch": "1631317657.606411000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 58100, "dst_port": 445, "tcp_stream": 19, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-8783bed7b723a4d1cebfc2e9", "kind": "unclassified_tcp", "frame_number": 7934, "timestamp_epoch": "1631317687.932078000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 58100, "dst_port": 445, "tcp_stream": 19, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-2c2a147e6ccbc87b83bef05a", "kind": "unclassified_tcp", "frame_number": 7938, "timestamp_epoch": "1631317747.656070000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 445, "dst_port": 58100, "tcp_stream": 19, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-e962d38ee4cddd8c77bc3939", "kind": "unclassified_tcp", "frame_number": 7987, "timestamp_epoch": "1631317868.036365000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 445, "dst_port": 58100, "tcp_stream": 19, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-ce43b004f16f8ca63f699644", "kind": "unclassified_tcp", "frame_number": 8066, "timestamp_epoch": "1631317988.128662000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 445, "dst_port": 58100, "tcp_stream": 19, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-e19b9d3bbfbd61f4908e4fc3", "kind": "unclassified_tcp", "frame_number": 8073, "timestamp_epoch": "1631318108.209400000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 445, "dst_port": 58100, "tcp_stream": 19, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-e3c6fae98ec42e239e726f70", "kind": "unclassified_tcp", "frame_number": 8134, "timestamp_epoch": "1631318257.968872000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 58100, "dst_port": 445, "tcp_stream": 19, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-b07c334581126eb4a93cd1b5", "kind": "unclassified_tcp", "frame_number": 8143, "timestamp_epoch": "1631318288.639033000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 58100, "dst_port": 445, "tcp_stream": 19, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-a9851aae170e15904496ceb6", "kind": "unclassified_tcp", "frame_number": 8147, "timestamp_epoch": "1631318348.011596000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 445, "dst_port": 58100, "tcp_stream": 19, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-be9df9f8f1e9258d3f41f128", "kind": "unclassified_tcp", "frame_number": 8176, "timestamp_epoch": "1631318468.480335000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 445, "dst_port": 58100, "tcp_stream": 19, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-70f7ddaa7f5c6a18b08222aa", "kind": "unclassified_tcp", "frame_number": 8229, "timestamp_epoch": "1631318589.126636000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 445, "dst_port": 58100, "tcp_stream": 19, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-32f781deb22256f9c63013d2", "kind": "unclassified_tcp", "frame_number": 8264, "timestamp_epoch": "1631318709.129600000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 445, "dst_port": 58100, "tcp_stream": 19, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-2b5774dd5a60c9736e3bfc84", "kind": "unclassified_tcp", "frame_number": 8330, "timestamp_epoch": "1631318858.328977000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 58100, "dst_port": 445, "tcp_stream": 19, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-d7523402d8ed641c8189215b", "kind": "unclassified_tcp", "frame_number": 8332, "timestamp_epoch": "1631318888.699270000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 58100, "dst_port": 445, "tcp_stream": 19, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-86426523c807862fcfe0a1ff", "kind": "unclassified_tcp", "frame_number": 8366, "timestamp_epoch": "1631318948.372075000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 445, "dst_port": 58100, "tcp_stream": 19, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-8603e9a9b7c6a75d536b50d9", "kind": "unclassified_tcp", "frame_number": 8467, "timestamp_epoch": "1631319068.964019000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 445, "dst_port": 58100, "tcp_stream": 19, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-23cea73a07a8828fe17cb187", "kind": "unclassified_tcp", "frame_number": 8474, "timestamp_epoch": "1631319189.037371000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 445, "dst_port": 58100, "tcp_stream": 19, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-cac32ae531104b56f3c52732", "kind": "unclassified_tcp", "frame_number": 8528, "timestamp_epoch": "1631319309.124802000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 445, "dst_port": 58100, "tcp_stream": 19, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-037488a2ebef3a0456fdd69a", "kind": "unclassified_tcp", "frame_number": 8571, "timestamp_epoch": "1631319458.689529000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 58100, "dst_port": 445, "tcp_stream": 19, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-fa943c190a5a86ac0b72a107", "kind": "unclassified_tcp", "frame_number": 8573, "timestamp_epoch": "1631319489.360810000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 58100, "dst_port": 445, "tcp_stream": 19, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-91d4b6bbb22f124c5f39af2f", "kind": "unclassified_tcp", "frame_number": 8577, "timestamp_epoch": "1631319548.737874000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 445, "dst_port": 58100, "tcp_stream": 19, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-15a5b532034df218052056ae", "kind": "unclassified_tcp", "frame_number": 8650, "timestamp_epoch": "1631319669.405386000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 445, "dst_port": 58100, "tcp_stream": 19, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-c1d53f570b0813c9ec3e2ff8", "kind": "unclassified_tcp", "frame_number": 8764, "timestamp_epoch": "1631319790.028220000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 445, "dst_port": 58100, "tcp_stream": 19, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-c0414b9a7b9d770b541dd261", "kind": "unclassified_tcp", "frame_number": 8812, "timestamp_epoch": "1631319910.285127000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 445, "dst_port": 58100, "tcp_stream": 19, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-c98e4d6390c15ea9c112f119", "kind": "unclassified_tcp", "frame_number": 8880, "timestamp_epoch": "1631320059.048956000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 58100, "dst_port": 445, "tcp_stream": 19, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-244be6b0d6a315016c3c6cce", "kind": "unclassified_tcp", "frame_number": 9087, "timestamp_epoch": "1631320089.381374000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 58100, "dst_port": 445, "tcp_stream": 19, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-29150b57d6707300d499bceb", "kind": "unclassified_tcp", "frame_number": 9100, "timestamp_epoch": "1631320118.301087000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 58238, "dst_port": 445, "tcp_stream": 157, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-0d021a83120fbb6cb18b4a21", "kind": "unclassified_tcp", "frame_number": 9106, "timestamp_epoch": "1631320148.407763000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 58238, "dst_port": 445, "tcp_stream": 157, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-a4eb245872418595ee4b77d6", "kind": "unclassified_tcp", "frame_number": 9108, "timestamp_epoch": "1631320149.085373000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 445, "dst_port": 58100, "tcp_stream": 19, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-7364ceeae0d9700ae001788d", "kind": "unclassified_tcp", "frame_number": 9110, "timestamp_epoch": "1631320179.014423000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 58238, "dst_port": 445, "tcp_stream": 157, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-dec9cf09691c5a1ed3b834ae", "kind": "unclassified_tcp", "frame_number": 9112, "timestamp_epoch": "1631320208.358910000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 445, "dst_port": 58238, "tcp_stream": 157, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-1a5e1b16da632d099e67d699", "kind": "unclassified_tcp", "frame_number": 9114, "timestamp_epoch": "1631320209.351092000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 58238, "dst_port": 445, "tcp_stream": 157, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-4f86dfefcf40eeee7e928a1a", "kind": "unclassified_tcp", "frame_number": 9159, "timestamp_epoch": "1631320239.727134000", "src_ip": "10.9.10.102", "dst_ip": "10.9.10.9", "src_port": 58238, "dst_port": 445, "tcp_stream": 157, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-fa70b0cb6b325ba24eb0ea36", "kind": "unclassified_tcp", "frame_number": 9184, "timestamp_epoch": "1631320269.716023000", "src_ip": "10.9.10.9", "dst_ip": "10.9.10.102", "src_port": 445, "dst_port": 58100, "tcp_stream": 19, "udp_stream": null, "fields": { "tcp.payload": "00" } } ] }, "artifacts": [ { "artifact_id": "artifact-4ab43a37d5b5d37b561a401c", "type": "http-exported-object", "filename": "am_delta_patch_1.349.439.0_dcf977cccce1b58289d270f71f8151b3acc1566b(3).exe", "filenames": [ "am_delta_patch_1.349.439.0_dcf977cccce1b58289d270f71f8151b3acc1566b(3).exe" ], "occurrences": 1, "static_features": { "content_kind": "pe", "inspected_bytes": 262144, "inspection_truncated": true, "features": [], "interpretation": "Static content only; not proof of execution, intent, or malware family" }, "size_bytes": 1048576, "sha256": "1d48d9166408d8b8bf39f9557e4f8a57133c353567c55966ec2831a7bc230431", "media_type": "application/octet-stream", "extraction_method": "tshark-http-export-objects", "content_retained_by_analyzer": false }, { "artifact_id": "artifact-e972ba353cda6421180154da", "type": "http-exported-object", "filename": "am_delta_patch_1.349.439.0_dcf977cccce1b58289d270f71f8151b3acc1566b(2).exe", "filenames": [ "am_delta_patch_1.349.439.0_dcf977cccce1b58289d270f71f8151b3acc1566b(2).exe" ], "occurrences": 1, "static_features": { "content_kind": "script-like-text", "inspected_bytes": 262144, "inspection_truncated": true, "features": [ { "feature": "dynamic-evaluation", "excerpt": "iEx", "offset": 207057 } ], "interpretation": "Static content only; not proof of execution, intent, or malware family" }, "size_bytes": 1048576, "sha256": "2ac413d79efa22e42a179f0450d7e8e4bb8202c881bf9e02a5a13a9a3626d792", "media_type": "application/octet-stream", "extraction_method": "tshark-http-export-objects", "content_retained_by_analyzer": false }, { "artifact_id": "artifact-3139dedfc6a1194feef19f69", "type": "http-exported-object", "filename": "date1%3fBNLv65=pAAS", "filenames": [ "date1%3fBNLv65=pAAS" ], "occurrences": 1, "static_features": { "content_kind": "pe", "inspected_bytes": 262144, "inspection_truncated": true, "features": [], "interpretation": "Static content only; not proof of execution, intent, or malware family" }, "size_bytes": 284816, "sha256": "eed363fc4af7a9070d69340592dcab7c78db4f90710357de29e3b624aa957cf8", "media_type": "application/octet-stream", "extraction_method": "tshark-http-export-objects", "content_retained_by_analyzer": false }, { "artifact_id": "artifact-74472d7bfd877aa3363c2955", "type": "http-exported-object", "filename": "am_delta_patch_1.349.439.0_dcf977cccce1b58289d270f71f8151b3acc1566b(4).exe", "filenames": [ "am_delta_patch_1.349.439.0_dcf977cccce1b58289d270f71f8151b3acc1566b(4).exe" ], "occurrences": 1, "static_features": { "content_kind": "unclassified", "inspected_bytes": 262144, "inspection_truncated": true, "features": [], "interpretation": "Static content only; not proof of execution, intent, or malware family" }, "size_bytes": 922056, "sha256": "0fb4d47bcda9b77b0fbd8cb88b34ba180365991f6a376e00add1ac880b67fd8f", "media_type": "application/octet-stream", "extraction_method": "tshark-http-export-objects", "content_retained_by_analyzer": false }, { "artifact_id": "artifact-0fb55f3316dc0c38ed2fe99e", "type": "http-exported-object", "filename": "apps.40518.14127333176902609.7be7b901-15fe-4c27-863c-7c0dbfc26c5c.5c278f58-912b-4af9-88f8-a65fff2da477%3fw=150&h=150", "filenames": [ "apps.40518.14127333176902609.7be7b901-15fe-4c27-863c-7c0dbfc26c5c.5c278f58-912b-4af9-88f8-a65fff2da477%3fw=150&h=150" ], "occurrences": 1, "static_features": { "content_kind": "unclassified", "inspected_bytes": 24101, "inspection_truncated": false, "features": [], "interpretation": "Static content only; not proof of execution, intent, or malware family" }, "size_bytes": 24101, "sha256": "c1c72144b320890b971bf8cd335438dd6c2e50783398965e7891ccb30b4e3652", "media_type": "application/octet-stream", "extraction_method": "tshark-http-export-objects", "content_retained_by_analyzer": false }, { "artifact_id": "artifact-752a975585b653cc07a0b2ff", "type": "http-exported-object", "filename": "apps.16525.14618985536919905.4b30e4f3-f7a1-4421-840c-2cc97b10e8e0.13409c3f-0e0f-40dd-b458-b324f658c185%3fw=150&h=150", "filenames": [ "apps.16525.14618985536919905.4b30e4f3-f7a1-4421-840c-2cc97b10e8e0.13409c3f-0e0f-40dd-b458-b324f658c185%3fw=150&h=150" ], "occurrences": 1, "static_features": { "content_kind": "unclassified", "inspected_bytes": 19230, "inspection_truncated": false, "features": [], "interpretation": "Static content only; not proof of execution, intent, or malware family" }, "size_bytes": 19230, "sha256": "f7018b08490ebc04900ec28586710f3e93542ebe3ce390378e7f4e6665f28c43", "media_type": "application/octet-stream", "extraction_method": "tshark-http-export-objects", "content_retained_by_analyzer": false }, { "artifact_id": "artifact-70bb5da136c66653715ee483", "type": "http-exported-object", "filename": "apps.31617.13655054093851568.f2bf9430-60d7-4569-a50d-0f21c9ade6b3.c563d383-997d-4da1-9def-d7200e3547f8%3fw=150&h=150", "filenames": [ "apps.31617.13655054093851568.f2bf9430-60d7-4569-a50d-0f21c9ade6b3.c563d383-997d-4da1-9def-d7200e3547f8%3fw=150&h=150" ], "occurrences": 1, "static_features": { "content_kind": "unclassified", "inspected_bytes": 17906, "inspection_truncated": false, "features": [], "interpretation": "Static content only; not proof of execution, intent, or malware family" }, "size_bytes": 17906, "sha256": "0c58b13a7b5d78c8a9e35d5995b7352c3b38acee77d6af9886c3cf2d668bfd3c", "media_type": "application/octet-stream", "extraction_method": "tshark-http-export-objects", "content_retained_by_analyzer": false }, { "artifact_id": "artifact-5ab522a329d23e888d2e9c73", "type": "http-exported-object", "filename": "apps.16999.13510798885065391.a43a9782-6060-4560-b391-7f6f188559d0.dc15b6ee-644d-41e3-8d76-67c8c9dac9e9%3fw=150&h=225", "filenames": [ "apps.16999.13510798885065391.a43a9782-6060-4560-b391-7f6f188559d0.dc15b6ee-644d-41e3-8d76-67c8c9dac9e9%3fw=150&h=225" ], "occurrences": 1, "static_features": { "content_kind": "unclassified", "inspected_bytes": 16870, "inspection_truncated": false, "features": [], "interpretation": "Static content only; not proof of execution, intent, or malware family" }, "size_bytes": 16870, "sha256": "4a11107d730c5943885081bfc3e902af14e8e83f59d110979bb2af47e325c38e", "media_type": "application/octet-stream", "extraction_method": "tshark-http-export-objects", "content_retained_by_analyzer": false }, { "artifact_id": "artifact-7953b8baee3e02621457eeef", "type": "http-exported-object", "filename": "apps.11608.14255546098955437.c2922c50-eb00-4f80-b393-4e513d9f81c7.4345eb8f-f893-40a2-aec5-20f4758af165%3fw=150&h=150", "filenames": [ "apps.11608.14255546098955437.c2922c50-eb00-4f80-b393-4e513d9f81c7.4345eb8f-f893-40a2-aec5-20f4758af165%3fw=150&h=150" ], "occurrences": 1, "static_features": { "content_kind": "unclassified", "inspected_bytes": 13972, "inspection_truncated": false, "features": [], "interpretation": "Static content only; not proof of execution, intent, or malware family" }, "size_bytes": 13972, "sha256": "0f132c40ca33c057af0aed28534cd23b31ce36da1ad0cda3f2c2f1e03d646bca", "media_type": "application/octet-stream", "extraction_method": "tshark-http-export-objects", "content_retained_by_analyzer": false }, { "artifact_id": "artifact-baacb90b3ea2a5bac3bb2228", "type": "http-exported-object", "filename": "35098229_d9a668acd9af16621c688b823ada2c10de963ca4.cab", "filenames": [ "35098229_d9a668acd9af16621c688b823ada2c10de963ca4.cab" ], "occurrences": 1, "static_features": { "content_kind": "unclassified", "inspected_bytes": 10821, "inspection_truncated": false, "features": [], "interpretation": "Static content only; not proof of execution, intent, or malware family" }, "size_bytes": 10821, "sha256": "4b03bfd94c00eecc15b41ef45adb7196c1bcfc942383b2ace3fac4a0423bdef4", "media_type": "application/octet-stream", "extraction_method": "tshark-http-export-objects", "content_retained_by_analyzer": false }, { "artifact_id": "artifact-6ec9d7b2eeadec7d012d8a56", "type": "http-exported-object", "filename": "35094827_769ef074432ee9d2982132709c97d7a039b1441d.cab", "filenames": [ "35094827_769ef074432ee9d2982132709c97d7a039b1441d.cab" ], "occurrences": 1, "static_features": { "content_kind": "unclassified", "inspected_bytes": 10791, "inspection_truncated": false, "features": [], "interpretation": "Static content only; not proof of execution, intent, or malware family" }, "size_bytes": 10791, "sha256": "4839da5b25468809fbc7708652e77c4aa945e6735bf5c9119b3299653898ce34", "media_type": "application/octet-stream", "extraction_method": "tshark-http-export-objects", "content_retained_by_analyzer": false }, { "artifact_id": "artifact-1bcd879a067ef93d296ed895", "type": "http-exported-object", "filename": "35096864_51f3f34383a28a4d5d63528d9978515e66a6806e.cab", "filenames": [ "35096864_51f3f34383a28a4d5d63528d9978515e66a6806e.cab" ], "occurrences": 1, "static_features": { "content_kind": "unclassified", "inspected_bytes": 10789, "inspection_truncated": false, "features": [], "interpretation": "Static content only; not proof of execution, intent, or malware family" }, "size_bytes": 10789, "sha256": "cb82f8b3153b5c172ae382d0cf92ca5373017dd09f98137bc3b06982115006d7", "media_type": "application/octet-stream", "extraction_method": "tshark-http-export-objects", "content_retained_by_analyzer": false }, { "artifact_id": "artifact-4cba839fc685581f1de16836", "type": "http-exported-object", "filename": "35096188_49a74f42962e10ef9cfa9492f2c1955c24967958.cab", "filenames": [ "35096188_49a74f42962e10ef9cfa9492f2c1955c24967958.cab" ], "occurrences": 1, "static_features": { "content_kind": "unclassified", "inspected_bytes": 10781, "inspection_truncated": false, "features": [], "interpretation": "Static content only; not proof of execution, intent, or malware family" }, "size_bytes": 10781, "sha256": "2972f477a28570de6c949fba237ace8c1bc2ea29b961b63aab3a57469e70cb51", "media_type": "application/octet-stream", "extraction_method": "tshark-http-export-objects", "content_retained_by_analyzer": false }, { "artifact_id": "artifact-4b9ef213a8b480b046f0e55d", "type": "http-exported-object", "filename": "35096518_246960552fd8974bcfe0af13e362f8d00f0c6046.cab", "filenames": [ "35096518_246960552fd8974bcfe0af13e362f8d00f0c6046.cab" ], "occurrences": 1, "static_features": { "content_kind": "unclassified", "inspected_bytes": 10767, "inspection_truncated": false, "features": [], "interpretation": "Static content only; not proof of execution, intent, or malware family" }, "size_bytes": 10767, "sha256": "8529705a28a2cc8a6ac692e2f9a8cba5d6a3f44b81041270251389f1a017656c", "media_type": "application/octet-stream", "extraction_method": "tshark-http-export-objects", "content_retained_by_analyzer": false }, { "artifact_id": "artifact-286a093f05b5dda8bf2af676", "type": "http-exported-object", "filename": "35095158_9a369166024cd2046a41b3fcf5a7d5743d20b1f8.cab", "filenames": [ "35095158_9a369166024cd2046a41b3fcf5a7d5743d20b1f8.cab" ], "occurrences": 1, "static_features": { "content_kind": "unclassified", "inspected_bytes": 10765, "inspection_truncated": false, "features": [], "interpretation": "Static content only; not proof of execution, intent, or malware family" }, "size_bytes": 10765, "sha256": "1127774b7710ffa8c9bd5d3182517be848d9373e8f4382f28f801ba9e44f80fb", "media_type": "application/octet-stream", "extraction_method": "tshark-http-export-objects", "content_retained_by_analyzer": false }, { "artifact_id": "artifact-ed48e5ec1e756dd30dcc10bc", "type": "http-exported-object", "filename": "35097188_47bf5b9e41cf731eeaf7b93672b38948c413df0b.cab", "filenames": [ "35097188_47bf5b9e41cf731eeaf7b93672b38948c413df0b.cab" ], "occurrences": 1, "static_features": { "content_kind": "unclassified", "inspected_bytes": 10763, "inspection_truncated": false, "features": [], "interpretation": "Static content only; not proof of execution, intent, or malware family" }, "size_bytes": 10763, "sha256": "80a71674cf8a71eaaf73c661d43ca1b69c4f393ccd603b89436812913fffb0f1", "media_type": "application/octet-stream", "extraction_method": "tshark-http-export-objects", "content_retained_by_analyzer": false }, { "artifact_id": "artifact-710cd180d86e73cf5af6f7ca", "type": "http-exported-object", "filename": "35095511_08bd8b8ea97b82600094601b9451b7fa9b028927.cab", "filenames": [ "35095511_08bd8b8ea97b82600094601b9451b7fa9b028927.cab" ], "occurrences": 1, "static_features": { "content_kind": "unclassified", "inspected_bytes": 10623, "inspection_truncated": false, "features": [], "interpretation": "Static content only; not proof of execution, intent, or malware family" }, "size_bytes": 10623, "sha256": "07a1470ae3b863578779e025fc6009e6519e0f77325e7a94a426a58b7e408196", "media_type": "application/octet-stream", "extraction_method": "tshark-http-export-objects", "content_retained_by_analyzer": false }, { "artifact_id": "artifact-9e0bee7b41d6b7ca0e69d67d", "type": "http-exported-object", "filename": "35097541_59453a64ae1a0f59447d0c4e4bae68350827ad3f.cab", "filenames": [ "35097541_59453a64ae1a0f59447d0c4e4bae68350827ad3f.cab" ], "occurrences": 1, "static_features": { "content_kind": "unclassified", "inspected_bytes": 10621, "inspection_truncated": false, "features": [], "interpretation": "Static content only; not proof of execution, intent, or malware family" }, "size_bytes": 10621, "sha256": "e9132eaa61c1d06d76b82c27cffa7b6ba171f5e31fcec6fa78b03a7523f0f40a", "media_type": "application/octet-stream", "extraction_method": "tshark-http-export-objects", "content_retained_by_analyzer": false }, { "artifact_id": "artifact-c6d21c7f5c356b86c31703bb", "type": "http-exported-object", "filename": "35095828_d42aac61fe6047b9b6b654db9d5c9ae957613125.cab", "filenames": [ "35095828_d42aac61fe6047b9b6b654db9d5c9ae957613125.cab" ], "occurrences": 1, "static_features": { "content_kind": "unclassified", "inspected_bytes": 10593, "inspection_truncated": false, "features": [], "interpretation": "Static content only; not proof of execution, intent, or malware family" }, "size_bytes": 10593, "sha256": "dd3eb184a16f533fcce480c533d93846a6bb11138dc12468830115263490238d", "media_type": "application/octet-stream", "extraction_method": "tshark-http-export-objects", "content_retained_by_analyzer": false }, { "artifact_id": "artifact-67d57be4db6fe8650288f03b", "type": "http-exported-object", "filename": "35097869_11f02196bd92ebd3ff0745749654d98eb8ddd58c.cab", "filenames": [ "35097869_11f02196bd92ebd3ff0745749654d98eb8ddd58c.cab" ], "occurrences": 1, "static_features": { "content_kind": "unclassified", "inspected_bytes": 10589, "inspection_truncated": false, "features": [], "interpretation": "Static content only; not proof of execution, intent, or malware family" }, "size_bytes": 10589, "sha256": "0076eaec4990322f0ebf53a5a53997c1525f358dc28dd6b7e1cbffd9bd41a9a5", "media_type": "application/octet-stream", "extraction_method": "tshark-http-export-objects", "content_retained_by_analyzer": false }, { "artifact_id": "artifact-387316dbd8bd994b4abb00f1", "type": "http-exported-object", "filename": "35096748_a533dd985a0175649c16855a9c628da8f21d78da.cab", "filenames": [ "35096748_a533dd985a0175649c16855a9c628da8f21d78da.cab" ], "occurrences": 1, "static_features": { "content_kind": "unclassified", "inspected_bytes": 7287, "inspection_truncated": false, "features": [], "interpretation": "Static content only; not proof of execution, intent, or malware family" }, "size_bytes": 7287, "sha256": "9db86bb697c7b6a5f3ed228546c9cb8a7037901e61efe0b244ba38e7d9ad3886", "media_type": "application/octet-stream", "extraction_method": "tshark-http-export-objects", "content_retained_by_analyzer": false }, { "artifact_id": "artifact-180b6d8f674e60363cc922f7", "type": "http-exported-object", "filename": "35098113_ea9c1c8bf8003ad3b08ee004e09ae3bbf5fb1456.cab", "filenames": [ "35098113_ea9c1c8bf8003ad3b08ee004e09ae3bbf5fb1456.cab" ], "occurrences": 1, "static_features": { "content_kind": "unclassified", "inspected_bytes": 7285, "inspection_truncated": false, "features": [], "interpretation": "Static content only; not proof of execution, intent, or malware family" }, "size_bytes": 7285, "sha256": "01b57c485bc90409c12dfff1fcca905e8ee03a18958ebb8fb7f007d317c2e6fc", "media_type": "application/octet-stream", "extraction_method": "tshark-http-export-objects", "content_retained_by_analyzer": false }, { "artifact_id": "artifact-6d935ccb1dfb597125dd0f98", "type": "http-exported-object", "filename": "35096747_f2ef0a3546df9b0fe01091e8cf6244c2b18ad27a.cab", "filenames": [ "35096747_f2ef0a3546df9b0fe01091e8cf6244c2b18ad27a.cab" ], "occurrences": 1, "static_features": { "content_kind": "unclassified", "inspected_bytes": 7285, "inspection_truncated": false, "features": [], "interpretation": "Static content only; not proof of execution, intent, or malware family" }, "size_bytes": 7285, "sha256": "2cd96ea2a66b8bc4526b21c3744118b75f834d24739b04e2e7ceef21b8ad706f", "media_type": "application/octet-stream", "extraction_method": "tshark-http-export-objects", "content_retained_by_analyzer": false }, { "artifact_id": "artifact-2d99be72ce0938e1d5cbe15a", "type": "http-exported-object", "filename": "35096072_5331372f4a198d80f7a5602f73259ff77d004730.cab", "filenames": [ "35096072_5331372f4a198d80f7a5602f73259ff77d004730.cab" ], "occurrences": 1, "static_features": { "content_kind": "unclassified", "inspected_bytes": 7283, "inspection_truncated": false, "features": [], "interpretation": "Static content only; not proof of execution, intent, or malware family" }, "size_bytes": 7283, "sha256": "6db9e2137a8e7ebe66680ad4b9deeb17f7fc9f3103d9a1d9cde353f898de1bee", "media_type": "application/octet-stream", "extraction_method": "tshark-http-export-objects", "content_retained_by_analyzer": false }, { "artifact_id": "artifact-69b45771a4e918bc030c1f5c", "type": "http-exported-object", "filename": "35098112_e6ce21ecdf7d899a6a8671574b68871ce853efe6.cab", "filenames": [ "35098112_e6ce21ecdf7d899a6a8671574b68871ce853efe6.cab" ], "occurrences": 1, "static_features": { "content_kind": "unclassified", "inspected_bytes": 7277, "inspection_truncated": false, "features": [], "interpretation": "Static content only; not proof of execution, intent, or malware family" }, "size_bytes": 7277, "sha256": "d98626686f7c56a852f3d658d947d96137ecbcfed278bdc2bc6158239a7434a2", "media_type": "application/octet-stream", "extraction_method": "tshark-http-export-objects", "content_retained_by_analyzer": false }, { "artifact_id": "artifact-2ad4d61b8d2e2e6a6577e5fa", "type": "http-exported-object", "filename": "35094710_046a1ec2fc584f3c2f6653542576b125ec45b91b.cab", "filenames": [ "35094710_046a1ec2fc584f3c2f6653542576b125ec45b91b.cab" ], "occurrences": 1, "static_features": { "content_kind": "unclassified", "inspected_bytes": 7277, "inspection_truncated": false, "features": [], "interpretation": "Static content only; not proof of execution, intent, or malware family" }, "size_bytes": 7277, "sha256": "ea203eb1b56387cac02308b5aca040993e2d1c7fbd06413d41c957a726e4898f", "media_type": "application/octet-stream", "extraction_method": "tshark-http-export-objects", "content_retained_by_analyzer": false }, { "artifact_id": "artifact-6c9261c50b1842b029fbf98a", "type": "http-exported-object", "filename": "35096071_6f89138c772d9cca2cda43656eecab96a5cd44fc.cab", "filenames": [ "35096071_6f89138c772d9cca2cda43656eecab96a5cd44fc.cab" ], "occurrences": 1, "static_features": { "content_kind": "unclassified", "inspected_bytes": 7275, "inspection_truncated": false, "features": [], "interpretation": "Static content only; not proof of execution, intent, or malware family" }, "size_bytes": 7275, "sha256": "153eec5b545f82f598d7728472073b1cdee325fc30cb7bc743c21d753610950d", "media_type": "application/octet-stream", "extraction_method": "tshark-http-export-objects", "content_retained_by_analyzer": false }, { "artifact_id": "artifact-048bc1575e3c1d50f469a660", "type": "http-exported-object", "filename": "35097432_b4cbace49a072b37958e15b9d3daadf28c89f361.cab", "filenames": [ "35097432_b4cbace49a072b37958e15b9d3daadf28c89f361.cab" ], "occurrences": 1, "static_features": { "content_kind": "unclassified", "inspected_bytes": 7275, "inspection_truncated": false, "features": [], "interpretation": "Static content only; not proof of execution, intent, or malware family" }, "size_bytes": 7275, "sha256": "729388a4d1b0e06eb28c982bf4a2e9304937ad1a92932dfc76d822b441563b6d", "media_type": "application/octet-stream", "extraction_method": "tshark-http-export-objects", "content_retained_by_analyzer": false }, { "artifact_id": "artifact-b01f68708da0f1bb264a8668", "type": "http-exported-object", "filename": "35094711_e3993b23840c0d600179f647e9ac08158269c095.cab", "filenames": [ "35094711_e3993b23840c0d600179f647e9ac08158269c095.cab" ], "occurrences": 1, "static_features": { "content_kind": "unclassified", "inspected_bytes": 7275, "inspection_truncated": false, "features": [], "interpretation": "Static content only; not proof of execution, intent, or malware family" }, "size_bytes": 7275, "sha256": "e008608c81024ed297a07321b7c9ba9a00adac7cea71f24491af04b5e88f2f21", "media_type": "application/octet-stream", "extraction_method": "tshark-http-export-objects", "content_retained_by_analyzer": false }, { "artifact_id": "artifact-910911685decebc2c3ee0cad", "type": "http-exported-object", "filename": "35097431_5695ed6029065d034bdbaa6edef143ec73f43570.cab", "filenames": [ "35097431_5695ed6029065d034bdbaa6edef143ec73f43570.cab" ], "occurrences": 1, "static_features": { "content_kind": "unclassified", "inspected_bytes": 7273, "inspection_truncated": false, "features": [], "interpretation": "Static content only; not proof of execution, intent, or malware family" }, "size_bytes": 7273, "sha256": "8eddb32e5ab1436d9cec5cbf730ad2a82d559730d69e35c534863d64d038d7c5", "media_type": "application/octet-stream", "extraction_method": "tshark-http-export-objects", "content_retained_by_analyzer": false }, { "artifact_id": "artifact-30ac0a77eb10b6bc5a953010", "type": "http-exported-object", "filename": "35095402_3a3af9d09b295d5cad27c058b669144408fd1987.cab", "filenames": [ "35095402_3a3af9d09b295d5cad27c058b669144408fd1987.cab" ], "occurrences": 1, "static_features": { "content_kind": "unclassified", "inspected_bytes": 7267, "inspection_truncated": false, "features": [], "interpretation": "Static content only; not proof of execution, intent, or malware family" }, "size_bytes": 7267, "sha256": "3197375f525ce4d0d339e56b343ecd510ffc72dcfa250b1352f8bd6a02d49864", "media_type": "application/octet-stream", "extraction_method": "tshark-http-export-objects", "content_retained_by_analyzer": false }, { "artifact_id": "artifact-f5f89b4e1678d28348a0e84e", "type": "http-exported-object", "filename": "35095401_461f0f3035a629e02f33b5439ab5d58c4e45c62f.cab", "filenames": [ "35095401_461f0f3035a629e02f33b5439ab5d58c4e45c62f.cab" ], "occurrences": 1, "static_features": { "content_kind": "unclassified", "inspected_bytes": 7261, "inspection_truncated": false, "features": [], "interpretation": "Static content only; not proof of execution, intent, or malware family" }, "size_bytes": 7261, "sha256": "f040d968ae5f0c4324a4e3fce10f7bfbc4370251aecb695f4a5f6c5af7a66aa7", "media_type": "application/octet-stream", "extraction_method": "tshark-http-export-objects", "content_retained_by_analyzer": false }, { "artifact_id": "artifact-ae04db8f4788e6435c2d3639", "type": "http-exported-object", "filename": "35097072_9c18abaa0dd4f3355c05cb1e0ac0d0a1da10552a.cab", "filenames": [ "35097072_9c18abaa0dd4f3355c05cb1e0ac0d0a1da10552a.cab" ], "occurrences": 1, "static_features": { "content_kind": "unclassified", "inspected_bytes": 7189, "inspection_truncated": false, "features": [], "interpretation": "Static content only; not proof of execution, intent, or malware family" }, "size_bytes": 7189, "sha256": "6c1eac65b98a81cd11abeaffe3fcf7f268e8788f733a0a8598b900201f05fc6d", "media_type": "application/octet-stream", "extraction_method": "tshark-http-export-objects", "content_retained_by_analyzer": false }, { "artifact_id": "artifact-cbf67ce8eb8b5faa88185a15", "type": "http-exported-object", "filename": "35097071_01580b64b700158e52507faa6223a4cb41c43f05.cab", "filenames": [ "35097071_01580b64b700158e52507faa6223a4cb41c43f05.cab" ], "occurrences": 1, "static_features": { "content_kind": "unclassified", "inspected_bytes": 7185, "inspection_truncated": false, "features": [], "interpretation": "Static content only; not proof of execution, intent, or malware family" }, "size_bytes": 7185, "sha256": "0550952e70d2e4e5ca28a8160e31cab6418ecb152915ec5dbfe88248d39fc2c7", "media_type": "application/octet-stream", "extraction_method": "tshark-http-export-objects", "content_retained_by_analyzer": false }, { "artifact_id": "artifact-86ba355c6f7138cabbded8e8", "type": "http-exported-object", "filename": "35096401_980e49644362fb40897606d01fddd1ef79c6702a.cab", "filenames": [ "35096401_980e49644362fb40897606d01fddd1ef79c6702a.cab" ], "occurrences": 1, "static_features": { "content_kind": "unclassified", "inspected_bytes": 7183, "inspection_truncated": false, "features": [], "interpretation": "Static content only; not proof of execution, intent, or malware family" }, "size_bytes": 7183, "sha256": "b4effa72b591f85bed1dd07d82d924b9423f5e58a26c62290d11a628768676e4", "media_type": "application/octet-stream", "extraction_method": "tshark-http-export-objects", "content_retained_by_analyzer": false }, { "artifact_id": "artifact-e0731dc3eff6de98411d3b44", "type": "http-exported-object", "filename": "35096402_83d0bc9d8970cab311753b171496293c4e0588b8.cab", "filenames": [ "35096402_83d0bc9d8970cab311753b171496293c4e0588b8.cab" ], "occurrences": 1, "static_features": { "content_kind": "unclassified", "inspected_bytes": 7181, "inspection_truncated": false, "features": [], "interpretation": "Static content only; not proof of execution, intent, or malware family" }, "size_bytes": 7181, "sha256": "36d3e002691397fefd5287603499d03fd0d929ebc2d4b08ece3d9e8b74cb3219", "media_type": "application/octet-stream", "extraction_method": "tshark-http-export-objects", "content_retained_by_analyzer": false }, { "artifact_id": "artifact-28cabf370041ec91b1106009", "type": "http-exported-object", "filename": "35095042_571a24bf1c59b2fc66012aba76936bc63860b918.cab", "filenames": [ "35095042_571a24bf1c59b2fc66012aba76936bc63860b918.cab" ], "occurrences": 1, "static_features": { "content_kind": "unclassified", "inspected_bytes": 7181, "inspection_truncated": false, "features": [], "interpretation": "Static content only; not proof of execution, intent, or malware family" }, "size_bytes": 7181, "sha256": "e65eaf9faa6e7f3f0ce49c052a35be7cd5fed3ffc70b3f1ff7c213bee79f83fe", "media_type": "application/octet-stream", "extraction_method": "tshark-http-export-objects", "content_retained_by_analyzer": false }, { "artifact_id": "artifact-3e58d219ed25bd72b8be4a9c", "type": "http-exported-object", "filename": "35097759_f51781226900f2c3a24cac0d25d7e32ce4232b12.cab", "filenames": [ "35097759_f51781226900f2c3a24cac0d25d7e32ce4232b12.cab" ], "occurrences": 1, "static_features": { "content_kind": "unclassified", "inspected_bytes": 7175, "inspection_truncated": false, "features": [], "interpretation": "Static content only; not proof of execution, intent, or malware family" }, "size_bytes": 7175, "sha256": "809e5e4344a517b4f713aa55e03e2dc0c0d21cfa77ac2963e2e6e937e7d1264a", "media_type": "application/octet-stream", "extraction_method": "tshark-http-export-objects", "content_retained_by_analyzer": false }, { "artifact_id": "artifact-6393dcafb21eb3f8fa0af067", "type": "http-exported-object", "filename": "35097760_94afc464b79c1922edc5d9f1aa46b8bbdafcac27.cab", "filenames": [ "35097760_94afc464b79c1922edc5d9f1aa46b8bbdafcac27.cab" ], "occurrences": 1, "static_features": { "content_kind": "unclassified", "inspected_bytes": 7175, "inspection_truncated": false, "features": [], "interpretation": "Static content only; not proof of execution, intent, or malware family" }, "size_bytes": 7175, "sha256": "b96661475f79113a3685ff208a52c3dde1340f93a479011f027c7bd3859c5334", "media_type": "application/octet-stream", "extraction_method": "tshark-http-export-objects", "content_retained_by_analyzer": false }, { "artifact_id": "artifact-382a4df8d7cc37c7274cf358", "type": "http-exported-object", "filename": "35095719_bb98167530418ae8aa387c077bca2d54e52a227b.cab", "filenames": [ "35095719_bb98167530418ae8aa387c077bca2d54e52a227b.cab" ], "occurrences": 1, "static_features": { "content_kind": "unclassified", "inspected_bytes": 7171, "inspection_truncated": false, "features": [], "interpretation": "Static content only; not proof of execution, intent, or malware family" }, "size_bytes": 7171, "sha256": "6a115a372e460c1de12760689955740a891b6d1e3f97bbe7e667c93ee940150c", "media_type": "application/octet-stream", "extraction_method": "tshark-http-export-objects", "content_retained_by_analyzer": false }, { "artifact_id": "artifact-23f6fc7b3b31892241e9e53d", "type": "http-exported-object", "filename": "35095718_d6052d2a18efec5d0584f7d9db0c6df36c871e5e.cab", "filenames": [ "35095718_d6052d2a18efec5d0584f7d9db0c6df36c871e5e.cab" ], "occurrences": 1, "static_features": { "content_kind": "unclassified", "inspected_bytes": 7171, "inspection_truncated": false, "features": [], "interpretation": "Static content only; not proof of execution, intent, or malware family" }, "size_bytes": 7171, "sha256": "b80ed4f18c472ca7a6dd8dad53acc51a77e0ee0dc1fbadcc2e5d8e42efaa37fe", "media_type": "application/octet-stream", "extraction_method": "tshark-http-export-objects", "content_retained_by_analyzer": false }, { "artifact_id": "artifact-f8a6b000a365b8e0f3d09f05", "type": "http-exported-object", "filename": "35095041_d6fbe7dcab58bad491f97a8fb16f67acdd9c5880.cab", "filenames": [ "35095041_d6fbe7dcab58bad491f97a8fb16f67acdd9c5880.cab" ], "occurrences": 1, "static_features": { "content_kind": "unclassified", "inspected_bytes": 7171, "inspection_truncated": false, "features": [], "interpretation": "Static content only; not proof of execution, intent, or malware family" }, "size_bytes": 7171, "sha256": "eddbff1244adffc83452a0a77a9c25fb8eb31625f9d18203acde9fd85eaa7f74", "media_type": "application/octet-stream", "extraction_method": "tshark-http-export-objects", "content_retained_by_analyzer": false }, { "artifact_id": "artifact-1a5706bb5697bc56c5bcddb5", "type": "http-exported-object", "filename": "apps.28261.13798539581762600.abe1643f-1704-4a4d-a61b-47ccc25da012.ada314ec-db8e-49bb-a756-60487526418e%3fw=150&h=150", "filenames": [ "apps.28261.13798539581762600.abe1643f-1704-4a4d-a61b-47ccc25da012.ada314ec-db8e-49bb-a756-60487526418e%3fw=150&h=150" ], "occurrences": 1, "static_features": { "content_kind": "unclassified", "inspected_bytes": 2222, "inspection_truncated": false, "features": [], "interpretation": "Static content only; not proof of execution, intent, or malware family" }, "size_bytes": 2222, "sha256": "84520bc8bb4f129be41a7ab2a1ff1064efcd060d5521c2d5c23afd8710339411", "media_type": "application/octet-stream", "extraction_method": "tshark-http-export-objects", "content_retained_by_analyzer": false }, { "artifact_id": "artifact-0fc769c752319e9982259def", "type": "http-exported-object", "filename": "ncsi.txt", "filenames": [ "ncsi.txt" ], "occurrences": 1, "static_features": { "content_kind": "unclassified", "inspected_bytes": 14, "inspection_truncated": false, "features": [], "interpretation": "Static content only; not proof of execution, intent, or malware family" }, "size_bytes": 14, "sha256": "6137f8db2192e638e13610f75e73b9247c05f4706f0afd1fdb132d86de6b4012", "media_type": "text/plain", "extraction_method": "tshark-http-export-objects", "content_retained_by_analyzer": false }, { "artifact_id": "artifact-cfaef7a0adb110765307d655", "type": "http-exported-object", "filename": "am_delta_patch_1.349.439.0_dcf977cccce1b58289d270f71f8151b3acc1566b(1).exe", "filenames": [ "am_delta_patch_1.349.439.0_dcf977cccce1b58289d270f71f8151b3acc1566b(1).exe", "am_delta_patch_1.349.439.0_dcf977cccce1b58289d270f71f8151b3acc1566b.exe" ], "occurrences": 2, "static_features": { "content_kind": "unclassified", "inspected_bytes": 2, "inspection_truncated": false, "features": [], "interpretation": "Static content only; not proof of execution, intent, or malware family" }, "size_bytes": 2, "sha256": "9b8db510ef42b8ed54a3712636fda55a4f8cfcd5493e20b74ab00cd4f3979f2d", "media_type": "application/octet-stream", "extraction_method": "tshark-http-export-objects", "content_retained_by_analyzer": false } ], "observables": [ { "observable_id": "observable-b9226c9d28483c6b6bab4bb3", "type": "domain", "value": "68091d435f184f9c8d6273bdb538ff4b.clo.footprintdns.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1631315821.620987000", "last_seen_epoch": "1631315821.798138000", "evidence": [ { "frame_number": 583, "timestamp_epoch": "1631315821.620987000", "display_filter": "frame.number == 583", "udp_stream": 29 }, { "frame_number": 601, "timestamp_epoch": "1631315821.704192000", "display_filter": "frame.number == 601", "udp_stream": 29 }, { "frame_number": 641, "timestamp_epoch": "1631315821.798138000", "display_filter": "frame.number == 641", "tcp_stream": 33 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-cbf35cbe75f7755fd9e35524", "type": "domain", "value": "a-ring.msedge.net", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1631315821.783225000", "last_seen_epoch": "1631315821.944764000", "evidence": [ { "frame_number": 632, "timestamp_epoch": "1631315821.783225000", "display_filter": "frame.number == 632", "udp_stream": 36 }, { "frame_number": 671, "timestamp_epoch": "1631315821.855931000", "display_filter": "frame.number == 671", "udp_stream": 36 }, { "frame_number": 769, "timestamp_epoch": "1631315821.944764000", "display_filter": "frame.number == 769", "tcp_stream": 39 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-80ead2800e445e7e4e3020f3", "type": "domain", "value": "am2prdapp01-canary.cloudapp.net", "roles": [ "dns-cname" ], "is_private": null, "first_seen_epoch": "1631315821.687583000", "last_seen_epoch": "1631315821.687583000", "evidence": [ { "frame_number": 587, "timestamp_epoch": "1631315821.687583000", "display_filter": "frame.number == 587", "udp_stream": 25 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-a403579410c433e7d7ceefe0", "type": "domain", "value": "angrypoutine-dc.angrypoutine.com", "roles": [ "dns-query" ], "is_private": null, "first_seen_epoch": "1631315711.022144000", "last_seen_epoch": "1631320086.126452000", "evidence": [ { "frame_number": 41, "timestamp_epoch": "1631315711.022144000", "display_filter": "frame.number == 41", "udp_stream": 11 }, { "frame_number": 42, "timestamp_epoch": "1631315711.022428000", "display_filter": "frame.number == 42", "udp_stream": 11 }, { "frame_number": 44, "timestamp_epoch": "1631315711.117649000", "display_filter": "frame.number == 44", "udp_stream": 11 }, { "frame_number": 45, "timestamp_epoch": "1631315711.117830000", "display_filter": "frame.number == 45", "udp_stream": 11 }, { "frame_number": 8533, "timestamp_epoch": "1631319346.875565000", "display_filter": "frame.number == 8533", "udp_stream": 92 }, { "frame_number": 8534, "timestamp_epoch": "1631319346.875848000", "display_filter": "frame.number == 8534", "udp_stream": 92 }, { "frame_number": 8535, "timestamp_epoch": "1631319346.962698000", "display_filter": "frame.number == 8535", "udp_stream": 92 }, { "frame_number": 8536, "timestamp_epoch": "1631319346.962976000", "display_filter": "frame.number == 8536", "udp_stream": 92 }, { "frame_number": 8884, "timestamp_epoch": "1631320086.126109000", "display_filter": "frame.number == 8884", "udp_stream": 99 }, { "frame_number": 8887, "timestamp_epoch": "1631320086.126452000", "display_filter": "frame.number == 8887", "udp_stream": 99 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-dfbf703ac689cee867597d31", "type": "domain", "value": "angrypoutine.com", "roles": [ "dns-query" ], "is_private": null, "first_seen_epoch": "1631315709.550830000", "last_seen_epoch": "1631315709.551563000", "evidence": [ { "frame_number": 26, "timestamp_epoch": "1631315709.550830000", "display_filter": "frame.number == 26", "udp_stream": 5 }, { "frame_number": 30, "timestamp_epoch": "1631315709.551563000", "display_filter": "frame.number == 30", "udp_stream": 5 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-d3c015efb683b10cd1238a16", "type": "domain", "value": "api.msn.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1631315818.320206000", "last_seen_epoch": "1631315823.927190000", "evidence": [ { "frame_number": 555, "timestamp_epoch": "1631315818.320206000", "display_filter": "frame.number == 555", "udp_stream": 23 }, { "frame_number": 556, "timestamp_epoch": "1631315818.394540000", "display_filter": "frame.number == 556", "udp_stream": 23 }, { "frame_number": 560, "timestamp_epoch": "1631315818.563237000", "display_filter": "frame.number == 560", "tcp_stream": 26 }, { "frame_number": 970, "timestamp_epoch": "1631315823.927190000", "display_filter": "frame.number == 970", "tcp_stream": 43 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-7d2fda5d22bb1e0c9e5f1d73", "type": "domain", "value": "au.download.windowsupdate.com", "roles": [ "dns-query", "http-host" ], "is_private": null, "first_seen_epoch": "1631316288.612396000", "last_seen_epoch": "1631316290.377646000", "evidence": [ { "frame_number": 4182, "timestamp_epoch": "1631316288.612396000", "display_filter": "frame.number == 4182", "udp_stream": 72 }, { "frame_number": 4187, "timestamp_epoch": "1631316288.685394000", "display_filter": "frame.number == 4187", "udp_stream": 72 }, { "frame_number": 4193, "timestamp_epoch": "1631316288.773365000", "display_filter": "frame.number == 4193", "tcp_stream": 100 }, { "frame_number": 4195, "timestamp_epoch": "1631316288.774253000", "display_filter": "frame.number == 4195", "tcp_stream": 101 }, { "frame_number": 4200, "timestamp_epoch": "1631316288.853317000", "display_filter": "frame.number == 4200", "tcp_stream": 100 }, { "frame_number": 4201, "timestamp_epoch": "1631316288.853479000", "display_filter": "frame.number == 4201", "tcp_stream": 101 }, { "frame_number": 6371, "timestamp_epoch": "1631316290.377646000", "display_filter": "frame.number == 6371", "tcp_stream": 101 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-883257209d498a256821c9ef", "type": "domain", "value": "bing.com", "roles": [ "tls-sni" ], "is_private": null, "first_seen_epoch": "1631315821.695634000", "last_seen_epoch": "1631315821.695634000", "evidence": [ { "frame_number": 594, "timestamp_epoch": "1631315821.695634000", "display_filter": "frame.number == 594", "tcp_stream": 27 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-c6df09458f7b0557af9dbca1", "type": "domain", "value": "cdn.onenote.net", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1631315817.470608000", "last_seen_epoch": "1631315817.663510000", "evidence": [ { "frame_number": 510, "timestamp_epoch": "1631315817.470608000", "display_filter": "frame.number == 510", "udp_stream": 22 }, { "frame_number": 511, "timestamp_epoch": "1631315817.545292000", "display_filter": "frame.number == 511", "udp_stream": 22 }, { "frame_number": 518, "timestamp_epoch": "1631315817.663508000", "display_filter": "frame.number == 518", "tcp_stream": 25 }, { "frame_number": 519, "timestamp_epoch": "1631315817.663510000", "display_filter": "frame.number == 519", "tcp_stream": 24 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-81a78b19b630a6b9990dff9d", "type": "domain", "value": "client.wns.windows.com", "roles": [ "tls-sni" ], "is_private": null, "first_seen_epoch": "1631315715.609283000", "last_seen_epoch": "1631315715.609283000", "evidence": [ { "frame_number": 97, "timestamp_epoch": "1631315715.609283000", "display_filter": "frame.number == 97", "tcp_stream": 2 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-51e12b3b76b1712d478527fc", "type": "domain", "value": "cp601.prod.do.dsp.mp.microsoft.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1631316287.945289000", "last_seen_epoch": "1631316288.173158000", "evidence": [ { "frame_number": 4151, "timestamp_epoch": "1631316287.945289000", "display_filter": "frame.number == 4151", "udp_stream": 71 }, { "frame_number": 4159, "timestamp_epoch": "1631316288.021439000", "display_filter": "frame.number == 4159", "udp_stream": 71 }, { "frame_number": 4163, "timestamp_epoch": "1631316288.173158000", "display_filter": "frame.number == 4163", "tcp_stream": 99 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-9b54a97045add9a55ba84b54", "type": "domain", "value": "ctldl.windowsupdate.com", "roles": [ "dns-query", "http-host" ], "is_private": null, "first_seen_epoch": "1631319034.384054000", "last_seen_epoch": "1631319034.835713000", "evidence": [ { "frame_number": 8441, "timestamp_epoch": "1631319034.384054000", "display_filter": "frame.number == 8441", "udp_stream": 91 }, { "frame_number": 8442, "timestamp_epoch": "1631319034.468756000", "display_filter": "frame.number == 8442", "udp_stream": 91 }, { "frame_number": 8446, "timestamp_epoch": "1631319034.703114000", "display_filter": "frame.number == 8446", "tcp_stream": 137 }, { "frame_number": 8449, "timestamp_epoch": "1631319034.835713000", "display_filter": "frame.number == 8449", "tcp_stream": 137 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-ce7660fef8ee927d1a030b04", "type": "domain", "value": "desktop-kkitb6q.angrypoutine.com", "roles": [ "dns-query" ], "is_private": null, "first_seen_epoch": "1631315709.547238000", "last_seen_epoch": "1631315709.547578000", "evidence": [ { "frame_number": 22, "timestamp_epoch": "1631315709.547238000", "display_filter": "frame.number == 22", "udp_stream": 4 }, { "frame_number": 23, "timestamp_epoch": "1631315709.547578000", "display_filter": "frame.number == 23", "udp_stream": 4 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-9c2c5c2438850dc6ace02cc2", "type": "domain", "value": "desktop-muyeyv7.angrypoutine.com", "roles": [ "dns-query" ], "is_private": null, "first_seen_epoch": "1631315962.254281000", "last_seen_epoch": "1631315962.343828000", "evidence": [ { "frame_number": 2636, "timestamp_epoch": "1631315962.254281000", "display_filter": "frame.number == 2636", "udp_stream": 55 }, { "frame_number": 2637, "timestamp_epoch": "1631315962.254530000", "display_filter": "frame.number == 2637", "udp_stream": 55 }, { "frame_number": 2638, "timestamp_epoch": "1631315962.343653000", "display_filter": "frame.number == 2638", "udp_stream": 55 }, { "frame_number": 2639, "timestamp_epoch": "1631315962.343828000", "display_filter": "frame.number == 2639", "udp_stream": 55 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-410b65bfb79090175f0ae7d2", "type": "domain", "value": "dns.msftncsi.com", "roles": [ "dns-query" ], "is_private": null, "first_seen_epoch": "1631317946.902041000", "last_seen_epoch": "1631317947.000885000", "evidence": [ { "frame_number": 8039, "timestamp_epoch": "1631317946.902041000", "display_filter": "frame.number == 8039", "udp_stream": 83 }, { "frame_number": 8040, "timestamp_epoch": "1631317946.978854000", "display_filter": "frame.number == 8040", "udp_stream": 83 }, { "frame_number": 8041, "timestamp_epoch": "1631317947.000663000", "display_filter": "frame.number == 8041", "udp_stream": 83 }, { "frame_number": 8042, "timestamp_epoch": "1631317947.000885000", "display_filter": "frame.number == 8042", "udp_stream": 83 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-7252b75530a1bb6bca00f43c", "type": "domain", "value": "download.windowsupdate.com", "roles": [ "dns-query", "http-host" ], "is_private": null, "first_seen_epoch": "1631316276.812385000", "last_seen_epoch": "1631316281.715475000", "evidence": [ { "frame_number": 3232, "timestamp_epoch": "1631316276.812385000", "display_filter": "frame.number == 3232", "udp_stream": 66 }, { "frame_number": 3233, "timestamp_epoch": "1631316276.885401000", "display_filter": "frame.number == 3233", "udp_stream": 66 }, { "frame_number": 3241, "timestamp_epoch": "1631316277.088208000", "display_filter": "frame.number == 3241", "tcp_stream": 93 }, { "frame_number": 3254, "timestamp_epoch": "1631316277.171165000", "display_filter": "frame.number == 3254", "tcp_stream": 93 }, { "frame_number": 3263, "timestamp_epoch": "1631316277.250235000", "display_filter": "frame.number == 3263", "tcp_stream": 93 }, { "frame_number": 3272, "timestamp_epoch": "1631316277.331910000", "display_filter": "frame.number == 3272", "tcp_stream": 93 }, { "frame_number": 3284, "timestamp_epoch": "1631316277.422407000", "display_filter": "frame.number == 3284", "tcp_stream": 93 }, { "frame_number": 3294, "timestamp_epoch": "1631316277.503154000", "display_filter": "frame.number == 3294", "tcp_stream": 93 }, { "frame_number": 3303, "timestamp_epoch": "1631316277.580403000", "display_filter": "frame.number == 3303", "tcp_stream": 93 }, { "frame_number": 3320, "timestamp_epoch": "1631316277.672274000", "display_filter": "frame.number == 3320", "tcp_stream": 93 }, { "frame_number": 3336, "timestamp_epoch": "1631316277.754272000", "display_filter": "frame.number == 3336", "tcp_stream": 93 }, { "frame_number": 3351, "timestamp_epoch": "1631316277.844148000", "display_filter": "frame.number == 3351", "tcp_stream": 93 }, { "frame_number": 3366, "timestamp_epoch": "1631316277.936391000", "display_filter": "frame.number == 3366", "tcp_stream": 93 }, { "frame_number": 3381, "timestamp_epoch": "1631316278.041138000", "display_filter": "frame.number == 3381", "tcp_stream": 93 }, { "frame_number": 3394, "timestamp_epoch": "1631316278.130092000", "display_filter": "frame.number == 3394", "tcp_stream": 93 }, { "frame_number": 3407, "timestamp_epoch": "1631316278.212132000", "display_filter": "frame.number == 3407", "tcp_stream": 93 }, { "frame_number": 3421, "timestamp_epoch": "1631316278.664748000", "display_filter": "frame.number == 3421", "tcp_stream": 93 }, { "frame_number": 3435, "timestamp_epoch": "1631316278.755365000", "display_filter": "frame.number == 3435", "tcp_stream": 93 }, { "frame_number": 3448, "timestamp_epoch": "1631316278.843113000", "display_filter": "frame.number == 3448", "tcp_stream": 93 }, { "frame_number": 3560, "timestamp_epoch": "1631316279.506042000", "display_filter": "frame.number == 3560", "tcp_stream": 93 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-6c47557cffbbb21d529ee17e", "type": "domain", "value": "evoke-windowsservices-tas.msedge.net", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1631317871.054310000", "last_seen_epoch": "1631317871.606825000", "evidence": [ { "frame_number": 7989, "timestamp_epoch": "1631317871.054310000", "display_filter": "frame.number == 7989", "udp_stream": 81 }, { "frame_number": 7990, "timestamp_epoch": "1631317871.122087000", "display_filter": "frame.number == 7990", "udp_stream": 81 }, { "frame_number": 7995, "timestamp_epoch": "1631317871.606825000", "display_filter": "frame.number == 7995", "tcp_stream": 123 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-c8d51120d618179f3b18d210", "type": "domain", "value": "f005cab8a8840abf6ab35152a071b205.clo.footprintdns.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1631315821.609487000", "last_seen_epoch": "1631315821.918599000", "evidence": [ { "frame_number": 578, "timestamp_epoch": "1631315821.609487000", "display_filter": "frame.number == 578", "udp_stream": 25 }, { "frame_number": 587, "timestamp_epoch": "1631315821.687583000", "display_filter": "frame.number == 587", "udp_stream": 25 }, { "frame_number": 714, "timestamp_epoch": "1631315821.918599000", "display_filter": "frame.number == 714", "tcp_stream": 29 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-e82b755cb5a87159ec60e60c", "type": "domain", "value": "fe2cr.update.microsoft.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1631316274.428472000", "last_seen_epoch": "1631316274.690592000", "evidence": [ { "frame_number": 3049, "timestamp_epoch": "1631316274.428472000", "display_filter": "frame.number == 3049", "udp_stream": 63 }, { "frame_number": 3050, "timestamp_epoch": "1631316274.505027000", "display_filter": "frame.number == 3050", "udp_stream": 63 }, { "frame_number": 3054, "timestamp_epoch": "1631316274.690592000", "display_filter": "frame.number == 3054", "tcp_stream": 90 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-d2e756bfa10db7849038b1e0", "type": "domain", "value": "fe2cr.update.microsoft.com.akadns.net", "roles": [ "dns-cname" ], "is_private": null, "first_seen_epoch": "1631316274.505027000", "last_seen_epoch": "1631316274.505027000", "evidence": [ { "frame_number": 3050, "timestamp_epoch": "1631316274.505027000", "display_filter": "frame.number == 3050", "udp_stream": 63 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-63d2f74e486266e508016bc1", "type": "domain", "value": "fe3cr.delivery.mp.microsoft.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1631316283.545802000", "last_seen_epoch": "1631316283.932448000", "evidence": [ { "frame_number": 4022, "timestamp_epoch": "1631316283.545802000", "display_filter": "frame.number == 4022", "udp_stream": 67 }, { "frame_number": 4023, "timestamp_epoch": "1631316283.633425000", "display_filter": "frame.number == 4023", "udp_stream": 67 }, { "frame_number": 4024, "timestamp_epoch": "1631316283.653453000", "display_filter": "frame.number == 4024", "udp_stream": 67 }, { "frame_number": 4028, "timestamp_epoch": "1631316283.932448000", "display_filter": "frame.number == 4028", "tcp_stream": 94 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-e07a99f2f07314ae903c57c8", "type": "domain", "value": "fp-afd.azureedge.us", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1631315821.790476000", "last_seen_epoch": "1631315822.087964000", "evidence": [ { "frame_number": 634, "timestamp_epoch": "1631315821.790476000", "display_filter": "frame.number == 634", "udp_stream": 38 }, { "frame_number": 706, "timestamp_epoch": "1631315821.887347000", "display_filter": "frame.number == 706", "udp_stream": 38 }, { "frame_number": 712, "timestamp_epoch": "1631315821.917378000", "display_filter": "frame.number == 712", "udp_stream": 38 }, { "frame_number": 870, "timestamp_epoch": "1631315822.087964000", "display_filter": "frame.number == 870", "tcp_stream": 42 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-077b50156a16019a69bd2352", "type": "domain", "value": "fp-afd.azurefd.us", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1631315821.618106000", "last_seen_epoch": "1631315826.308118000", "evidence": [ { "frame_number": 582, "timestamp_epoch": "1631315821.618106000", "display_filter": "frame.number == 582", "udp_stream": 28 }, { "frame_number": 605, "timestamp_epoch": "1631315821.718228000", "display_filter": "frame.number == 605", "udp_stream": 28 }, { "frame_number": 960, "timestamp_epoch": "1631315822.720072000", "display_filter": "frame.number == 960", "udp_stream": 28 }, { "frame_number": 1006, "timestamp_epoch": "1631315824.734259000", "display_filter": "frame.number == 1006", "udp_stream": 28 }, { "frame_number": 1007, "timestamp_epoch": "1631315825.758203000", "display_filter": "frame.number == 1007", "udp_stream": 28 }, { "frame_number": 1011, "timestamp_epoch": "1631315826.308118000", "display_filter": "frame.number == 1011", "tcp_stream": 44 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-347f02c6d78ecce95db1b180", "type": "domain", "value": "fp-vs-nocache.azureedge.net", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1631315821.707229000", "last_seen_epoch": "1631315821.860007000", "evidence": [ { "frame_number": 602, "timestamp_epoch": "1631315821.707229000", "display_filter": "frame.number == 602", "udp_stream": 34 }, { "frame_number": 625, "timestamp_epoch": "1631315821.777719000", "display_filter": "frame.number == 625", "udp_stream": 34 }, { "frame_number": 682, "timestamp_epoch": "1631315821.860007000", "display_filter": "frame.number == 682", "tcp_stream": 37 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-a3b8b48f3bf920f4afecf13b", "type": "domain", "value": "fp.msedge.net", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1631315821.787724000", "last_seen_epoch": "1631315821.944743000", "evidence": [ { "frame_number": 633, "timestamp_epoch": "1631315821.787724000", "display_filter": "frame.number == 633", "udp_stream": 37 }, { "frame_number": 672, "timestamp_epoch": "1631315821.856019000", "display_filter": "frame.number == 672", "udp_stream": 37 }, { "frame_number": 768, "timestamp_epoch": "1631315821.944743000", "display_filter": "frame.number == 768", "tcp_stream": 40 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-7d72c5faef53852f345d0636", "type": "domain", "value": "fs.microsoft.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1631315797.993791000", "last_seen_epoch": "1631315800.094805000", "evidence": [ { "frame_number": 218, "timestamp_epoch": "1631315797.993791000", "display_filter": "frame.number == 218", "udp_stream": 20 }, { "frame_number": 219, "timestamp_epoch": "1631315798.069599000", "display_filter": "frame.number == 219", "udp_stream": 20 }, { "frame_number": 223, "timestamp_epoch": "1631315798.694974000", "display_filter": "frame.number == 223", "tcp_stream": 8 }, { "frame_number": 244, "timestamp_epoch": "1631315799.393702000", "display_filter": "frame.number == 244", "tcp_stream": 9 }, { "frame_number": 264, "timestamp_epoch": "1631315800.094805000", "display_filter": "frame.number == 264", "tcp_stream": 10 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-884416f7c4b9826700ec8be3", "type": "domain", "value": "gameplayapi.intel.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1631315877.761881000", "last_seen_epoch": "1631315878.003403000", "evidence": [ { "frame_number": 2328, "timestamp_epoch": "1631315877.761881000", "display_filter": "frame.number == 2328", "udp_stream": 49 }, { "frame_number": 2329, "timestamp_epoch": "1631315877.846253000", "display_filter": "frame.number == 2329", "udp_stream": 49 }, { "frame_number": 2370, "timestamp_epoch": "1631315877.905601000", "display_filter": "frame.number == 2370", "udp_stream": 49 }, { "frame_number": 2457, "timestamp_epoch": "1631315878.003403000", "display_filter": "frame.number == 2457", "tcp_stream": 76 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-7919e3b969694cacd0b5ec4f", "type": "domain", "value": "geo.prod.do.dsp.mp.microsoft.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1631316286.101929000", "last_seen_epoch": "1631316286.544944000", "evidence": [ { "frame_number": 4096, "timestamp_epoch": "1631316286.101929000", "display_filter": "frame.number == 4096", "udp_stream": 69 }, { "frame_number": 4097, "timestamp_epoch": "1631316286.166797000", "display_filter": "frame.number == 4097", "udp_stream": 69 }, { "frame_number": 4107, "timestamp_epoch": "1631316286.544944000", "display_filter": "frame.number == 4107", "tcp_stream": 96 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-81a7f5fdb230723ccbaf8867", "type": "domain", "value": "k-ring.msedge.net", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1631315821.703853000", "last_seen_epoch": "1631315821.860644000", "evidence": [ { "frame_number": 600, "timestamp_epoch": "1631315821.703853000", "display_filter": "frame.number == 600", "udp_stream": 33 }, { "frame_number": 618, "timestamp_epoch": "1631315821.775735000", "display_filter": "frame.number == 618", "udp_stream": 33 }, { "frame_number": 684, "timestamp_epoch": "1631315821.860644000", "display_filter": "frame.number == 684", "tcp_stream": 35 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-3db66c1ff52053f1e7609a8f", "type": "domain", "value": "kv601.prod.do.dsp.mp.microsoft.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1631316286.985284000", "last_seen_epoch": "1631316287.389840000", "evidence": [ { "frame_number": 4123, "timestamp_epoch": "1631316286.985284000", "display_filter": "frame.number == 4123", "udp_stream": 70 }, { "frame_number": 4124, "timestamp_epoch": "1631316287.056993000", "display_filter": "frame.number == 4124", "udp_stream": 70 }, { "frame_number": 4131, "timestamp_epoch": "1631316287.389840000", "display_filter": "frame.number == 4131", "tcp_stream": 97 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-ff7b40ff9657611192470e99", "type": "domain", "value": "login.live.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1631315821.811473000", "last_seen_epoch": "1631318973.635253000", "evidence": [ { "frame_number": 642, "timestamp_epoch": "1631315821.811473000", "display_filter": "frame.number == 642", "udp_stream": 39 }, { "frame_number": 707, "timestamp_epoch": "1631315821.891636000", "display_filter": "frame.number == 707", "udp_stream": 39 }, { "frame_number": 3072, "timestamp_epoch": "1631316275.626673000", "display_filter": "frame.number == 3072", "udp_stream": 64 }, { "frame_number": 3073, "timestamp_epoch": "1631316275.712007000", "display_filter": "frame.number == 3073", "udp_stream": 64 }, { "frame_number": 8397, "timestamp_epoch": "1631318972.337134000", "display_filter": "frame.number == 8397", "udp_stream": 90 }, { "frame_number": 8398, "timestamp_epoch": "1631318972.424007000", "display_filter": "frame.number == 8398", "udp_stream": 90 }, { "frame_number": 8399, "timestamp_epoch": "1631318972.821081000", "display_filter": "frame.number == 8399", "udp_stream": 90 }, { "frame_number": 822, "timestamp_epoch": "1631315822.024638000", "display_filter": "frame.number == 822", "tcp_stream": 41 }, { "frame_number": 3082, "timestamp_epoch": "1631316275.893695000", "display_filter": "frame.number == 3082", "tcp_stream": 91 }, { "frame_number": 8403, "timestamp_epoch": "1631318973.635253000", "display_filter": "frame.number == 8403", "tcp_stream": 136 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-1ddd78114fc44bc3cc03e50a", "type": "domain", "value": "microsoft.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1631315851.802675000", "last_seen_epoch": "1631315852.122449000", "evidence": [ { "frame_number": 1478, "timestamp_epoch": "1631315851.802675000", "display_filter": "frame.number == 1478", "udp_stream": 44 }, { "frame_number": 1480, "timestamp_epoch": "1631315851.872188000", "display_filter": "frame.number == 1480", "udp_stream": 44 }, { "frame_number": 1486, "timestamp_epoch": "1631315852.122449000", "display_filter": "frame.number == 1486", "tcp_stream": 52 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-350afdece313e65777c029ba", "type": "domain", "value": "moiafdazure.clo.footprintdns.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1631315821.612358000", "last_seen_epoch": "1631315821.771792000", "evidence": [ { "frame_number": 579, "timestamp_epoch": "1631315821.612358000", "display_filter": "frame.number == 579", "udp_stream": 26 }, { "frame_number": 584, "timestamp_epoch": "1631315821.686441000", "display_filter": "frame.number == 584", "udp_stream": 26 }, { "frame_number": 613, "timestamp_epoch": "1631315821.771792000", "display_filter": "frame.number == 613", "tcp_stream": 28 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-b4b800dfed02251b37417c3d", "type": "domain", "value": "myexternalip.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1631315961.509438000", "last_seen_epoch": "1631315961.798195000", "evidence": [ { "frame_number": 2603, "timestamp_epoch": "1631315961.509438000", "display_filter": "frame.number == 2603", "udp_stream": 50 }, { "frame_number": 2604, "timestamp_epoch": "1631315961.580572000", "display_filter": "frame.number == 2604", "udp_stream": 50 }, { "frame_number": 2605, "timestamp_epoch": "1631315961.591549000", "display_filter": "frame.number == 2605", "udp_stream": 50 }, { "frame_number": 2606, "timestamp_epoch": "1631315961.591822000", "display_filter": "frame.number == 2606", "udp_stream": 50 }, { "frame_number": 2611, "timestamp_epoch": "1631315961.798195000", "display_filter": "frame.number == 2611", "tcp_stream": 78 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-2c39046891de8198da9d6e98", "type": "domain", "value": "nexus.officeapps.live.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1631315841.137786000", "last_seen_epoch": "1631320316.499210000", "evidence": [ { "frame_number": 2849, "timestamp_epoch": "1631315968.340842000", "display_filter": "frame.number == 2849", "udp_stream": 58 }, { "frame_number": 2853, "timestamp_epoch": "1631315968.428839000", "display_filter": "frame.number == 2853", "udp_stream": 58 }, { "frame_number": 2854, "timestamp_epoch": "1631315968.436452000", "display_filter": "frame.number == 2854", "udp_stream": 58 }, { "frame_number": 8178, "timestamp_epoch": "1631318516.031005000", "display_filter": "frame.number == 8178", "udp_stream": 86 }, { "frame_number": 8179, "timestamp_epoch": "1631318516.120081000", "display_filter": "frame.number == 8179", "udp_stream": 86 }, { "frame_number": 8180, "timestamp_epoch": "1631318517.132973000", "display_filter": "frame.number == 8180", "udp_stream": 86 }, { "frame_number": 8181, "timestamp_epoch": "1631318519.137285000", "display_filter": "frame.number == 8181", "udp_stream": 86 }, { "frame_number": 8182, "timestamp_epoch": "1631318520.437836000", "display_filter": "frame.number == 8182", "udp_stream": 86 }, { "frame_number": 9203, "timestamp_epoch": "1631320315.976739000", "display_filter": "frame.number == 9203", "udp_stream": 101 }, { "frame_number": 9204, "timestamp_epoch": "1631320316.054404000", "display_filter": "frame.number == 9204", "udp_stream": 101 }, { "frame_number": 1150, "timestamp_epoch": "1631315841.137786000", "display_filter": "frame.number == 1150", "tcp_stream": 48 }, { "frame_number": 2858, "timestamp_epoch": "1631315969.262219000", "display_filter": "frame.number == 2858", "tcp_stream": 83 }, { "frame_number": 8188, "timestamp_epoch": "1631318520.735515000", "display_filter": "frame.number == 8188", "tcp_stream": 129 }, { "frame_number": 9208, "timestamp_epoch": "1631320316.499210000", "display_filter": "frame.number == 9208", "tcp_stream": 160 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-39ed0699b3b1ded2b346fc68", "type": "domain", "value": "nexusrules.officeapps.live.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1631315842.541994000", "last_seen_epoch": "1631315970.664926000", "evidence": [ { "frame_number": 2875, "timestamp_epoch": "1631315969.871045000", "display_filter": "frame.number == 2875", "udp_stream": 59 }, { "frame_number": 2877, "timestamp_epoch": "1631315969.959548000", "display_filter": "frame.number == 2877", "udp_stream": 59 }, { "frame_number": 2878, "timestamp_epoch": "1631315969.971917000", "display_filter": "frame.number == 2878", "udp_stream": 59 }, { "frame_number": 1166, "timestamp_epoch": "1631315842.541994000", "display_filter": "frame.number == 1166", "tcp_stream": 49 }, { "frame_number": 2882, "timestamp_epoch": "1631315970.664926000", "display_filter": "frame.number == 2882", "tcp_stream": 84 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-a74b178d532e2e050bfd4b35", "type": "domain", "value": "office15client.microsoft.com", "roles": [ "dns-query" ], "is_private": null, "first_seen_epoch": "1631315840.425780000", "last_seen_epoch": "1631315968.236579000", "evidence": [ { "frame_number": 1143, "timestamp_epoch": "1631315840.425780000", "display_filter": "frame.number == 1143", "udp_stream": 41 }, { "frame_number": 1144, "timestamp_epoch": "1631315840.502907000", "display_filter": "frame.number == 1144", "udp_stream": 41 }, { "frame_number": 2833, "timestamp_epoch": "1631315968.071604000", "display_filter": "frame.number == 2833", "udp_stream": 56 }, { "frame_number": 2844, "timestamp_epoch": "1631315968.163473000", "display_filter": "frame.number == 2844", "udp_stream": 56 }, { "frame_number": 2845, "timestamp_epoch": "1631315968.236579000", "display_filter": "frame.number == 2845", "udp_stream": 56 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-5d43de3da2d2d59cfeca8a83", "type": "domain", "value": "prod-w.nexus.live.com.akadns.net", "roles": [ "dns-cname" ], "is_private": null, "first_seen_epoch": "1631315968.436452000", "last_seen_epoch": "1631320316.054404000", "evidence": [ { "frame_number": 2854, "timestamp_epoch": "1631315968.436452000", "display_filter": "frame.number == 2854", "udp_stream": 58 }, { "frame_number": 8182, "timestamp_epoch": "1631318520.437836000", "display_filter": "frame.number == 8182", "udp_stream": 86 }, { "frame_number": 9204, "timestamp_epoch": "1631320316.054404000", "display_filter": "frame.number == 9204", "udp_stream": 101 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-56099a5abb8ae73ad8f3a89f", "type": "domain", "value": "prod.nexusrules.live.com.akadns.net", "roles": [ "dns-cname" ], "is_private": null, "first_seen_epoch": "1631315969.971917000", "last_seen_epoch": "1631315969.971917000", "evidence": [ { "frame_number": 2878, "timestamp_epoch": "1631315969.971917000", "display_filter": "frame.number == 2878", "udp_stream": 59 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-4eef8b7782f91199ba0aa098", "type": "domain", "value": "q-ring.msedge.net", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1631315821.615606000", "last_seen_epoch": "1631315821.778069000", "evidence": [ { "frame_number": 581, "timestamp_epoch": "1631315821.615606000", "display_filter": "frame.number == 581", "udp_stream": 27 }, { "frame_number": 586, "timestamp_epoch": "1631315821.687509000", "display_filter": "frame.number == 586", "udp_stream": 27 }, { "frame_number": 628, "timestamp_epoch": "1631315821.778069000", "display_filter": "frame.number == 628", "tcp_stream": 30 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-83e312129270fcd7c2e9d34b", "type": "domain", "value": "s-ring.msedge.net", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1631315821.698728000", "last_seen_epoch": "1631315821.848001000", "evidence": [ { "frame_number": 597, "timestamp_epoch": "1631315821.698728000", "display_filter": "frame.number == 597", "udp_stream": 31 }, { "frame_number": 617, "timestamp_epoch": "1631315821.775660000", "display_filter": "frame.number == 617", "udp_stream": 31 }, { "frame_number": 657, "timestamp_epoch": "1631315821.848001000", "display_filter": "frame.number == 657", "tcp_stream": 34 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-8410481254ea78bfeeec52fa", "type": "domain", "value": "settings-win.data.microsoft.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1631315834.099848000", "last_seen_epoch": "1631318968.260301000", "evidence": [ { "frame_number": 1086, "timestamp_epoch": "1631315834.099848000", "display_filter": "frame.number == 1086", "udp_stream": 40 }, { "frame_number": 1087, "timestamp_epoch": "1631315834.189719000", "display_filter": "frame.number == 1087", "udp_stream": 40 }, { "frame_number": 1088, "timestamp_epoch": "1631315834.196449000", "display_filter": "frame.number == 1088", "udp_stream": 40 }, { "frame_number": 7445, "timestamp_epoch": "1631316322.221973000", "display_filter": "frame.number == 7445", "udp_stream": 76 }, { "frame_number": 7446, "timestamp_epoch": "1631316322.309220000", "display_filter": "frame.number == 7446", "udp_stream": 76 }, { "frame_number": 7447, "timestamp_epoch": "1631316323.324567000", "display_filter": "frame.number == 7447", "udp_stream": 76 }, { "frame_number": 7450, "timestamp_epoch": "1631316325.339628000", "display_filter": "frame.number == 7450", "udp_stream": 76 }, { "frame_number": 7451, "timestamp_epoch": "1631316326.556916000", "display_filter": "frame.number == 7451", "udp_stream": 76 }, { "frame_number": 8375, "timestamp_epoch": "1631318967.344045000", "display_filter": "frame.number == 8375", "udp_stream": 89 }, { "frame_number": 8376, "timestamp_epoch": "1631318967.344347000", "display_filter": "frame.number == 8376", "udp_stream": 89 }, { "frame_number": 1094, "timestamp_epoch": "1631315834.315747000", "display_filter": "frame.number == 1094", "tcp_stream": 45 }, { "frame_number": 1096, "timestamp_epoch": "1631315834.317832000", "display_filter": "frame.number == 1096", "tcp_stream": 46 }, { "frame_number": 1126, "timestamp_epoch": "1631315835.488085000", "display_filter": "frame.number == 1126", "tcp_stream": 47 }, { "frame_number": 7457, "timestamp_epoch": "1631316326.793867000", "display_filter": "frame.number == 7457", "tcp_stream": 107 }, { "frame_number": 7480, "timestamp_epoch": "1631316328.682953000", "display_filter": "frame.number == 7480", "tcp_stream": 108 }, { "frame_number": 7504, "timestamp_epoch": "1631316330.094014000", "display_filter": "frame.number == 7504", "tcp_stream": 109 }, { "frame_number": 7526, "timestamp_epoch": "1631316330.807884000", "display_filter": "frame.number == 7526", "tcp_stream": 110 }, { "frame_number": 8380, "timestamp_epoch": "1631318968.260301000", "display_filter": "frame.number == 8380", "tcp_stream": 135 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-944807b35e65323332fdd78c", "type": "domain", "value": "settingsfd-geo.trafficmanager.net", "roles": [ "dns-cname" ], "is_private": null, "first_seen_epoch": "1631315834.196449000", "last_seen_epoch": "1631318967.344347000", "evidence": [ { "frame_number": 1088, "timestamp_epoch": "1631315834.196449000", "display_filter": "frame.number == 1088", "udp_stream": 40 }, { "frame_number": 7451, "timestamp_epoch": "1631316326.556916000", "display_filter": "frame.number == 7451", "udp_stream": 76 }, { "frame_number": 8376, "timestamp_epoch": "1631318967.344347000", "display_filter": "frame.number == 8376", "udp_stream": 89 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-fed58a16404c6e5cc73ea7a6", "type": "domain", "value": "simpsonsavingss.com", "roles": [ "dns-query", "http-host" ], "is_private": null, "first_seen_epoch": "1631315847.020323000", "last_seen_epoch": "1631315847.822861000", "evidence": [ { "frame_number": 1180, "timestamp_epoch": "1631315847.020323000", "display_filter": "frame.number == 1180", "udp_stream": 43 }, { "frame_number": 1181, "timestamp_epoch": "1631315847.100529000", "display_filter": "frame.number == 1181", "udp_stream": 43 }, { "frame_number": 1182, "timestamp_epoch": "1631315847.253809000", "display_filter": "frame.number == 1182", "udp_stream": 43 }, { "frame_number": 1189, "timestamp_epoch": "1631315847.822861000", "display_filter": "frame.number == 1189", "tcp_stream": 50 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-0a2048041ca4f6ddeb45ef26", "type": "domain", "value": "slscr.update.microsoft.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1631316272.878633000", "last_seen_epoch": "1631316273.307528000", "evidence": [ { "frame_number": 3025, "timestamp_epoch": "1631316272.878633000", "display_filter": "frame.number == 3025", "udp_stream": 62 }, { "frame_number": 3026, "timestamp_epoch": "1631316272.958756000", "display_filter": "frame.number == 3026", "udp_stream": 62 }, { "frame_number": 3027, "timestamp_epoch": "1631316272.962978000", "display_filter": "frame.number == 3027", "udp_stream": 62 }, { "frame_number": 3031, "timestamp_epoch": "1631316273.307528000", "display_filter": "frame.number == 3031", "tcp_stream": 89 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-e1e5a2be9b8df24acde96c7c", "type": "domain", "value": "spo-ring.msedge.net", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1631315821.711728000", "last_seen_epoch": "1631315821.875754000", "evidence": [ { "frame_number": 604, "timestamp_epoch": "1631315821.711728000", "display_filter": "frame.number == 604", "udp_stream": 35 }, { "frame_number": 637, "timestamp_epoch": "1631315821.791996000", "display_filter": "frame.number == 637", "udp_stream": 35 }, { "frame_number": 700, "timestamp_epoch": "1631315821.875754000", "display_filter": "frame.number == 700", "tcp_stream": 38 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-3c59d54f0c68f7b095dff986", "type": "domain", "value": "store-images.s-microsoft.com", "roles": [ "dns-query", "http-host" ], "is_private": null, "first_seen_epoch": "1631315877.448892000", "last_seen_epoch": "1631315877.886858000", "evidence": [ { "frame_number": 2295, "timestamp_epoch": "1631315877.448892000", "display_filter": "frame.number == 2295", "udp_stream": 48 }, { "frame_number": 2305, "timestamp_epoch": "1631315877.533889000", "display_filter": "frame.number == 2305", "udp_stream": 48 }, { "frame_number": 2306, "timestamp_epoch": "1631315877.614309000", "display_filter": "frame.number == 2306", "udp_stream": 48 }, { "frame_number": 2316, "timestamp_epoch": "1631315877.719270000", "display_filter": "frame.number == 2316", "tcp_stream": 70 }, { "frame_number": 2317, "timestamp_epoch": "1631315877.719308000", "display_filter": "frame.number == 2317", "tcp_stream": 71 }, { "frame_number": 2324, "timestamp_epoch": "1631315877.730580000", "display_filter": "frame.number == 2324", "tcp_stream": 74 }, { "frame_number": 2325, "timestamp_epoch": "1631315877.731332000", "display_filter": "frame.number == 2325", "tcp_stream": 73 }, { "frame_number": 2327, "timestamp_epoch": "1631315877.731972000", "display_filter": "frame.number == 2327", "tcp_stream": 72 }, { "frame_number": 2353, "timestamp_epoch": "1631315877.886858000", "display_filter": "frame.number == 2353", "tcp_stream": 75 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-56a215c221aad93cbbd84e65", "type": "domain", "value": "storeedgefd.dsx.mp.microsoft.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1631315872.895782000", "last_seen_epoch": "1631315876.689581000", "evidence": [ { "frame_number": 1932, "timestamp_epoch": "1631315872.895782000", "display_filter": "frame.number == 1932", "udp_stream": 45 }, { "frame_number": 1933, "timestamp_epoch": "1631315872.987404000", "display_filter": "frame.number == 1933", "udp_stream": 45 }, { "frame_number": 1936, "timestamp_epoch": "1631315874.002873000", "display_filter": "frame.number == 1936", "udp_stream": 45 }, { "frame_number": 1945, "timestamp_epoch": "1631315876.005564000", "display_filter": "frame.number == 1945", "udp_stream": 45 }, { "frame_number": 1946, "timestamp_epoch": "1631315876.496286000", "display_filter": "frame.number == 1946", "udp_stream": 45 }, { "frame_number": 1969, "timestamp_epoch": "1631315876.688950000", "display_filter": "frame.number == 1969", "tcp_stream": 59 }, { "frame_number": 1970, "timestamp_epoch": "1631315876.688951000", "display_filter": "frame.number == 1970", "tcp_stream": 64 }, { "frame_number": 1971, "timestamp_epoch": "1631315876.688952000", "display_filter": "frame.number == 1971", "tcp_stream": 60 }, { "frame_number": 1972, "timestamp_epoch": "1631315876.689031000", "display_filter": "frame.number == 1972", "tcp_stream": 65 }, { "frame_number": 1973, "timestamp_epoch": "1631315876.689032000", "display_filter": "frame.number == 1973", "tcp_stream": 58 }, { "frame_number": 1974, "timestamp_epoch": "1631315876.689033000", "display_filter": "frame.number == 1974", "tcp_stream": 61 }, { "frame_number": 1977, "timestamp_epoch": "1631315876.689526000", "display_filter": "frame.number == 1977", "tcp_stream": 63 }, { "frame_number": 1978, "timestamp_epoch": "1631315876.689581000", "display_filter": "frame.number == 1978", "tcp_stream": 62 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-74b00d94c669ea98dba1242f", "type": "domain", "value": "t-ring.msedge.net", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1631315821.695636000", "last_seen_epoch": "1631315821.778012000", "evidence": [ { "frame_number": 595, "timestamp_epoch": "1631315821.695636000", "display_filter": "frame.number == 595", "udp_stream": 30 }, { "frame_number": 596, "timestamp_epoch": "1631315821.695989000", "display_filter": "frame.number == 596", "udp_stream": 30 }, { "frame_number": 627, "timestamp_epoch": "1631315821.778012000", "display_filter": "frame.number == 627", "tcp_stream": 32 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-88410897be6a6a550785f382", "type": "domain", "value": "teams-ring.msedge.net", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1631315821.701103000", "last_seen_epoch": "1631315821.860172000", "evidence": [ { "frame_number": 599, "timestamp_epoch": "1631315821.701103000", "display_filter": "frame.number == 599", "udp_stream": 32 }, { "frame_number": 619, "timestamp_epoch": "1631315821.775938000", "display_filter": "frame.number == 619", "udp_stream": 32 }, { "frame_number": 683, "timestamp_epoch": "1631315821.860172000", "display_filter": "frame.number == 683", "tcp_stream": 36 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-fde70bc995695abaa7d02a55", "type": "domain", "value": "update.googleapis.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1631318944.952875000", "last_seen_epoch": "1631318946.145996000", "evidence": [ { "frame_number": 8336, "timestamp_epoch": "1631318944.952875000", "display_filter": "frame.number == 8336", "udp_stream": 88 }, { "frame_number": 8337, "timestamp_epoch": "1631318945.033622000", "display_filter": "frame.number == 8337", "udp_stream": 88 }, { "frame_number": 8338, "timestamp_epoch": "1631318945.200916000", "display_filter": "frame.number == 8338", "udp_stream": 88 }, { "frame_number": 8342, "timestamp_epoch": "1631318946.145996000", "display_filter": "frame.number == 8342", "tcp_stream": 134 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-ae9dfa6e24e9b11762923f8e", "type": "domain", "value": "v10.events.data.microsoft.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1631316276.398273000", "last_seen_epoch": "1631319727.425336000", "evidence": [ { "frame_number": 3163, "timestamp_epoch": "1631316276.398273000", "display_filter": "frame.number == 3163", "udp_stream": 65 }, { "frame_number": 3165, "timestamp_epoch": "1631316276.467528000", "display_filter": "frame.number == 3165", "udp_stream": 65 }, { "frame_number": 4034, "timestamp_epoch": "1631316284.708888000", "display_filter": "frame.number == 4034", "udp_stream": 68 }, { "frame_number": 4044, "timestamp_epoch": "1631316284.787487000", "display_filter": "frame.number == 4044", "udp_stream": 68 }, { "frame_number": 5111, "timestamp_epoch": "1631316289.549810000", "display_filter": "frame.number == 5111", "udp_stream": 73 }, { "frame_number": 5113, "timestamp_epoch": "1631316289.550182000", "display_filter": "frame.number == 5113", "udp_stream": 73 }, { "frame_number": 7357, "timestamp_epoch": "1631316292.761763000", "display_filter": "frame.number == 7357", "udp_stream": 74 }, { "frame_number": 7358, "timestamp_epoch": "1631316292.832321000", "display_filter": "frame.number == 7358", "udp_stream": 74 }, { "frame_number": 7419, "timestamp_epoch": "1631316303.614050000", "display_filter": "frame.number == 7419", "udp_stream": 75 }, { "frame_number": 7420, "timestamp_epoch": "1631316303.686956000", "display_filter": "frame.number == 7420", "udp_stream": 75 }, { "frame_number": 7585, "timestamp_epoch": "1631316382.412743000", "display_filter": "frame.number == 7585", "udp_stream": 77 }, { "frame_number": 7586, "timestamp_epoch": "1631316382.488159000", "display_filter": "frame.number == 7586", "udp_stream": 77 }, { "frame_number": 8026, "timestamp_epoch": "1631317927.232039000", "display_filter": "frame.number == 8026", "udp_stream": 82 }, { "frame_number": 8027, "timestamp_epoch": "1631317927.318922000", "display_filter": "frame.number == 8027", "udp_stream": 82 }, { "frame_number": 8043, "timestamp_epoch": "1631317951.355779000", "display_filter": "frame.number == 8043", "udp_stream": 84 }, { "frame_number": 8044, "timestamp_epoch": "1631317951.431683000", "display_filter": "frame.number == 8044", "udp_stream": 84 }, { "frame_number": 8654, "timestamp_epoch": "1631319727.188018000", "display_filter": "frame.number == 8654", "udp_stream": 94 }, { "frame_number": 8655, "timestamp_epoch": "1631319727.265646000", "display_filter": "frame.number == 8655", "udp_stream": 94 }, { "frame_number": 3228, "timestamp_epoch": "1631316276.796295000", "display_filter": "frame.number == 3228", "tcp_stream": 92 }, { "frame_number": 4066, "timestamp_epoch": "1631316285.281343000", "display_filter": "frame.number == 4066", "tcp_stream": 95 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-4010c4dd16c3b4204679c6fb", "type": "domain", "value": "wpad.angrypoutine.com", "roles": [ "dns-query" ], "is_private": null, "first_seen_epoch": "1631315709.538659000", "last_seen_epoch": "1631319992.455953000", "evidence": [ { "frame_number": 18, "timestamp_epoch": "1631315709.538659000", "display_filter": "frame.number == 18", "udp_stream": 3 }, { "frame_number": 19, "timestamp_epoch": "1631315709.539026000", "display_filter": "frame.number == 19", "udp_stream": 3 }, { "frame_number": 63, "timestamp_epoch": "1631315714.217547000", "display_filter": "frame.number == 63", "udp_stream": 16 }, { "frame_number": 64, "timestamp_epoch": "1631315714.217859000", "display_filter": "frame.number == 64", "udp_stream": 16 }, { "frame_number": 133, "timestamp_epoch": "1631315732.216866000", "display_filter": "frame.number == 133", "udp_stream": 17 }, { "frame_number": 134, "timestamp_epoch": "1631315732.217241000", "display_filter": "frame.number == 134", "udp_stream": 17 }, { "frame_number": 167, "timestamp_epoch": "1631315792.232266000", "display_filter": "frame.number == 167", "udp_stream": 19 }, { "frame_number": 168, "timestamp_epoch": "1631315792.232631000", "display_filter": "frame.number == 168", "udp_stream": 19 }, { "frame_number": 7623, "timestamp_epoch": "1631316392.221436000", "display_filter": "frame.number == 7623", "udp_stream": 78 }, { "frame_number": 7624, "timestamp_epoch": "1631316392.221760000", "display_filter": "frame.number == 7624", "udp_stream": 78 }, { "frame_number": 7761, "timestamp_epoch": "1631316992.281374000", "display_filter": "frame.number == 7761", "udp_stream": 79 }, { "frame_number": 7762, "timestamp_epoch": "1631316992.281679000", "display_filter": "frame.number == 7762", "udp_stream": 79 }, { "frame_number": 7921, "timestamp_epoch": "1631317592.283598000", "display_filter": "frame.number == 7921", "udp_stream": 80 }, { "frame_number": 7922, "timestamp_epoch": "1631317592.283915000", "display_filter": "frame.number == 7922", "udp_stream": 80 }, { "frame_number": 8077, "timestamp_epoch": "1631318192.329739000", "display_filter": "frame.number == 8077", "udp_stream": 85 }, { "frame_number": 8078, "timestamp_epoch": "1631318192.330117000", "display_filter": "frame.number == 8078", "udp_stream": 85 }, { "frame_number": 8313, "timestamp_epoch": "1631318792.332434000", "display_filter": "frame.number == 8313", "udp_stream": 87 }, { "frame_number": 8314, "timestamp_epoch": "1631318792.332716000", "display_filter": "frame.number == 8314", "udp_stream": 87 }, { "frame_number": 8315, "timestamp_epoch": "1631318792.421558000", "display_filter": "frame.number == 8315", "udp_stream": 87 }, { "frame_number": 8316, "timestamp_epoch": "1631318792.421801000", "display_filter": "frame.number == 8316", "udp_stream": 87 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-d552d391523cb11ff6b6775a", "type": "domain", "value": "www.bing.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1631315821.607731000", "last_seen_epoch": "1631316926.532191000", "evidence": [ { "frame_number": 577, "timestamp_epoch": "1631315821.607731000", "display_filter": "frame.number == 577", "udp_stream": 24 }, { "frame_number": 590, "timestamp_epoch": "1631315821.689446000", "display_filter": "frame.number == 590", "udp_stream": 24 }, { "frame_number": 624, "timestamp_epoch": "1631315821.776922000", "display_filter": "frame.number == 624", "tcp_stream": 31 }, { "frame_number": 7746, "timestamp_epoch": "1631316926.532191000", "display_filter": "frame.number == 7746", "tcp_stream": 115 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-b8c71db4fcfb28b5b09fddc1", "type": "domain", "value": "www.microsoft.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1631315840.524648000", "last_seen_epoch": "1631315968.338242000", "evidence": [ { "frame_number": 1145, "timestamp_epoch": "1631315840.524648000", "display_filter": "frame.number == 1145", "udp_stream": 42 }, { "frame_number": 1146, "timestamp_epoch": "1631315840.596048000", "display_filter": "frame.number == 1146", "udp_stream": 42 }, { "frame_number": 2846, "timestamp_epoch": "1631315968.255718000", "display_filter": "frame.number == 2846", "udp_stream": 57 }, { "frame_number": 2847, "timestamp_epoch": "1631315968.335091000", "display_filter": "frame.number == 2847", "udp_stream": 57 }, { "frame_number": 2848, "timestamp_epoch": "1631315968.338242000", "display_filter": "frame.number == 2848", "udp_stream": 57 }, { "frame_number": 1546, "timestamp_epoch": "1631315853.754352000", "display_filter": "frame.number == 1546", "tcp_stream": 53 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-6db0665bf1eac4c589f8e998", "type": "domain", "value": "www.msftncsi.com", "roles": [ "dns-query", "http-host" ], "is_private": null, "first_seen_epoch": "1631315714.160252000", "last_seen_epoch": "1631315714.886095000", "evidence": [ { "frame_number": 62, "timestamp_epoch": "1631315714.160252000", "display_filter": "frame.number == 62", "udp_stream": 15 }, { "frame_number": 65, "timestamp_epoch": "1631315714.230509000", "display_filter": "frame.number == 65", "udp_stream": 15 }, { "frame_number": 75, "timestamp_epoch": "1631315714.886095000", "display_filter": "frame.number == 75", "tcp_stream": 0 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-52e23e99246c19f53b2db93c", "type": "ipv4", "value": "0.0.0.0", "roles": [ "network-endpoint" ], "is_private": true, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-0b9171a39e0b776680d73890", "type": "ipv4", "value": "10.9.10.102", "roles": [ "dns-answer", "network-endpoint" ], "is_private": true, "first_seen_epoch": "1631315709.550830000", "last_seen_epoch": "1631315709.551563000", "evidence": [ { "frame_number": 26, "timestamp_epoch": "1631315709.550830000", "display_filter": "frame.number == 26", "udp_stream": 5 }, { "frame_number": 30, "timestamp_epoch": "1631315709.551563000", "display_filter": "frame.number == 30", "udp_stream": 5 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-22a72104bd8dbd0bd77d2cee", "type": "ipv4", "value": "10.9.10.103", "roles": [ "dns-answer", "network-endpoint" ], "is_private": true, "first_seen_epoch": "1631315962.254530000", "last_seen_epoch": "1631315962.343828000", "evidence": [ { "frame_number": 2637, "timestamp_epoch": "1631315962.254530000", "display_filter": "frame.number == 2637", "udp_stream": 55 }, { "frame_number": 2639, "timestamp_epoch": "1631315962.343828000", "display_filter": "frame.number == 2639", "udp_stream": 55 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-29bbac5b2c72e813f7f3c4e9", "type": "ipv4", "value": "10.9.10.255", "roles": [ "network-endpoint" ], "is_private": true, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-0a83fe09bb876c6331358b2a", "type": "ipv4", "value": "10.9.10.9", "roles": [ "dns-answer", "network-endpoint" ], "is_private": true, "first_seen_epoch": "1631315709.547578000", "last_seen_epoch": "1631320086.126452000", "evidence": [ { "frame_number": 23, "timestamp_epoch": "1631315709.547578000", "display_filter": "frame.number == 23", "udp_stream": 4 }, { "frame_number": 40, "timestamp_epoch": "1631315711.019480000", "display_filter": "frame.number == 40", "udp_stream": 10 }, { "frame_number": 42, "timestamp_epoch": "1631315711.022428000", "display_filter": "frame.number == 42", "udp_stream": 11 }, { "frame_number": 45, "timestamp_epoch": "1631315711.117830000", "display_filter": "frame.number == 45", "udp_stream": 11 }, { "frame_number": 2015, "timestamp_epoch": "1631315876.832971000", "display_filter": "frame.number == 2015", "udp_stream": 46 }, { "frame_number": 2942, "timestamp_epoch": "1631316141.268718000", "display_filter": "frame.number == 2942", "udp_stream": 60 }, { "frame_number": 8534, "timestamp_epoch": "1631319346.875848000", "display_filter": "frame.number == 8534", "udp_stream": 92 }, { "frame_number": 8536, "timestamp_epoch": "1631319346.962976000", "display_filter": "frame.number == 8536", "udp_stream": 92 }, { "frame_number": 8682, "timestamp_epoch": "1631319740.662210000", "display_filter": "frame.number == 8682", "udp_stream": 95 }, { "frame_number": 8887, "timestamp_epoch": "1631320086.126452000", "display_filter": "frame.number == 8887", "udp_stream": 99 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-8e5453ea49c7c8cae2e5476c", "type": "ipv4", "value": "104.125.253.131", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1631316287.056993000", "last_seen_epoch": "1631316288.021439000", "evidence": [ { "frame_number": 4124, "timestamp_epoch": "1631316287.056993000", "display_filter": "frame.number == 4124", "udp_stream": 70 }, { "frame_number": 4159, "timestamp_epoch": "1631316288.021439000", "display_filter": "frame.number == 4159", "udp_stream": 71 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-35dfb737ee98c349822f936d", "type": "ipv4", "value": "104.215.148.63", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1631315851.872188000", "last_seen_epoch": "1631315851.872188000", "evidence": [ { "frame_number": 1480, "timestamp_epoch": "1631315851.872188000", "display_filter": "frame.number == 1480", "udp_stream": 44 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-081d9ff2e43802a81d077816", "type": "ipv4", "value": "104.46.162.226", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1631316276.467528000", "last_seen_epoch": "1631316289.550182000", "evidence": [ { "frame_number": 3165, "timestamp_epoch": "1631316276.467528000", "display_filter": "frame.number == 3165", "udp_stream": 65 }, { "frame_number": 4044, "timestamp_epoch": "1631316284.787487000", "display_filter": "frame.number == 4044", "udp_stream": 68 }, { "frame_number": 5113, "timestamp_epoch": "1631316289.550182000", "display_filter": "frame.number == 5113", "udp_stream": 73 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-c2d03e1ab1e54c3e2c1bd60b", "type": "ipv4", "value": "13.107.136.254", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1631315821.791996000", "last_seen_epoch": "1631315821.791996000", "evidence": [ { "frame_number": 637, "timestamp_epoch": "1631315821.791996000", "display_filter": "frame.number == 637", "udp_stream": 35 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-4455d05eb3611e8b84685e3d", "type": "ipv4", "value": "13.107.18.254", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1631315821.775735000", "last_seen_epoch": "1631315821.775735000", "evidence": [ { "frame_number": 618, "timestamp_epoch": "1631315821.775735000", "display_filter": "frame.number == 618", "udp_stream": 33 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-268a943393233334094ad626", "type": "ipv4", "value": "13.107.21.200", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1631315821.689446000", "last_seen_epoch": "1631315821.689446000", "evidence": [ { "frame_number": 590, "timestamp_epoch": "1631315821.689446000", "display_filter": "frame.number == 590", "udp_stream": 24 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-36ecba80138f2a068088fb5f", "type": "ipv4", "value": "13.107.246.254", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1631315821.686441000", "last_seen_epoch": "1631315821.695989000", "evidence": [ { "frame_number": 584, "timestamp_epoch": "1631315821.686441000", "display_filter": "frame.number == 584", "udp_stream": 26 }, { "frame_number": 596, "timestamp_epoch": "1631315821.695989000", "display_filter": "frame.number == 596", "udp_stream": 30 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-70e1543ca9bd6887923d363c", "type": "ipv4", "value": "13.107.3.254", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1631315821.775660000", "last_seen_epoch": "1631315821.775660000", "evidence": [ { "frame_number": 617, "timestamp_epoch": "1631315821.775660000", "display_filter": "frame.number == 617", "udp_stream": 31 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-09bfa871f17b737e5d9f0ffb", "type": "ipv4", "value": "13.107.49.254", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1631315821.687509000", "last_seen_epoch": "1631315821.687509000", "evidence": [ { "frame_number": 586, "timestamp_epoch": "1631315821.687509000", "display_filter": "frame.number == 586", "udp_stream": 27 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-fc7584e4a62fd97232a5031c", "type": "ipv4", "value": "13.107.5.88", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1631317871.122087000", "last_seen_epoch": "1631317871.122087000", "evidence": [ { "frame_number": 7990, "timestamp_epoch": "1631317871.122087000", "display_filter": "frame.number == 7990", "udp_stream": 81 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-bf6a3d452349e50ce91d8dff", "type": "ipv4", "value": "13.69.239.72", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1631317951.431683000", "last_seen_epoch": "1631317951.431683000", "evidence": [ { "frame_number": 8044, "timestamp_epoch": "1631317951.431683000", "display_filter": "frame.number == 8044", "udp_stream": 84 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-fdf5402b166ea0013490f6a4", "type": "ipv4", "value": "13.77.161.179", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1631315851.872188000", "last_seen_epoch": "1631315851.872188000", "evidence": [ { "frame_number": 1480, "timestamp_epoch": "1631315851.872188000", "display_filter": "frame.number == 1480", "udp_stream": 44 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-c372d505eec57ded83c18d23", "type": "ipv4", "value": "131.107.255.255", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1631317946.978854000", "last_seen_epoch": "1631317947.000885000", "evidence": [ { "frame_number": 8040, "timestamp_epoch": "1631317946.978854000", "display_filter": "frame.number == 8040", "udp_stream": 83 }, { "frame_number": 8042, "timestamp_epoch": "1631317947.000885000", "display_filter": "frame.number == 8042", "udp_stream": 83 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-441114a576e4a8a8f4a5f6b4", "type": "ipv4", "value": "167.172.37.9", "roles": [ "network-endpoint" ], "is_private": false, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-c47ae4befff620b4d7551ace", "type": "ipv4", "value": "169.254.181.227", "roles": [ "network-endpoint" ], "is_private": true, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-6436c3868216e20ef1320d55", "type": "ipv4", "value": "169.254.255.255", "roles": [ "network-endpoint" ], "is_private": true, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-77eeca4e6085206c2efbeadd", "type": "ipv4", "value": "172.217.168.195", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1631318945.200916000", "last_seen_epoch": "1631318945.200916000", "evidence": [ { "frame_number": 8338, "timestamp_epoch": "1631318945.200916000", "display_filter": "frame.number == 8338", "udp_stream": 88 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-86d5fbaf696817b949d22b45", "type": "ipv4", "value": "184.85.229.68", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1631315817.545292000", "last_seen_epoch": "1631315817.545292000", "evidence": [ { "frame_number": 511, "timestamp_epoch": "1631315817.545292000", "display_filter": "frame.number == 511", "udp_stream": 22 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-ca58f50741eb1a816128e19e", "type": "ipv4", "value": "194.62.42.206", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1631315847.253809000", "last_seen_epoch": "1631315847.253809000", "evidence": [ { "frame_number": 1182, "timestamp_epoch": "1631315847.253809000", "display_filter": "frame.number == 1182", "udp_stream": 43 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-0ad98b6389cd36d4834d3177", "type": "ipv4", "value": "20.140.48.71", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1631315821.917378000", "last_seen_epoch": "1631315825.758203000", "evidence": [ { "frame_number": 712, "timestamp_epoch": "1631315821.917378000", "display_filter": "frame.number == 712", "udp_stream": 38 }, { "frame_number": 1007, "timestamp_epoch": "1631315825.758203000", "display_filter": "frame.number == 1007", "udp_stream": 28 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-9b5fbcaed5c8544b8f341341", "type": "ipv4", "value": "20.189.173.7", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1631316382.488159000", "last_seen_epoch": "1631316382.488159000", "evidence": [ { "frame_number": 7586, "timestamp_epoch": "1631316382.488159000", "display_filter": "frame.number == 7586", "udp_stream": 77 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-04ad52aa4bbf62100ac48385", "type": "ipv4", "value": "20.190.151.131", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1631315821.891636000", "last_seen_epoch": "1631315821.891636000", "evidence": [ { "frame_number": 707, "timestamp_epoch": "1631315821.891636000", "display_filter": "frame.number == 707", "udp_stream": 39 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-4fd8d2e67f19cebe2155803f", "type": "ipv4", "value": "20.190.151.132", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1631315821.891636000", "last_seen_epoch": "1631315821.891636000", "evidence": [ { "frame_number": 707, "timestamp_epoch": "1631315821.891636000", "display_filter": "frame.number == 707", "udp_stream": 39 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-ed97f220a4e5e77df5deb50e", "type": "ipv4", "value": "20.190.151.133", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1631315821.891636000", "last_seen_epoch": "1631315821.891636000", "evidence": [ { "frame_number": 707, "timestamp_epoch": "1631315821.891636000", "display_filter": "frame.number == 707", "udp_stream": 39 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-5354d5b62a61748e14e6aaab", "type": "ipv4", "value": "20.190.151.134", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1631315821.891636000", "last_seen_epoch": "1631315821.891636000", "evidence": [ { "frame_number": 707, "timestamp_epoch": "1631315821.891636000", "display_filter": "frame.number == 707", "udp_stream": 39 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-76e423e0dcea7eadb978d1f2", "type": "ipv4", "value": "20.190.151.6", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1631315821.891636000", "last_seen_epoch": "1631315821.891636000", "evidence": [ { "frame_number": 707, "timestamp_epoch": "1631315821.891636000", "display_filter": "frame.number == 707", "udp_stream": 39 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-34fd946df3a2dddcb27b692a", "type": "ipv4", "value": "20.190.151.68", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1631315821.891636000", "last_seen_epoch": "1631315821.891636000", "evidence": [ { "frame_number": 707, "timestamp_epoch": "1631315821.891636000", "display_filter": "frame.number == 707", "udp_stream": 39 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-c01303d35dbeb70e488b9427", "type": "ipv4", "value": "20.190.151.69", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1631315821.891636000", "last_seen_epoch": "1631315821.891636000", "evidence": [ { "frame_number": 707, "timestamp_epoch": "1631315821.891636000", "display_filter": "frame.number == 707", "udp_stream": 39 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-dc6f60798aeb7552806656b6", "type": "ipv4", "value": "20.190.151.9", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1631315821.891636000", "last_seen_epoch": "1631315821.891636000", "evidence": [ { "frame_number": 707, "timestamp_epoch": "1631315821.891636000", "display_filter": "frame.number == 707", "udp_stream": 39 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-a0ec3de015fcacde1dd57bb7", "type": "ipv4", "value": "20.190.154.136", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1631316275.712007000", "last_seen_epoch": "1631318972.821081000", "evidence": [ { "frame_number": 3073, "timestamp_epoch": "1631316275.712007000", "display_filter": "frame.number == 3073", "udp_stream": 64 }, { "frame_number": 8399, "timestamp_epoch": "1631318972.821081000", "display_filter": "frame.number == 8399", "udp_stream": 90 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-aa8306058df708e4e9442489", "type": "ipv4", "value": "20.190.154.138", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1631316275.712007000", "last_seen_epoch": "1631318972.821081000", "evidence": [ { "frame_number": 3073, "timestamp_epoch": "1631316275.712007000", "display_filter": "frame.number == 3073", "udp_stream": 64 }, { "frame_number": 8399, "timestamp_epoch": "1631318972.821081000", "display_filter": "frame.number == 8399", "udp_stream": 90 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-d43effb5c04d4a3225eb2972", "type": "ipv4", "value": "20.190.154.139", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1631316275.712007000", "last_seen_epoch": "1631318972.821081000", "evidence": [ { "frame_number": 3073, "timestamp_epoch": "1631316275.712007000", "display_filter": "frame.number == 3073", "udp_stream": 64 }, { "frame_number": 8399, "timestamp_epoch": "1631318972.821081000", "display_filter": "frame.number == 8399", "udp_stream": 90 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-19722dd5ef7b89ff0d849367", "type": "ipv4", "value": "20.190.154.16", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1631316275.712007000", "last_seen_epoch": "1631318972.821081000", "evidence": [ { "frame_number": 3073, "timestamp_epoch": "1631316275.712007000", "display_filter": "frame.number == 3073", "udp_stream": 64 }, { "frame_number": 8399, "timestamp_epoch": "1631318972.821081000", "display_filter": "frame.number == 8399", "udp_stream": 90 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-3b53af7c033ca0600f8e0147", "type": "ipv4", "value": "20.190.154.17", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1631316275.712007000", "last_seen_epoch": "1631318972.821081000", "evidence": [ { "frame_number": 3073, "timestamp_epoch": "1631316275.712007000", "display_filter": "frame.number == 3073", "udp_stream": 64 }, { "frame_number": 8399, "timestamp_epoch": "1631318972.821081000", "display_filter": "frame.number == 8399", "udp_stream": 90 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-d41cd147aa682f51f1ce899a", "type": "ipv4", "value": "20.190.154.18", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1631316275.712007000", "last_seen_epoch": "1631318972.821081000", "evidence": [ { "frame_number": 3073, "timestamp_epoch": "1631316275.712007000", "display_filter": "frame.number == 3073", "udp_stream": 64 }, { "frame_number": 8399, "timestamp_epoch": "1631318972.821081000", "display_filter": "frame.number == 8399", "udp_stream": 90 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-499bb85a29f57cbbaa031d2a", "type": "ipv4", "value": "20.190.154.19", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1631318972.821081000", "last_seen_epoch": "1631318972.821081000", "evidence": [ { "frame_number": 8399, "timestamp_epoch": "1631318972.821081000", "display_filter": "frame.number == 8399", "udp_stream": 90 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-31fadcbfe1ceb2053138cc8f", "type": "ipv4", "value": "20.42.73.25", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1631319727.265646000", "last_seen_epoch": "1631319727.265646000", "evidence": [ { "frame_number": 8655, "timestamp_epoch": "1631319727.265646000", "display_filter": "frame.number == 8655", "udp_stream": 94 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-0f0b64f1469874fe39c91dc5", "type": "ipv4", "value": "20.50.73.10", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1631316292.832321000", "last_seen_epoch": "1631316303.686956000", "evidence": [ { "frame_number": 7358, "timestamp_epoch": "1631316292.832321000", "display_filter": "frame.number == 7358", "udp_stream": 74 }, { "frame_number": 7420, "timestamp_epoch": "1631316303.686956000", "display_filter": "frame.number == 7420", "udp_stream": 75 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-bc2204e8277ebc1da5bdf67e", "type": "ipv4", "value": "204.79.197.200", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1631315821.689446000", "last_seen_epoch": "1631315821.689446000", "evidence": [ { "frame_number": 590, "timestamp_epoch": "1631315821.689446000", "display_filter": "frame.number == 590", "udp_stream": 24 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-db44e28bd14bae5b5260f53b", "type": "ipv4", "value": "204.79.197.203", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1631315818.394540000", "last_seen_epoch": "1631315818.394540000", "evidence": [ { "frame_number": 556, "timestamp_epoch": "1631315818.394540000", "display_filter": "frame.number == 556", "udp_stream": 23 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-1ab663a879609d75412f0167", "type": "ipv4", "value": "204.79.197.222", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1631315821.856019000", "last_seen_epoch": "1631315821.856019000", "evidence": [ { "frame_number": 672, "timestamp_epoch": "1631315821.856019000", "display_filter": "frame.number == 672", "udp_stream": 37 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-6c9df93be0ae62e04bdb75e0", "type": "ipv4", "value": "204.79.197.254", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1631315821.855931000", "last_seen_epoch": "1631315821.855931000", "evidence": [ { "frame_number": 671, "timestamp_epoch": "1631315821.855931000", "display_filter": "frame.number == 671", "udp_stream": 36 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-866382c5ef0431ed32b21799", "type": "ipv4", "value": "224.0.0.22", "roles": [ "network-endpoint" ], "is_private": false, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-a3fd9b96075fd59b8468a8e8", "type": "ipv4", "value": "224.0.0.251", "roles": [ "network-endpoint" ], "is_private": false, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-9883a94a75d7f604cf821c6e", "type": "ipv4", "value": "224.0.0.252", "roles": [ "network-endpoint" ], "is_private": false, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-606809f0be31912a2c1e845c", "type": "ipv4", "value": "23.1.237.200", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1631316276.885401000", "last_seen_epoch": "1631319034.468756000", "evidence": [ { "frame_number": 3233, "timestamp_epoch": "1631316276.885401000", "display_filter": "frame.number == 3233", "udp_stream": 66 }, { "frame_number": 4187, "timestamp_epoch": "1631316288.685394000", "display_filter": "frame.number == 4187", "udp_stream": 72 }, { "frame_number": 8442, "timestamp_epoch": "1631319034.468756000", "display_filter": "frame.number == 8442", "udp_stream": 91 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-651179e4b433d80470756ba5", "type": "ipv4", "value": "23.1.237.201", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1631319034.468756000", "last_seen_epoch": "1631319034.468756000", "evidence": [ { "frame_number": 8442, "timestamp_epoch": "1631319034.468756000", "display_filter": "frame.number == 8442", "udp_stream": 91 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-ad1378c7c7087da4cf007295", "type": "ipv4", "value": "23.1.237.209", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1631316276.885401000", "last_seen_epoch": "1631316288.685394000", "evidence": [ { "frame_number": 3233, "timestamp_epoch": "1631316276.885401000", "display_filter": "frame.number == 3233", "udp_stream": 66 }, { "frame_number": 4187, "timestamp_epoch": "1631316288.685394000", "display_filter": "frame.number == 4187", "udp_stream": 72 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-111f6a447abcbfa64967cc14", "type": "ipv4", "value": "23.1.237.216", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1631316276.885401000", "last_seen_epoch": "1631316288.685394000", "evidence": [ { "frame_number": 3233, "timestamp_epoch": "1631316276.885401000", "display_filter": "frame.number == 3233", "udp_stream": 66 }, { "frame_number": 4187, "timestamp_epoch": "1631316288.685394000", "display_filter": "frame.number == 4187", "udp_stream": 72 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-140b75d041d9ce7521346807", "type": "ipv4", "value": "23.1.237.225", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1631316276.885401000", "last_seen_epoch": "1631316288.685394000", "evidence": [ { "frame_number": 3233, "timestamp_epoch": "1631316276.885401000", "display_filter": "frame.number == 3233", "udp_stream": 66 }, { "frame_number": 4187, "timestamp_epoch": "1631316288.685394000", "display_filter": "frame.number == 4187", "udp_stream": 72 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-f6852de26e78f2e38024f80b", "type": "ipv4", "value": "23.100.36.182", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1631315821.704192000", "last_seen_epoch": "1631315821.704192000", "evidence": [ { "frame_number": 601, "timestamp_epoch": "1631315821.704192000", "display_filter": "frame.number == 601", "udp_stream": 29 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-99d7cdf11d315b4614e5e883", "type": "ipv4", "value": "23.3.6.28", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1631315877.905601000", "last_seen_epoch": "1631315877.905601000", "evidence": [ { "frame_number": 2370, "timestamp_epoch": "1631315877.905601000", "display_filter": "frame.number == 2370", "udp_stream": 49 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-230eae467444b3f96041bd7c", "type": "ipv4", "value": "23.3.84.67", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1631315798.069599000", "last_seen_epoch": "1631315798.069599000", "evidence": [ { "frame_number": 219, "timestamp_epoch": "1631315798.069599000", "display_filter": "frame.number == 219", "udp_stream": 20 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-cdfdcf33d0e05cf98d9788df", "type": "ipv4", "value": "23.3.85.202", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1631315877.614309000", "last_seen_epoch": "1631315877.614309000", "evidence": [ { "frame_number": 2306, "timestamp_epoch": "1631315877.614309000", "display_filter": "frame.number == 2306", "udp_stream": 48 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-eafa7ad151834fcbde54195c", "type": "ipv4", "value": "23.3.85.234", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1631315840.596048000", "last_seen_epoch": "1631315968.338242000", "evidence": [ { "frame_number": 1146, "timestamp_epoch": "1631315840.596048000", "display_filter": "frame.number == 1146", "udp_stream": 42 }, { "frame_number": 2848, "timestamp_epoch": "1631315968.338242000", "display_filter": "frame.number == 2848", "udp_stream": 57 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-edad8daa7e53896b1a8e94a2", "type": "ipv4", "value": "23.3.86.10", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1631315876.496286000", "last_seen_epoch": "1631315876.496286000", "evidence": [ { "frame_number": 1946, "timestamp_epoch": "1631315876.496286000", "display_filter": "frame.number == 1946", "udp_stream": 45 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-2b0c6693ce06b686cce46a8d", "type": "ipv4", "value": "239.255.255.250", "roles": [ "http-host", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1631315709.778075000", "last_seen_epoch": "1631315798.880079000", "evidence": [ { "frame_number": 32, "timestamp_epoch": "1631315709.778075000", "display_filter": "frame.number == 32" }, { "frame_number": 56, "timestamp_epoch": "1631315712.778108000", "display_filter": "frame.number == 56" }, { "frame_number": 93, "timestamp_epoch": "1631315715.057664000", "display_filter": "frame.number == 93" }, { "frame_number": 106, "timestamp_epoch": "1631315715.781766000", "display_filter": "frame.number == 106" }, { "frame_number": 122, "timestamp_epoch": "1631315718.071278000", "display_filter": "frame.number == 122" }, { "frame_number": 124, "timestamp_epoch": "1631315718.794423000", "display_filter": "frame.number == 124" }, { "frame_number": 130, "timestamp_epoch": "1631315721.802832000", "display_filter": "frame.number == 130" }, { "frame_number": 169, "timestamp_epoch": "1631315792.881017000", "display_filter": "frame.number == 169" }, { "frame_number": 170, "timestamp_epoch": "1631315795.874381000", "display_filter": "frame.number == 170" }, { "frame_number": 234, "timestamp_epoch": "1631315798.880079000", "display_filter": "frame.number == 234" } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-2fbd01faf12625b058fa037e", "type": "ipv4", "value": "255.255.255.255", "roles": [ "network-endpoint" ], "is_private": true, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-ad1f0e89b8cab6a32268cda4", "type": "ipv4", "value": "34.117.59.81", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1631315961.580572000", "last_seen_epoch": "1631315961.591822000", "evidence": [ { "frame_number": 2604, "timestamp_epoch": "1631315961.580572000", "display_filter": "frame.number == 2604", "udp_stream": 50 }, { "frame_number": 2606, "timestamp_epoch": "1631315961.591822000", "display_filter": "frame.number == 2606", "udp_stream": 50 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-ce5a2a50c0c0022a0907f5d3", "type": "ipv4", "value": "40.112.72.205", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1631315851.872188000", "last_seen_epoch": "1631315851.872188000", "evidence": [ { "frame_number": 1480, "timestamp_epoch": "1631315851.872188000", "display_filter": "frame.number == 1480", "udp_stream": 44 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-70293659127d24bdbee4a721", "type": "ipv4", "value": "40.113.200.201", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1631315851.872188000", "last_seen_epoch": "1631315851.872188000", "evidence": [ { "frame_number": 1480, "timestamp_epoch": "1631315851.872188000", "display_filter": "frame.number == 1480", "udp_stream": 44 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-9d2ab062f51777ff39f68e66", "type": "ipv4", "value": "40.125.122.151", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1631316283.653453000", "last_seen_epoch": "1631316283.653453000", "evidence": [ { "frame_number": 4024, "timestamp_epoch": "1631316283.653453000", "display_filter": "frame.number == 4024", "udp_stream": 67 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-c7ecae5c99afd484271a12e3", "type": "ipv4", "value": "40.126.26.132", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1631316275.712007000", "last_seen_epoch": "1631316275.712007000", "evidence": [ { "frame_number": 3073, "timestamp_epoch": "1631316275.712007000", "display_filter": "frame.number == 3073", "udp_stream": 64 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-475616d90597b89e08c2fc10", "type": "ipv4", "value": "40.126.26.134", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1631316275.712007000", "last_seen_epoch": "1631316275.712007000", "evidence": [ { "frame_number": 3073, "timestamp_epoch": "1631316275.712007000", "display_filter": "frame.number == 3073", "udp_stream": 64 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-04d58f98998f8449a1b6b8ce", "type": "ipv4", "value": "40.126.26.135", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1631318972.821081000", "last_seen_epoch": "1631318972.821081000", "evidence": [ { "frame_number": 8399, "timestamp_epoch": "1631318972.821081000", "display_filter": "frame.number == 8399", "udp_stream": 90 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-e52cd20568e61c244580de53", "type": "ipv4", "value": "40.76.4.15", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1631315851.872188000", "last_seen_epoch": "1631315851.872188000", "evidence": [ { "frame_number": 1480, "timestamp_epoch": "1631315851.872188000", "display_filter": "frame.number == 1480", "udp_stream": 44 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-f6df0f157aaf579beaa95b1f", "type": "ipv4", "value": "40.83.240.146", "roles": [ "network-endpoint" ], "is_private": false, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-b0e2cb1c5d0788ae8db93dc7", "type": "ipv4", "value": "51.137.102.183", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1631315821.687583000", "last_seen_epoch": "1631315821.687583000", "evidence": [ { "frame_number": 587, "timestamp_epoch": "1631315821.687583000", "display_filter": "frame.number == 587", "udp_stream": 25 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-0e916023ae0f152505c46b68", "type": "ipv4", "value": "52.109.20.75", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1631315840.502907000", "last_seen_epoch": "1631315968.236579000", "evidence": [ { "frame_number": 1144, "timestamp_epoch": "1631315840.502907000", "display_filter": "frame.number == 1144", "udp_stream": 41 }, { "frame_number": 2845, "timestamp_epoch": "1631315968.236579000", "display_filter": "frame.number == 2845", "udp_stream": 56 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-3a9d4d865a191cd09ab06e5a", "type": "ipv4", "value": "52.109.76.32", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1631315969.971917000", "last_seen_epoch": "1631315969.971917000", "evidence": [ { "frame_number": 2878, "timestamp_epoch": "1631315969.971917000", "display_filter": "frame.number == 2878", "udp_stream": 59 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-320400b61fe154d6cc16d840", "type": "ipv4", "value": "52.109.76.36", "roles": [ "network-endpoint" ], "is_private": false, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-1b40b864223dd79d3feecace", "type": "ipv4", "value": "52.109.8.19", "roles": [ "network-endpoint" ], "is_private": false, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-bf931984c043ab52e1ce2602", "type": "ipv4", "value": "52.109.8.22", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1631315968.436452000", "last_seen_epoch": "1631318520.437836000", "evidence": [ { "frame_number": 2854, "timestamp_epoch": "1631315968.436452000", "display_filter": "frame.number == 2854", "udp_stream": 58 }, { "frame_number": 8182, "timestamp_epoch": "1631318520.437836000", "display_filter": "frame.number == 8182", "udp_stream": 86 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-5a7f1a48f4b1433fe7140fbb", "type": "ipv4", "value": "52.109.8.25", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1631320316.054404000", "last_seen_epoch": "1631320316.054404000", "evidence": [ { "frame_number": 9204, "timestamp_epoch": "1631320316.054404000", "display_filter": "frame.number == 9204", "udp_stream": 101 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-afe31ee0da7b3ed2882f79a5", "type": "ipv4", "value": "52.113.196.254", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1631315821.775938000", "last_seen_epoch": "1631315821.775938000", "evidence": [ { "frame_number": 619, "timestamp_epoch": "1631315821.775938000", "display_filter": "frame.number == 619", "udp_stream": 32 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-bd629f28101d0ded21e5a4b8", "type": "ipv4", "value": "52.137.106.217", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1631315834.196449000", "last_seen_epoch": "1631318967.344347000", "evidence": [ { "frame_number": 1088, "timestamp_epoch": "1631315834.196449000", "display_filter": "frame.number == 1088", "udp_stream": 40 }, { "frame_number": 7451, "timestamp_epoch": "1631316326.556916000", "display_filter": "frame.number == 7451", "udp_stream": 76 }, { "frame_number": 8376, "timestamp_epoch": "1631318967.344347000", "display_filter": "frame.number == 8376", "udp_stream": 89 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-275b5e45e4ceafa5c01b8b2d", "type": "ipv4", "value": "52.182.143.208", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1631317927.318922000", "last_seen_epoch": "1631317927.318922000", "evidence": [ { "frame_number": 8027, "timestamp_epoch": "1631317927.318922000", "display_filter": "frame.number == 8027", "udp_stream": 82 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-077a9abe5d63d1ed60dcaa32", "type": "ipv4", "value": "52.184.217.20", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1631316286.166797000", "last_seen_epoch": "1631316286.166797000", "evidence": [ { "frame_number": 4097, "timestamp_epoch": "1631316286.166797000", "display_filter": "frame.number == 4097", "udp_stream": 69 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-69a9ce7c9bf115af3b5d86c4", "type": "ipv4", "value": "52.238.248.6", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1631316274.505027000", "last_seen_epoch": "1631316274.505027000", "evidence": [ { "frame_number": 3050, "timestamp_epoch": "1631316274.505027000", "display_filter": "frame.number == 3050", "udp_stream": 63 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-19b1df3bef442a058303c201", "type": "ipv4", "value": "52.242.101.226", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1631316272.962978000", "last_seen_epoch": "1631316272.962978000", "evidence": [ { "frame_number": 3027, "timestamp_epoch": "1631316272.962978000", "display_filter": "frame.number == 3027", "udp_stream": 62 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-2df809168ad35e9c29cc1cd0", "type": "ipv4", "value": "52.242.97.97", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1631316283.653453000", "last_seen_epoch": "1631316283.653453000", "evidence": [ { "frame_number": 4024, "timestamp_epoch": "1631316283.653453000", "display_filter": "frame.number == 4024", "udp_stream": 67 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-52dc5cc1b83fbd977b13ca32", "type": "ipv4", "value": "72.21.81.200", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1631315821.777719000", "last_seen_epoch": "1631315821.777719000", "evidence": [ { "frame_number": 625, "timestamp_epoch": "1631315821.777719000", "display_filter": "frame.number == 625", "udp_stream": 34 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-3276e917ca07304786123be0", "type": "ipv4", "value": "94.158.245.52", "roles": [ "network-endpoint" ], "is_private": false, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-02472283613a7be76a9f3e6e", "type": "ipv4", "value": "96.17.68.66", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1631315714.230509000", "last_seen_epoch": "1631315714.230509000", "evidence": [ { "frame_number": 65, "timestamp_epoch": "1631315714.230509000", "display_filter": "frame.number == 65", "udp_stream": 15 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-f4544ea09615cb8aafbbaed8", "type": "ipv4", "value": "96.17.68.83", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1631315714.230509000", "last_seen_epoch": "1631315714.230509000", "evidence": [ { "frame_number": 65, "timestamp_epoch": "1631315714.230509000", "display_filter": "frame.number == 65", "udp_stream": 15 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-9de05f3a72b1c870db3bc6e8", "type": "ja3", "value": "28a2c9bd18a11de089ef85a160da29e4", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1631315798.694974000", "last_seen_epoch": "1631320316.499210000", "evidence": [ { "frame_number": 223, "timestamp_epoch": "1631315798.694974000", "display_filter": "frame.number == 223", "tcp_stream": 8 }, { "frame_number": 244, "timestamp_epoch": "1631315799.393702000", "display_filter": "frame.number == 244", "tcp_stream": 9 }, { "frame_number": 264, "timestamp_epoch": "1631315800.094805000", "display_filter": "frame.number == 264", "tcp_stream": 10 }, { "frame_number": 822, "timestamp_epoch": "1631315822.024638000", "display_filter": "frame.number == 822", "tcp_stream": 41 }, { "frame_number": 1096, "timestamp_epoch": "1631315834.317832000", "display_filter": "frame.number == 1096", "tcp_stream": 46 }, { "frame_number": 1486, "timestamp_epoch": "1631315852.122449000", "display_filter": "frame.number == 1486", "tcp_stream": 52 }, { "frame_number": 1546, "timestamp_epoch": "1631315853.754352000", "display_filter": "frame.number == 1546", "tcp_stream": 53 }, { "frame_number": 3031, "timestamp_epoch": "1631316273.307528000", "display_filter": "frame.number == 3031", "tcp_stream": 89 }, { "frame_number": 3054, "timestamp_epoch": "1631316274.690592000", "display_filter": "frame.number == 3054", "tcp_stream": 90 }, { "frame_number": 3082, "timestamp_epoch": "1631316275.893695000", "display_filter": "frame.number == 3082", "tcp_stream": 91 }, { "frame_number": 3228, "timestamp_epoch": "1631316276.796295000", "display_filter": "frame.number == 3228", "tcp_stream": 92 }, { "frame_number": 4028, "timestamp_epoch": "1631316283.932448000", "display_filter": "frame.number == 4028", "tcp_stream": 94 }, { "frame_number": 4066, "timestamp_epoch": "1631316285.281343000", "display_filter": "frame.number == 4066", "tcp_stream": 95 }, { "frame_number": 4107, "timestamp_epoch": "1631316286.544944000", "display_filter": "frame.number == 4107", "tcp_stream": 96 }, { "frame_number": 4131, "timestamp_epoch": "1631316287.389840000", "display_filter": "frame.number == 4131", "tcp_stream": 97 }, { "frame_number": 4146, "timestamp_epoch": "1631316287.718495000", "display_filter": "frame.number == 4146", "tcp_stream": 98 }, { "frame_number": 4163, "timestamp_epoch": "1631316288.173158000", "display_filter": "frame.number == 4163", "tcp_stream": 99 }, { "frame_number": 5741, "timestamp_epoch": "1631316289.984008000", "display_filter": "frame.number == 5741", "tcp_stream": 102 }, { "frame_number": 7362, "timestamp_epoch": "1631316293.107545000", "display_filter": "frame.number == 7362", "tcp_stream": 103 }, { "frame_number": 7425, "timestamp_epoch": "1631316303.946199000", "display_filter": "frame.number == 7425", "tcp_stream": 106 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-4b512fbdf2e57da79af367a0", "type": "ja3", "value": "37f463bf4616ecd445d4a1937da06e19", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1631315818.563237000", "last_seen_epoch": "1631315961.798195000", "evidence": [ { "frame_number": 560, "timestamp_epoch": "1631315818.563237000", "display_filter": "frame.number == 560", "tcp_stream": 26 }, { "frame_number": 2611, "timestamp_epoch": "1631315961.798195000", "display_filter": "frame.number == 2611", "tcp_stream": 78 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-d68e41677ce56da126e32549", "type": "ja3", "value": "3b5074b1b5d032e5620f69f9f700ff0e", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1631315715.609283000", "last_seen_epoch": "1631315878.003403000", "evidence": [ { "frame_number": 97, "timestamp_epoch": "1631315715.609283000", "display_filter": "frame.number == 97", "tcp_stream": 2 }, { "frame_number": 2457, "timestamp_epoch": "1631315878.003403000", "display_filter": "frame.number == 2457", "tcp_stream": 76 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-b8d0ba54453300c9b4424a80", "type": "ja3", "value": "51c64c77e60f3980eea90869b68c58a8", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1631315852.132689000", "last_seen_epoch": "1631320220.638845000", "evidence": [ { "frame_number": 1487, "timestamp_epoch": "1631315852.132689000", "display_filter": "frame.number == 1487", "tcp_stream": 51 }, { "frame_number": 1845, "timestamp_epoch": "1631315857.340404000", "display_filter": "frame.number == 1845", "tcp_stream": 54 }, { "frame_number": 1863, "timestamp_epoch": "1631315861.946297000", "display_filter": "frame.number == 1863", "tcp_stream": 55 }, { "frame_number": 1883, "timestamp_epoch": "1631315864.259420000", "display_filter": "frame.number == 1883", "tcp_stream": 56 }, { "frame_number": 1906, "timestamp_epoch": "1631315866.080548000", "display_filter": "frame.number == 1906", "tcp_stream": 57 }, { "frame_number": 2591, "timestamp_epoch": "1631315960.082826000", "display_filter": "frame.number == 2591", "tcp_stream": 77 }, { "frame_number": 2832, "timestamp_epoch": "1631315967.851208000", "display_filter": "frame.number == 2832", "tcp_stream": 82 }, { "frame_number": 7382, "timestamp_epoch": "1631316294.516983000", "display_filter": "frame.number == 7382", "tcp_stream": 104 }, { "frame_number": 7402, "timestamp_epoch": "1631316297.355750000", "display_filter": "frame.number == 7402", "tcp_stream": 105 }, { "frame_number": 7674, "timestamp_epoch": "1631316667.709165000", "display_filter": "frame.number == 7674", "tcp_stream": 113 }, { "frame_number": 7697, "timestamp_epoch": "1631316671.225931000", "display_filter": "frame.number == 7697", "tcp_stream": 114 }, { "frame_number": 7770, "timestamp_epoch": "1631317013.932371000", "display_filter": "frame.number == 7770", "tcp_stream": 116 }, { "frame_number": 7793, "timestamp_epoch": "1631317019.554089000", "display_filter": "frame.number == 7793", "tcp_stream": 117 }, { "frame_number": 7841, "timestamp_epoch": "1631317324.194424000", "display_filter": "frame.number == 7841", "tcp_stream": 118 }, { "frame_number": 7860, "timestamp_epoch": "1631317327.706122000", "display_filter": "frame.number == 7860", "tcp_stream": 119 }, { "frame_number": 7947, "timestamp_epoch": "1631317832.668825000", "display_filter": "frame.number == 7947", "tcp_stream": 121 }, { "frame_number": 7968, "timestamp_epoch": "1631317835.488335000", "display_filter": "frame.number == 7968", "tcp_stream": 122 }, { "frame_number": 8082, "timestamp_epoch": "1631318194.461483000", "display_filter": "frame.number == 8082", "tcp_stream": 126 }, { "frame_number": 8104, "timestamp_epoch": "1631318197.177106000", "display_filter": "frame.number == 8104", "tcp_stream": 127 }, { "frame_number": 8210, "timestamp_epoch": "1631318587.243185000", "display_filter": "frame.number == 8210", "tcp_stream": 130 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-13e6e938c35f3f044c3f1061", "type": "ja3", "value": "6271f898ce5be7dd52b0fc260d0662b3", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1631315821.695634000", "last_seen_epoch": "1631317871.606825000", "evidence": [ { "frame_number": 594, "timestamp_epoch": "1631315821.695634000", "display_filter": "frame.number == 594", "tcp_stream": 27 }, { "frame_number": 613, "timestamp_epoch": "1631315821.771792000", "display_filter": "frame.number == 613", "tcp_stream": 28 }, { "frame_number": 624, "timestamp_epoch": "1631315821.776922000", "display_filter": "frame.number == 624", "tcp_stream": 31 }, { "frame_number": 627, "timestamp_epoch": "1631315821.778012000", "display_filter": "frame.number == 627", "tcp_stream": 32 }, { "frame_number": 628, "timestamp_epoch": "1631315821.778069000", "display_filter": "frame.number == 628", "tcp_stream": 30 }, { "frame_number": 641, "timestamp_epoch": "1631315821.798138000", "display_filter": "frame.number == 641", "tcp_stream": 33 }, { "frame_number": 657, "timestamp_epoch": "1631315821.848001000", "display_filter": "frame.number == 657", "tcp_stream": 34 }, { "frame_number": 682, "timestamp_epoch": "1631315821.860007000", "display_filter": "frame.number == 682", "tcp_stream": 37 }, { "frame_number": 683, "timestamp_epoch": "1631315821.860172000", "display_filter": "frame.number == 683", "tcp_stream": 36 }, { "frame_number": 684, "timestamp_epoch": "1631315821.860644000", "display_filter": "frame.number == 684", "tcp_stream": 35 }, { "frame_number": 700, "timestamp_epoch": "1631315821.875754000", "display_filter": "frame.number == 700", "tcp_stream": 38 }, { "frame_number": 714, "timestamp_epoch": "1631315821.918599000", "display_filter": "frame.number == 714", "tcp_stream": 29 }, { "frame_number": 768, "timestamp_epoch": "1631315821.944743000", "display_filter": "frame.number == 768", "tcp_stream": 40 }, { "frame_number": 769, "timestamp_epoch": "1631315821.944764000", "display_filter": "frame.number == 769", "tcp_stream": 39 }, { "frame_number": 870, "timestamp_epoch": "1631315822.087964000", "display_filter": "frame.number == 870", "tcp_stream": 42 }, { "frame_number": 970, "timestamp_epoch": "1631315823.927190000", "display_filter": "frame.number == 970", "tcp_stream": 43 }, { "frame_number": 1011, "timestamp_epoch": "1631315826.308118000", "display_filter": "frame.number == 1011", "tcp_stream": 44 }, { "frame_number": 1969, "timestamp_epoch": "1631315876.688950000", "display_filter": "frame.number == 1969", "tcp_stream": 59 }, { "frame_number": 1970, "timestamp_epoch": "1631315876.688951000", "display_filter": "frame.number == 1970", "tcp_stream": 64 }, { "frame_number": 1971, "timestamp_epoch": "1631315876.688952000", "display_filter": "frame.number == 1971", "tcp_stream": 60 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-e1799d64fb7bbc92b3d5d7a4", "type": "ja3", "value": "a0e9f5d64349fb13191bc781f81f42e1", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1631315817.663508000", "last_seen_epoch": "1631315970.664926000", "evidence": [ { "frame_number": 518, "timestamp_epoch": "1631315817.663508000", "display_filter": "frame.number == 518", "tcp_stream": 25 }, { "frame_number": 519, "timestamp_epoch": "1631315817.663510000", "display_filter": "frame.number == 519", "tcp_stream": 24 }, { "frame_number": 1094, "timestamp_epoch": "1631315834.315747000", "display_filter": "frame.number == 1094", "tcp_stream": 45 }, { "frame_number": 1126, "timestamp_epoch": "1631315835.488085000", "display_filter": "frame.number == 1126", "tcp_stream": 47 }, { "frame_number": 1150, "timestamp_epoch": "1631315841.137786000", "display_filter": "frame.number == 1150", "tcp_stream": 48 }, { "frame_number": 1166, "timestamp_epoch": "1631315842.541994000", "display_filter": "frame.number == 1166", "tcp_stream": 49 }, { "frame_number": 2858, "timestamp_epoch": "1631315969.262219000", "display_filter": "frame.number == 2858", "tcp_stream": 83 }, { "frame_number": 2882, "timestamp_epoch": "1631315970.664926000", "display_filter": "frame.number == 2882", "tcp_stream": 84 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-82e894030244ff487e7c5904", "type": "sha256", "value": "0076eaec4990322f0ebf53a5a53997c1525f358dc28dd6b7e1cbffd9bd41a9a5", "roles": [ "exported-object" ], "is_private": null, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-243cf4a0357b594fe428ef57", "type": "sha256", "value": "01b57c485bc90409c12dfff1fcca905e8ee03a18958ebb8fb7f007d317c2e6fc", "roles": [ "exported-object" ], "is_private": null, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-eefcdab43c2f442e105b5a64", "type": "sha256", "value": "0550952e70d2e4e5ca28a8160e31cab6418ecb152915ec5dbfe88248d39fc2c7", "roles": [ "exported-object" ], "is_private": null, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-f9f7792207deec19a6c67373", "type": "sha256", "value": "07a1470ae3b863578779e025fc6009e6519e0f77325e7a94a426a58b7e408196", "roles": [ "exported-object" ], "is_private": null, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-edece16e32e0bc4eec3ad9db", "type": "sha256", "value": "0c58b13a7b5d78c8a9e35d5995b7352c3b38acee77d6af9886c3cf2d668bfd3c", "roles": [ "exported-object" ], "is_private": null, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-68254f08bb6c0eed789858c3", "type": "sha256", "value": "0f132c40ca33c057af0aed28534cd23b31ce36da1ad0cda3f2c2f1e03d646bca", "roles": [ "exported-object" ], "is_private": null, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-26a23fdfa20b17d047a6c82d", "type": "sha256", "value": "0fb4d47bcda9b77b0fbd8cb88b34ba180365991f6a376e00add1ac880b67fd8f", "roles": [ "exported-object" ], "is_private": null, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-8542c4d3acb4e96e76bd59ff", "type": "sha256", "value": "1127774b7710ffa8c9bd5d3182517be848d9373e8f4382f28f801ba9e44f80fb", "roles": [ "exported-object" ], "is_private": null, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-aef683f9f4a6e37522e4309a", "type": "sha256", "value": "153eec5b545f82f598d7728472073b1cdee325fc30cb7bc743c21d753610950d", "roles": [ "exported-object" ], "is_private": null, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-d0f371e2065e6ecffdfc02e7", "type": "sha256", "value": "1d48d9166408d8b8bf39f9557e4f8a57133c353567c55966ec2831a7bc230431", "roles": [ "exported-object" ], "is_private": null, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-4147ea94e66fbc702a8d5cb7", "type": "sha256", "value": "2972f477a28570de6c949fba237ace8c1bc2ea29b961b63aab3a57469e70cb51", "roles": [ "exported-object" ], "is_private": null, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-8aef3511940ea105f59104e9", "type": "sha256", "value": "2ac413d79efa22e42a179f0450d7e8e4bb8202c881bf9e02a5a13a9a3626d792", "roles": [ "exported-object" ], "is_private": null, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-4d7c27bc0ab5089ff28700c0", "type": "sha256", "value": "2cd96ea2a66b8bc4526b21c3744118b75f834d24739b04e2e7ceef21b8ad706f", "roles": [ "exported-object" ], "is_private": null, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-c371b40ea4c10fb522cd4143", "type": "sha256", "value": "3197375f525ce4d0d339e56b343ecd510ffc72dcfa250b1352f8bd6a02d49864", "roles": [ "exported-object" ], "is_private": null, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-1d95a63e3d05b55b90225f42", "type": "sha256", "value": "36d3e002691397fefd5287603499d03fd0d929ebc2d4b08ece3d9e8b74cb3219", "roles": [ "exported-object" ], "is_private": null, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-7f45fa74446aadb185c5f737", "type": "sha256", "value": "4839da5b25468809fbc7708652e77c4aa945e6735bf5c9119b3299653898ce34", "roles": [ "exported-object" ], "is_private": null, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-5596c3c854e22b2cf6632381", "type": "sha256", "value": "4a11107d730c5943885081bfc3e902af14e8e83f59d110979bb2af47e325c38e", "roles": [ "exported-object" ], "is_private": null, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-34382f238841ee212fb2d01f", "type": "sha256", "value": "4b03bfd94c00eecc15b41ef45adb7196c1bcfc942383b2ace3fac4a0423bdef4", "roles": [ "exported-object" ], "is_private": null, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-d7b326ee933ef7a30d58d295", "type": "sha256", "value": "6137f8db2192e638e13610f75e73b9247c05f4706f0afd1fdb132d86de6b4012", "roles": [ "exported-object" ], "is_private": null, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-c4cd44f8827b52b184eae523", "type": "sha256", "value": "6a115a372e460c1de12760689955740a891b6d1e3f97bbe7e667c93ee940150c", "roles": [ "exported-object" ], "is_private": null, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-2759338cf94a59b6340326bf", "type": "sha256", "value": "6c1eac65b98a81cd11abeaffe3fcf7f268e8788f733a0a8598b900201f05fc6d", "roles": [ "exported-object" ], "is_private": null, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-f423b5171d9b97226ca23df0", "type": "sha256", "value": "6db9e2137a8e7ebe66680ad4b9deeb17f7fc9f3103d9a1d9cde353f898de1bee", "roles": [ "exported-object" ], "is_private": null, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-5bedd188e3c33e2129180541", "type": "sha256", "value": "729388a4d1b0e06eb28c982bf4a2e9304937ad1a92932dfc76d822b441563b6d", "roles": [ "exported-object" ], "is_private": null, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-d879ea615f24670e85a69b44", "type": "sha256", "value": "809e5e4344a517b4f713aa55e03e2dc0c0d21cfa77ac2963e2e6e937e7d1264a", "roles": [ "exported-object" ], "is_private": null, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-4b99b3a1160697cc2802bbdf", "type": "sha256", "value": "80a71674cf8a71eaaf73c661d43ca1b69c4f393ccd603b89436812913fffb0f1", "roles": [ "exported-object" ], "is_private": null, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-0528d8023e27fad8dc1e1493", "type": "sha256", "value": "84520bc8bb4f129be41a7ab2a1ff1064efcd060d5521c2d5c23afd8710339411", "roles": [ "exported-object" ], "is_private": null, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-1a78f02f7a7c639eb8c8af4c", "type": "sha256", "value": "8529705a28a2cc8a6ac692e2f9a8cba5d6a3f44b81041270251389f1a017656c", "roles": [ "exported-object" ], "is_private": null, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-167fba03eba3f0bdf7a2303e", "type": "sha256", "value": "8eddb32e5ab1436d9cec5cbf730ad2a82d559730d69e35c534863d64d038d7c5", "roles": [ "exported-object" ], "is_private": null, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-9e42019fa230e3188baf695b", "type": "sha256", "value": "9b8db510ef42b8ed54a3712636fda55a4f8cfcd5493e20b74ab00cd4f3979f2d", "roles": [ "exported-object" ], "is_private": null, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-6bc3cc50e46466080db3e87a", "type": "sha256", "value": "9db86bb697c7b6a5f3ed228546c9cb8a7037901e61efe0b244ba38e7d9ad3886", "roles": [ "exported-object" ], "is_private": null, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-334f3770174f81fbb803a878", "type": "sha256", "value": "b4effa72b591f85bed1dd07d82d924b9423f5e58a26c62290d11a628768676e4", "roles": [ "exported-object" ], "is_private": null, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-27a3a642ebcf5b5804ca6af9", "type": "sha256", "value": "b80ed4f18c472ca7a6dd8dad53acc51a77e0ee0dc1fbadcc2e5d8e42efaa37fe", "roles": [ "exported-object" ], "is_private": null, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-ac64e5dfc25c21dfb962e99f", "type": "sha256", "value": "b96661475f79113a3685ff208a52c3dde1340f93a479011f027c7bd3859c5334", "roles": [ "exported-object" ], "is_private": null, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-3e4f394397bcc8216ccd0662", "type": "sha256", "value": "c1c72144b320890b971bf8cd335438dd6c2e50783398965e7891ccb30b4e3652", "roles": [ "exported-object" ], "is_private": null, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-b4cf5028b6ded6d8a70a3f9d", "type": "sha256", "value": "cb82f8b3153b5c172ae382d0cf92ca5373017dd09f98137bc3b06982115006d7", "roles": [ "exported-object" ], "is_private": null, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-4cc98338916583e4cb0ba5e2", "type": "sha256", "value": "d98626686f7c56a852f3d658d947d96137ecbcfed278bdc2bc6158239a7434a2", "roles": [ "exported-object" ], "is_private": null, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-c39952640a7b0cb4befd3422", "type": "sha256", "value": "dd3eb184a16f533fcce480c533d93846a6bb11138dc12468830115263490238d", "roles": [ "exported-object" ], "is_private": null, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-9a14b22812624147b6e70c89", "type": "sha256", "value": "e008608c81024ed297a07321b7c9ba9a00adac7cea71f24491af04b5e88f2f21", "roles": [ "exported-object" ], "is_private": null, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-320be0d0be5bcc1f9cb2f45d", "type": "sha256", "value": "e65eaf9faa6e7f3f0ce49c052a35be7cd5fed3ffc70b3f1ff7c213bee79f83fe", "roles": [ "exported-object" ], "is_private": null, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-1373f1576da52d013eb7d83e", "type": "sha256", "value": "e9132eaa61c1d06d76b82c27cffa7b6ba171f5e31fcec6fa78b03a7523f0f40a", "roles": [ "exported-object" ], "is_private": null, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-91fda6e37c1f879e4c67fa21", "type": "sha256", "value": "ea203eb1b56387cac02308b5aca040993e2d1c7fbd06413d41c957a726e4898f", "roles": [ "exported-object" ], "is_private": null, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-af750cfa8d5113ce12d452d4", "type": "sha256", "value": "eddbff1244adffc83452a0a77a9c25fb8eb31625f9d18203acde9fd85eaa7f74", "roles": [ "exported-object" ], "is_private": null, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-769d815b3fc7a70c6103ae74", "type": "sha256", "value": "eed363fc4af7a9070d69340592dcab7c78db4f90710357de29e3b624aa957cf8", "roles": [ "exported-object" ], "is_private": null, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-4afc544ca147c260b927b77c", "type": "sha256", "value": "f040d968ae5f0c4324a4e3fce10f7bfbc4370251aecb695f4a5f6c5af7a66aa7", "roles": [ "exported-object" ], "is_private": null, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-e2aa1383491af6949aca36ef", "type": "sha256", "value": "f7018b08490ebc04900ec28586710f3e93542ebe3ce390378e7f4e6665f28c43", "roles": [ "exported-object" ], "is_private": null, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-422e7b30baaa2155c295f8d2", "type": "url", "value": "http://239.255.255.250:1900*", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1631315709.778075000", "last_seen_epoch": "1631315798.880079000", "evidence": [ { "frame_number": 32, "timestamp_epoch": "1631315709.778075000", "display_filter": "frame.number == 32" }, { "frame_number": 56, "timestamp_epoch": "1631315712.778108000", "display_filter": "frame.number == 56" }, { "frame_number": 93, "timestamp_epoch": "1631315715.057664000", "display_filter": "frame.number == 93" }, { "frame_number": 106, "timestamp_epoch": "1631315715.781766000", "display_filter": "frame.number == 106" }, { "frame_number": 122, "timestamp_epoch": "1631315718.071278000", "display_filter": "frame.number == 122" }, { "frame_number": 124, "timestamp_epoch": "1631315718.794423000", "display_filter": "frame.number == 124" }, { "frame_number": 130, "timestamp_epoch": "1631315721.802832000", "display_filter": "frame.number == 130" }, { "frame_number": 169, "timestamp_epoch": "1631315792.881017000", "display_filter": "frame.number == 169" }, { "frame_number": 170, "timestamp_epoch": "1631315795.874381000", "display_filter": "frame.number == 170" }, { "frame_number": 234, "timestamp_epoch": "1631315798.880079000", "display_filter": "frame.number == 234" } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-712f808d603238cd5ec3eb8e", "type": "url", "value": "http://au.download.windowsupdate.com/d/msdownload/update/software/defu/2021/09/am_delta_patch_1.349.439.0_dcf977cccce1b58289d270f71f8151b3acc1566b.exe", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1631316288.773365000", "last_seen_epoch": "1631316290.377646000", "evidence": [ { "frame_number": 4193, "timestamp_epoch": "1631316288.773365000", "display_filter": "frame.number == 4193", "tcp_stream": 100 }, { "frame_number": 4195, "timestamp_epoch": "1631316288.774253000", "display_filter": "frame.number == 4195", "tcp_stream": 101 }, { "frame_number": 4200, "timestamp_epoch": "1631316288.853317000", "display_filter": "frame.number == 4200", "tcp_stream": 100 }, { "frame_number": 4201, "timestamp_epoch": "1631316288.853479000", "display_filter": "frame.number == 4201", "tcp_stream": 101 }, { "frame_number": 6371, "timestamp_epoch": "1631316290.377646000", "display_filter": "frame.number == 6371", "tcp_stream": 101 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-43ab92ffbce5a149c0909e23", "type": "url", "value": "http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?8afe60e61b27f828", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1631319034.703114000", "last_seen_epoch": "1631319034.703114000", "evidence": [ { "frame_number": 8446, "timestamp_epoch": "1631319034.703114000", "display_filter": "frame.number == 8446", "tcp_stream": 137 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-f3fcd46d8a18756a8f8b01b3", "type": "url", "value": "http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/pinrulesstl.cab?22c230ae05c29e0f", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1631319034.835713000", "last_seen_epoch": "1631319034.835713000", "evidence": [ { "frame_number": 8449, "timestamp_epoch": "1631319034.835713000", "display_filter": "frame.number == 8449", "tcp_stream": 137 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-8bce04c939835fcec47d7a8e", "type": "url", "value": "http://download.windowsupdate.com/c/msdownload/update/others/2021/09/35094710_046a1ec2fc584f3c2f6653542576b125ec45b91b.cab", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1631316277.503154000", "last_seen_epoch": "1631316277.503154000", "evidence": [ { "frame_number": 3294, "timestamp_epoch": "1631316277.503154000", "display_filter": "frame.number == 3294", "tcp_stream": 93 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-f66f5bd59db9225eeb2e953f", "type": "url", "value": "http://download.windowsupdate.com/c/msdownload/update/others/2021/09/35094711_e3993b23840c0d600179f647e9ac08158269c095.cab", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1631316277.422407000", "last_seen_epoch": "1631316277.422407000", "evidence": [ { "frame_number": 3284, "timestamp_epoch": "1631316277.422407000", "display_filter": "frame.number == 3284", "tcp_stream": 93 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-33a8eb7b6de55d743e01c220", "type": "url", "value": "http://download.windowsupdate.com/c/msdownload/update/others/2021/09/35094827_769ef074432ee9d2982132709c97d7a039b1441d.cab", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1631316278.843113000", "last_seen_epoch": "1631316278.843113000", "evidence": [ { "frame_number": 3448, "timestamp_epoch": "1631316278.843113000", "display_filter": "frame.number == 3448", "tcp_stream": 93 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-d570b1b3f79cfdcbf166df82", "type": "url", "value": "http://download.windowsupdate.com/c/msdownload/update/others/2021/09/35095041_d6fbe7dcab58bad491f97a8fb16f67acdd9c5880.cab", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1631316277.331910000", "last_seen_epoch": "1631316277.331910000", "evidence": [ { "frame_number": 3272, "timestamp_epoch": "1631316277.331910000", "display_filter": "frame.number == 3272", "tcp_stream": 93 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-f3cf601c83622952f88c59e2", "type": "url", "value": "http://download.windowsupdate.com/c/msdownload/update/others/2021/09/35095042_571a24bf1c59b2fc66012aba76936bc63860b918.cab", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1631316277.250235000", "last_seen_epoch": "1631316277.250235000", "evidence": [ { "frame_number": 3263, "timestamp_epoch": "1631316277.250235000", "display_filter": "frame.number == 3263", "tcp_stream": 93 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-ab1ddfa61f297ecec8c7f6c0", "type": "url", "value": "http://download.windowsupdate.com/c/msdownload/update/others/2021/09/35095158_9a369166024cd2046a41b3fcf5a7d5743d20b1f8.cab", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1631316278.755365000", "last_seen_epoch": "1631316278.755365000", "evidence": [ { "frame_number": 3435, "timestamp_epoch": "1631316278.755365000", "display_filter": "frame.number == 3435", "tcp_stream": 93 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-f73d48835e37934ff7d90e84", "type": "url", "value": "http://download.windowsupdate.com/c/msdownload/update/others/2021/09/35095401_461f0f3035a629e02f33b5439ab5d58c4e45c62f.cab", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1631316277.171165000", "last_seen_epoch": "1631316277.171165000", "evidence": [ { "frame_number": 3254, "timestamp_epoch": "1631316277.171165000", "display_filter": "frame.number == 3254", "tcp_stream": 93 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-3561ec6383d305c5a16ecf94", "type": "url", "value": "http://download.windowsupdate.com/c/msdownload/update/others/2021/09/35095402_3a3af9d09b295d5cad27c058b669144408fd1987.cab", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1631316277.088208000", "last_seen_epoch": "1631316277.088208000", "evidence": [ { "frame_number": 3241, "timestamp_epoch": "1631316277.088208000", "display_filter": "frame.number == 3241", "tcp_stream": 93 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-5f9a8d6c89c42a7111d87705", "type": "url", "value": "http://download.windowsupdate.com/c/msdownload/update/others/2021/09/35095511_08bd8b8ea97b82600094601b9451b7fa9b028927.cab", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1631316278.664748000", "last_seen_epoch": "1631316278.664748000", "evidence": [ { "frame_number": 3421, "timestamp_epoch": "1631316278.664748000", "display_filter": "frame.number == 3421", "tcp_stream": 93 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-43d957b6b6c406bb55234eaf", "type": "url", "value": "http://download.windowsupdate.com/c/msdownload/update/others/2021/09/35097431_5695ed6029065d034bdbaa6edef143ec73f43570.cab", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1631316281.715475000", "last_seen_epoch": "1631316281.715475000", "evidence": [ { "frame_number": 3898, "timestamp_epoch": "1631316281.715475000", "display_filter": "frame.number == 3898", "tcp_stream": 93 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-975c0fd4592ab1e38284c713", "type": "url", "value": "http://download.windowsupdate.com/c/msdownload/update/others/2021/09/35097432_b4cbace49a072b37958e15b9d3daadf28c89f361.cab", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1631316281.632651000", "last_seen_epoch": "1631316281.632651000", "evidence": [ { "frame_number": 3888, "timestamp_epoch": "1631316281.632651000", "display_filter": "frame.number == 3888", "tcp_stream": 93 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-250607d441b6ac5583f0a019", "type": "url", "value": "http://download.windowsupdate.com/c/msdownload/update/others/2021/09/35097541_59453a64ae1a0f59447d0c4e4bae68350827ad3f.cab", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1631316277.754272000", "last_seen_epoch": "1631316277.754272000", "evidence": [ { "frame_number": 3336, "timestamp_epoch": "1631316277.754272000", "display_filter": "frame.number == 3336", "tcp_stream": 93 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-4e4c8522a080eece07fb27f8", "type": "url", "value": "http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35095718_d6052d2a18efec5d0584f7d9db0c6df36c871e5e.cab", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1631316279.948828000", "last_seen_epoch": "1631316279.948828000", "evidence": [ { "frame_number": 3608, "timestamp_epoch": "1631316279.948828000", "display_filter": "frame.number == 3608", "tcp_stream": 93 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-a9b0c078ad35e02c909bc818", "type": "url", "value": "http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35095719_bb98167530418ae8aa387c077bca2d54e52a227b.cab", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1631316279.862456000", "last_seen_epoch": "1631316279.862456000", "evidence": [ { "frame_number": 3599, "timestamp_epoch": "1631316279.862456000", "display_filter": "frame.number == 3599", "tcp_stream": 93 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-5d0d6b555a2c338e2302236d", "type": "url", "value": "http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35095828_d42aac61fe6047b9b6b654db9d5c9ae957613125.cab", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1631316278.212132000", "last_seen_epoch": "1631316278.212132000", "evidence": [ { "frame_number": 3407, "timestamp_epoch": "1631316278.212132000", "display_filter": "frame.number == 3407", "tcp_stream": 93 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-ba3c4de33a56daffa162e3b5", "type": "url", "value": "http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35096071_6f89138c772d9cca2cda43656eecab96a5cd44fc.cab", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1631316279.787458000", "last_seen_epoch": "1631316279.787458000", "evidence": [ { "frame_number": 3590, "timestamp_epoch": "1631316279.787458000", "display_filter": "frame.number == 3590", "tcp_stream": 93 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-c95e953dc09094f84b5f47aa", "type": "url", "value": "http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35096072_5331372f4a198d80f7a5602f73259ff77d004730.cab", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1631316279.689712000", "last_seen_epoch": "1631316279.689712000", "evidence": [ { "frame_number": 3580, "timestamp_epoch": "1631316279.689712000", "display_filter": "frame.number == 3580", "tcp_stream": 93 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-ab7865496e79daf30cb6564d", "type": "url", "value": "http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35096188_49a74f42962e10ef9cfa9492f2c1955c24967958.cab", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1631316278.130092000", "last_seen_epoch": "1631316278.130092000", "evidence": [ { "frame_number": 3394, "timestamp_epoch": "1631316278.130092000", "display_filter": "frame.number == 3394", "tcp_stream": 93 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-ece437ddfe124c2bb4987427", "type": "url", "value": "http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35096401_980e49644362fb40897606d01fddd1ef79c6702a.cab", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1631316279.596839000", "last_seen_epoch": "1631316279.596839000", "evidence": [ { "frame_number": 3570, "timestamp_epoch": "1631316279.596839000", "display_filter": "frame.number == 3570", "tcp_stream": 93 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-08254d7504395ed7399106b1", "type": "url", "value": "http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35096402_83d0bc9d8970cab311753b171496293c4e0588b8.cab", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1631316279.506042000", "last_seen_epoch": "1631316279.506042000", "evidence": [ { "frame_number": 3560, "timestamp_epoch": "1631316279.506042000", "display_filter": "frame.number == 3560", "tcp_stream": 93 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-3d7979a774e296d9a794b73c", "type": "url", "value": "http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35096518_246960552fd8974bcfe0af13e362f8d00f0c6046.cab", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1631316278.041138000", "last_seen_epoch": "1631316278.041138000", "evidence": [ { "frame_number": 3381, "timestamp_epoch": "1631316278.041138000", "display_filter": "frame.number == 3381", "tcp_stream": 93 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-ceb94c63faf37b0f235449fc", "type": "url", "value": "http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35096747_f2ef0a3546df9b0fe01091e8cf6244c2b18ad27a.cab", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1631316280.730429000", "last_seen_epoch": "1631316280.730429000", "evidence": [ { "frame_number": 3739, "timestamp_epoch": "1631316280.730429000", "display_filter": "frame.number == 3739", "tcp_stream": 93 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-1ea38bf88eae5df42d975c6a", "type": "url", "value": "http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35096748_a533dd985a0175649c16855a9c628da8f21d78da.cab", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1631316280.648306000", "last_seen_epoch": "1631316280.648306000", "evidence": [ { "frame_number": 3730, "timestamp_epoch": "1631316280.648306000", "display_filter": "frame.number == 3730", "tcp_stream": 93 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-95c4883fe989423ddec242e6", "type": "url", "value": "http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35096864_51f3f34383a28a4d5d63528d9978515e66a6806e.cab", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1631316277.936391000", "last_seen_epoch": "1631316277.936391000", "evidence": [ { "frame_number": 3366, "timestamp_epoch": "1631316277.936391000", "display_filter": "frame.number == 3366", "tcp_stream": 93 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-441a9828575b3b0f238d549f", "type": "url", "value": "http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35097071_01580b64b700158e52507faa6223a4cb41c43f05.cab", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1631316280.553685000", "last_seen_epoch": "1631316280.553685000", "evidence": [ { "frame_number": 3721, "timestamp_epoch": "1631316280.553685000", "display_filter": "frame.number == 3721", "tcp_stream": 93 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-6541ac3852d12bbd6b278cf0", "type": "url", "value": "http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35097072_9c18abaa0dd4f3355c05cb1e0ac0d0a1da10552a.cab", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1631316280.475562000", "last_seen_epoch": "1631316280.475562000", "evidence": [ { "frame_number": 3712, "timestamp_epoch": "1631316280.475562000", "display_filter": "frame.number == 3712", "tcp_stream": 93 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-f57d16798c637d4b3193b781", "type": "url", "value": "http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35097188_47bf5b9e41cf731eeaf7b93672b38948c413df0b.cab", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1631316277.844148000", "last_seen_epoch": "1631316277.844148000", "evidence": [ { "frame_number": 3351, "timestamp_epoch": "1631316277.844148000", "display_filter": "frame.number == 3351", "tcp_stream": 93 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-857f5c78f9aaafd7aff1af96", "type": "url", "value": "http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35097759_f51781226900f2c3a24cac0d25d7e32ce4232b12.cab", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1631316281.553403000", "last_seen_epoch": "1631316281.553403000", "evidence": [ { "frame_number": 3878, "timestamp_epoch": "1631316281.553403000", "display_filter": "frame.number == 3878", "tcp_stream": 93 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-db124c3269fc8b3e0948b01e", "type": "url", "value": "http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35097760_94afc464b79c1922edc5d9f1aa46b8bbdafcac27.cab", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1631316281.470656000", "last_seen_epoch": "1631316281.470656000", "evidence": [ { "frame_number": 3868, "timestamp_epoch": "1631316281.470656000", "display_filter": "frame.number == 3868", "tcp_stream": 93 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-265e0152d2ad53e78b0bae89", "type": "url", "value": "http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35097869_11f02196bd92ebd3ff0745749654d98eb8ddd58c.cab", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1631316277.672274000", "last_seen_epoch": "1631316277.672274000", "evidence": [ { "frame_number": 3320, "timestamp_epoch": "1631316277.672274000", "display_filter": "frame.number == 3320", "tcp_stream": 93 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-2b0c862851637a9e163e5fd2", "type": "url", "value": "http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35098112_e6ce21ecdf7d899a6a8671574b68871ce853efe6.cab", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1631316281.384283000", "last_seen_epoch": "1631316281.384283000", "evidence": [ { "frame_number": 3858, "timestamp_epoch": "1631316281.384283000", "display_filter": "frame.number == 3858", "tcp_stream": 93 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-5f86c4b7d0abb6c5b4e71a20", "type": "url", "value": "http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35098113_ea9c1c8bf8003ad3b08ee004e09ae3bbf5fb1456.cab", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1631316281.299411000", "last_seen_epoch": "1631316281.299411000", "evidence": [ { "frame_number": 3849, "timestamp_epoch": "1631316281.299411000", "display_filter": "frame.number == 3849", "tcp_stream": 93 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-b200b728a1d137446a36b3a7", "type": "url", "value": "http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35098229_d9a668acd9af16621c688b823ada2c10de963ca4.cab", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1631316277.580403000", "last_seen_epoch": "1631316277.580403000", "evidence": [ { "frame_number": 3303, "timestamp_epoch": "1631316277.580403000", "display_filter": "frame.number == 3303", "tcp_stream": 93 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-04ef7931b27df86e338c0063", "type": "url", "value": "http://simpsonsavingss.com/bmdff/BhoHsCtZ/MLdmpfjaX/5uFG3Dz7yt/date1?BNLv65=pAAS", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1631315847.822861000", "last_seen_epoch": "1631315847.822861000", "evidence": [ { "frame_number": 1189, "timestamp_epoch": "1631315847.822861000", "display_filter": "frame.number == 1189", "tcp_stream": 50 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-068d9902b0718b5cebbe679e", "type": "url", "value": "http://store-images.s-microsoft.com/image/apps.11608.14255546098955437.c2922c50-eb00-4f80-b393-4e513d9f81c7.4345eb8f-f893-40a2-aec5-20f4758af165?w=150&h=150", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1631315877.731332000", "last_seen_epoch": "1631315877.731332000", "evidence": [ { "frame_number": 2325, "timestamp_epoch": "1631315877.731332000", "display_filter": "frame.number == 2325", "tcp_stream": 73 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-13bb87af62958e4d14e8cbc7", "type": "url", "value": "http://store-images.s-microsoft.com/image/apps.16525.14618985536919905.4b30e4f3-f7a1-4421-840c-2cc97b10e8e0.13409c3f-0e0f-40dd-b458-b324f658c185?w=150&h=150", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1631315877.719308000", "last_seen_epoch": "1631315877.719308000", "evidence": [ { "frame_number": 2317, "timestamp_epoch": "1631315877.719308000", "display_filter": "frame.number == 2317", "tcp_stream": 71 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-b956bb2405270f1ad13402d9", "type": "url", "value": "http://store-images.s-microsoft.com/image/apps.16999.13510798885065391.a43a9782-6060-4560-b391-7f6f188559d0.dc15b6ee-644d-41e3-8d76-67c8c9dac9e9?w=150&h=225", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1631315877.886858000", "last_seen_epoch": "1631315877.886858000", "evidence": [ { "frame_number": 2353, "timestamp_epoch": "1631315877.886858000", "display_filter": "frame.number == 2353", "tcp_stream": 75 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-a19fb0b0f03a21777e6d0aff", "type": "url", "value": "http://store-images.s-microsoft.com/image/apps.28261.13798539581762600.abe1643f-1704-4a4d-a61b-47ccc25da012.ada314ec-db8e-49bb-a756-60487526418e?w=150&h=150", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1631315877.719270000", "last_seen_epoch": "1631315877.719270000", "evidence": [ { "frame_number": 2316, "timestamp_epoch": "1631315877.719270000", "display_filter": "frame.number == 2316", "tcp_stream": 70 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-2e52513eaaa6835f07f43503", "type": "url", "value": "http://store-images.s-microsoft.com/image/apps.31617.13655054093851568.f2bf9430-60d7-4569-a50d-0f21c9ade6b3.c563d383-997d-4da1-9def-d7200e3547f8?w=150&h=150", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1631315877.730580000", "last_seen_epoch": "1631315877.730580000", "evidence": [ { "frame_number": 2324, "timestamp_epoch": "1631315877.730580000", "display_filter": "frame.number == 2324", "tcp_stream": 74 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-0d9863800c46352bd820344d", "type": "url", "value": "http://store-images.s-microsoft.com/image/apps.40518.14127333176902609.7be7b901-15fe-4c27-863c-7c0dbfc26c5c.5c278f58-912b-4af9-88f8-a65fff2da477?w=150&h=150", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1631315877.731972000", "last_seen_epoch": "1631315877.731972000", "evidence": [ { "frame_number": 2327, "timestamp_epoch": "1631315877.731972000", "display_filter": "frame.number == 2327", "tcp_stream": 72 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-ebbb30b621fc99df7b02cdf8", "type": "url", "value": "http://www.msftncsi.com/ncsi.txt", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1631315714.886095000", "last_seen_epoch": "1631315714.886095000", "evidence": [ { "frame_number": 75, "timestamp_epoch": "1631315714.886095000", "display_filter": "frame.number == 75", "tcp_stream": 0 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-5c65f812c736a5148ac3d9af", "type": "user_agent", "value": "Microsoft NCSI", "roles": [ "http-client" ], "is_private": null, "first_seen_epoch": "1631315714.886095000", "last_seen_epoch": "1631315714.886095000", "evidence": [ { "frame_number": 75, "timestamp_epoch": "1631315714.886095000", "display_filter": "frame.number == 75", "tcp_stream": 0 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-bbc17e9b7b17239bf072cc25", "type": "user_agent", "value": "Microsoft-CryptoAPI/10.0", "roles": [ "http-client" ], "is_private": null, "first_seen_epoch": "1631319034.703114000", "last_seen_epoch": "1631319034.835713000", "evidence": [ { "frame_number": 8446, "timestamp_epoch": "1631319034.703114000", "display_filter": "frame.number == 8446", "tcp_stream": 137 }, { "frame_number": 8449, "timestamp_epoch": "1631319034.835713000", "display_filter": "frame.number == 8449", "tcp_stream": 137 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-9340716e7a80c2e8535f7c1d", "type": "user_agent", "value": "Microsoft-Delivery-Optimization/10.0", "roles": [ "http-client" ], "is_private": null, "first_seen_epoch": "1631316288.773365000", "last_seen_epoch": "1631316290.377646000", "evidence": [ { "frame_number": 4193, "timestamp_epoch": "1631316288.773365000", "display_filter": "frame.number == 4193", "tcp_stream": 100 }, { "frame_number": 4195, "timestamp_epoch": "1631316288.774253000", "display_filter": "frame.number == 4195", "tcp_stream": 101 }, { "frame_number": 4200, "timestamp_epoch": "1631316288.853317000", "display_filter": "frame.number == 4200", "tcp_stream": 100 }, { "frame_number": 4201, "timestamp_epoch": "1631316288.853479000", "display_filter": "frame.number == 4201", "tcp_stream": 101 }, { "frame_number": 6371, "timestamp_epoch": "1631316290.377646000", "display_filter": "frame.number == 6371", "tcp_stream": 101 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-52eaa68fc9c1be966dd630f9", "type": "user_agent", "value": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)", "roles": [ "http-client" ], "is_private": null, "first_seen_epoch": "1631315847.822861000", "last_seen_epoch": "1631315847.822861000", "evidence": [ { "frame_number": 1189, "timestamp_epoch": "1631315847.822861000", "display_filter": "frame.number == 1189", "tcp_stream": 50 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-253ce8ddacd723c28ec02274", "type": "user_agent", "value": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19043", "roles": [ "http-client" ], "is_private": null, "first_seen_epoch": "1631315877.719270000", "last_seen_epoch": "1631315877.886858000", "evidence": [ { "frame_number": 2316, "timestamp_epoch": "1631315877.719270000", "display_filter": "frame.number == 2316", "tcp_stream": 70 }, { "frame_number": 2317, "timestamp_epoch": "1631315877.719308000", "display_filter": "frame.number == 2317", "tcp_stream": 71 }, { "frame_number": 2324, "timestamp_epoch": "1631315877.730580000", "display_filter": "frame.number == 2324", "tcp_stream": 74 }, { "frame_number": 2325, "timestamp_epoch": "1631315877.731332000", "display_filter": "frame.number == 2325", "tcp_stream": 73 }, { "frame_number": 2327, "timestamp_epoch": "1631315877.731972000", "display_filter": "frame.number == 2327", "tcp_stream": 72 }, { "frame_number": 2353, "timestamp_epoch": "1631315877.886858000", "display_filter": "frame.number == 2353", "tcp_stream": 75 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-e3e44cdd8e2f80d5d69c232f", "type": "user_agent", "value": "Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.32", "roles": [ "http-client" ], "is_private": null, "first_seen_epoch": "1631316277.088208000", "last_seen_epoch": "1631316281.715475000", "evidence": [ { "frame_number": 3241, "timestamp_epoch": "1631316277.088208000", "display_filter": "frame.number == 3241", "tcp_stream": 93 }, { "frame_number": 3254, "timestamp_epoch": "1631316277.171165000", "display_filter": "frame.number == 3254", "tcp_stream": 93 }, { "frame_number": 3263, "timestamp_epoch": "1631316277.250235000", "display_filter": "frame.number == 3263", "tcp_stream": 93 }, { "frame_number": 3272, "timestamp_epoch": "1631316277.331910000", "display_filter": "frame.number == 3272", "tcp_stream": 93 }, { "frame_number": 3284, "timestamp_epoch": "1631316277.422407000", "display_filter": "frame.number == 3284", "tcp_stream": 93 }, { "frame_number": 3294, "timestamp_epoch": "1631316277.503154000", "display_filter": "frame.number == 3294", "tcp_stream": 93 }, { "frame_number": 3303, "timestamp_epoch": "1631316277.580403000", "display_filter": "frame.number == 3303", "tcp_stream": 93 }, { "frame_number": 3320, "timestamp_epoch": "1631316277.672274000", "display_filter": "frame.number == 3320", "tcp_stream": 93 }, { "frame_number": 3336, "timestamp_epoch": "1631316277.754272000", "display_filter": "frame.number == 3336", "tcp_stream": 93 }, { "frame_number": 3351, "timestamp_epoch": "1631316277.844148000", "display_filter": "frame.number == 3351", "tcp_stream": 93 }, { "frame_number": 3366, "timestamp_epoch": "1631316277.936391000", "display_filter": "frame.number == 3366", "tcp_stream": 93 }, { "frame_number": 3381, "timestamp_epoch": "1631316278.041138000", "display_filter": "frame.number == 3381", "tcp_stream": 93 }, { "frame_number": 3394, "timestamp_epoch": "1631316278.130092000", "display_filter": "frame.number == 3394", "tcp_stream": 93 }, { "frame_number": 3407, "timestamp_epoch": "1631316278.212132000", "display_filter": "frame.number == 3407", "tcp_stream": 93 }, { "frame_number": 3421, "timestamp_epoch": "1631316278.664748000", "display_filter": "frame.number == 3421", "tcp_stream": 93 }, { "frame_number": 3435, "timestamp_epoch": "1631316278.755365000", "display_filter": "frame.number == 3435", "tcp_stream": 93 }, { "frame_number": 3448, "timestamp_epoch": "1631316278.843113000", "display_filter": "frame.number == 3448", "tcp_stream": 93 }, { "frame_number": 3560, "timestamp_epoch": "1631316279.506042000", "display_filter": "frame.number == 3560", "tcp_stream": 93 }, { "frame_number": 3570, "timestamp_epoch": "1631316279.596839000", "display_filter": "frame.number == 3570", "tcp_stream": 93 }, { "frame_number": 3580, "timestamp_epoch": "1631316279.689712000", "display_filter": "frame.number == 3580", "tcp_stream": 93 } ], "enrichment_state": "not_requested" } ], "findings": [ { "finding_id": "finding-888e9c1168af2bb2521c2e9a", "rule_id": "script-or-executable-transfer", "rule_version": "pcap-rules-v3", "severity": "medium", "title": "Script, archive, or executable transfer candidate", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "confidence": 0.86, "status": "candidate", "evidence": [ { "frame_number": 4193, "timestamp_epoch": "1631316288.773365000", "display_filter": "frame.number == 4193", "tcp_stream": 100 }, { "frame_number": 4198, "timestamp_epoch": "1631316288.847386000", "display_filter": "frame.number == 4198", "tcp_stream": 100 }, { "frame_number": 4200, "timestamp_epoch": "1631316288.853317000", "display_filter": "frame.number == 4200", "tcp_stream": 100 }, { "frame_number": 6404, "timestamp_epoch": "1631316290.461273000", "display_filter": "frame.number == 6404", "tcp_stream": 100 } ], "metrics": { "response_count": 2, "source": "23.1.237.216", "destination": "10.9.10.102", "uri": "/d/msdownload/update/software/defu/2021/09/am_delta_patch_1.349.439.0_dcf977cccce1b58289d270f71f8151b3acc1566b.exe", "content_type": "application/octet-stream", "declared_body_bytes": 1048578 } }, { "finding_id": "finding-4a3305add3580028359ef7dc", "rule_id": "script-or-executable-transfer", "rule_version": "pcap-rules-v3", "severity": "medium", "title": "Script, archive, or executable transfer candidate", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "confidence": 0.86, "status": "candidate", "evidence": [ { "frame_number": 4195, "timestamp_epoch": "1631316288.774253000", "display_filter": "frame.number == 4195", "tcp_stream": 101 }, { "frame_number": 4199, "timestamp_epoch": "1631316288.850212000", "display_filter": "frame.number == 4199", "tcp_stream": 101 }, { "frame_number": 4201, "timestamp_epoch": "1631316288.853479000", "display_filter": "frame.number == 4201", "tcp_stream": 101 }, { "frame_number": 6356, "timestamp_epoch": "1631316290.372399000", "display_filter": "frame.number == 6356", "tcp_stream": 101 }, { "frame_number": 6371, "timestamp_epoch": "1631316290.377646000", "display_filter": "frame.number == 6371", "tcp_stream": 101 }, { "frame_number": 7346, "timestamp_epoch": "1631316291.098090000", "display_filter": "frame.number == 7346", "tcp_stream": 101 } ], "metrics": { "response_count": 3, "source": "23.1.237.225", "destination": "10.9.10.102", "uri": "/d/msdownload/update/software/defu/2021/09/am_delta_patch_1.349.439.0_dcf977cccce1b58289d270f71f8151b3acc1566b.exe", "content_type": "application/octet-stream", "declared_body_bytes": 1970634 } }, { "finding_id": "finding-cff8089c8f798d22603605ac", "rule_id": "repeated-nxdomain", "rule_version": "pcap-rules-v3", "severity": "low", "title": "Repeated unsuccessful DNS resolution", "explanation": "Repeated NXDOMAIN responses may indicate a dead domain, misconfiguration, retrying software, or malicious fallback. They do not establish a domain-generation algorithm.", "confidence": 0.5, "status": "candidate", "evidence": [ { "frame_number": 19, "timestamp_epoch": "1631315709.539026000", "display_filter": "frame.number == 19", "udp_stream": 3 }, { "frame_number": 64, "timestamp_epoch": "1631315714.217859000", "display_filter": "frame.number == 64", "udp_stream": 16 }, { "frame_number": 134, "timestamp_epoch": "1631315732.217241000", "display_filter": "frame.number == 134", "udp_stream": 17 }, { "frame_number": 168, "timestamp_epoch": "1631315792.232631000", "display_filter": "frame.number == 168", "udp_stream": 19 }, { "frame_number": 7624, "timestamp_epoch": "1631316392.221760000", "display_filter": "frame.number == 7624", "udp_stream": 78 }, { "frame_number": 7762, "timestamp_epoch": "1631316992.281679000", "display_filter": "frame.number == 7762", "udp_stream": 79 }, { "frame_number": 7922, "timestamp_epoch": "1631317592.283915000", "display_filter": "frame.number == 7922", "udp_stream": 80 }, { "frame_number": 8078, "timestamp_epoch": "1631318192.330117000", "display_filter": "frame.number == 8078", "udp_stream": 85 }, { "frame_number": 8314, "timestamp_epoch": "1631318792.332716000", "display_filter": "frame.number == 8314", "udp_stream": 87 }, { "frame_number": 8316, "timestamp_epoch": "1631318792.421801000", "display_filter": "frame.number == 8316", "udp_stream": 87 }, { "frame_number": 8565, "timestamp_epoch": "1631319392.407330000", "display_filter": "frame.number == 8565", "udp_stream": 93 }, { "frame_number": 8826, "timestamp_epoch": "1631319992.455953000", "display_filter": "frame.number == 8826", "udp_stream": 98 } ], "metrics": { "source": "10.9.10.102", "domain": "wpad.angrypoutine.com", "response_count": 12 } }, { "finding_id": "finding-f67cfc1410d57105f2d8527d", "rule_id": "directory-service-activity", "rule_version": "pcap-rules-v3", "severity": "low", "title": "Directory-service protocol activity", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "confidence": 0.95, "status": "candidate", "evidence": [ { "frame_number": 389, "timestamp_epoch": "1631315816.202252000", "display_filter": "frame.number == 389", "tcp_stream": 15 }, { "frame_number": 398, "timestamp_epoch": "1631315816.203725000", "display_filter": "frame.number == 398", "tcp_stream": 15 }, { "frame_number": 404, "timestamp_epoch": "1631315816.205311000", "display_filter": "frame.number == 404", "tcp_stream": 15 }, { "frame_number": 417, "timestamp_epoch": "1631315816.208329000", "display_filter": "frame.number == 417", "tcp_stream": 15 }, { "frame_number": 2059, "timestamp_epoch": "1631315877.056698000", "display_filter": "frame.number == 2059", "tcp_stream": 67 }, { "frame_number": 2067, "timestamp_epoch": "1631315877.061719000", "display_filter": "frame.number == 2067", "tcp_stream": 67 }, { "frame_number": 2069, "timestamp_epoch": "1631315877.064549000", "display_filter": "frame.number == 2069", "tcp_stream": 67 }, { "frame_number": 2073, "timestamp_epoch": "1631315877.070451000", "display_filter": "frame.number == 2073", "tcp_stream": 67 }, { "frame_number": 2075, "timestamp_epoch": "1631315877.073075000", "display_filter": "frame.number == 2075", "tcp_stream": 67 }, { "frame_number": 2077, "timestamp_epoch": "1631315877.075923000", "display_filter": "frame.number == 2077", "tcp_stream": 67 }, { "frame_number": 2962, "timestamp_epoch": "1631316142.057390000", "display_filter": "frame.number == 2962", "tcp_stream": 86 }, { "frame_number": 2966, "timestamp_epoch": "1631316142.301058000", "display_filter": "frame.number == 2966", "tcp_stream": 86 }, { "frame_number": 2968, "timestamp_epoch": "1631316142.303973000", "display_filter": "frame.number == 2968", "tcp_stream": 86 }, { "frame_number": 2972, "timestamp_epoch": "1631316142.310485000", "display_filter": "frame.number == 2972", "tcp_stream": 86 }, { "frame_number": 2974, "timestamp_epoch": "1631316142.313000000", "display_filter": "frame.number == 2974", "tcp_stream": 86 }, { "frame_number": 2976, "timestamp_epoch": "1631316142.315848000", "display_filter": "frame.number == 2976", "tcp_stream": 86 }, { "frame_number": 8702, "timestamp_epoch": "1631319741.451904000", "display_filter": "frame.number == 8702", "tcp_stream": 146 }, { "frame_number": 8706, "timestamp_epoch": "1631319741.698651000", "display_filter": "frame.number == 8706", "tcp_stream": 146 }, { "frame_number": 8708, "timestamp_epoch": "1631319741.701621000", "display_filter": "frame.number == 8708", "tcp_stream": 146 }, { "frame_number": 8712, "timestamp_epoch": "1631319741.708133000", "display_filter": "frame.number == 8712", "tcp_stream": 146 }, { "frame_number": 8714, "timestamp_epoch": "1631319741.710774000", "display_filter": "frame.number == 8714", "tcp_stream": 146 }, { "frame_number": 8717, "timestamp_epoch": "1631319741.761245000", "display_filter": "frame.number == 8717", "tcp_stream": 146 }, { "frame_number": 8902, "timestamp_epoch": "1631320086.166099000", "display_filter": "frame.number == 8902", "tcp_stream": 154 }, { "frame_number": 8904, "timestamp_epoch": "1631320086.168219000", "display_filter": "frame.number == 8904", "tcp_stream": 154 }, { "frame_number": 8906, "timestamp_epoch": "1631320086.170454000", "display_filter": "frame.number == 8906", "tcp_stream": 154 } ], "metrics": { "source": "10.9.10.102", "destination": "10.9.10.9", "protocol": "drsuapi", "event_count": 25, "operation_numbers": [ "0", "1", "12" ] } }, { "finding_id": "finding-f2b09872431e80778a89f237", "rule_id": "directory-service-activity", "rule_version": "pcap-rules-v3", "severity": "low", "title": "Directory-service protocol activity", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "confidence": 0.95, "status": "candidate", "evidence": [ { "frame_number": 80, "timestamp_epoch": "1631315714.903567000", "display_filter": "frame.number == 80", "tcp_stream": 1 }, { "frame_number": 83, "timestamp_epoch": "1631315714.907528000", "display_filter": "frame.number == 83", "tcp_stream": 1 }, { "frame_number": 478, "timestamp_epoch": "1631315816.964061000", "display_filter": "frame.number == 478", "tcp_stream": 22 }, { "frame_number": 483, "timestamp_epoch": "1631315816.973775000", "display_filter": "frame.number == 483", "tcp_stream": 22 }, { "frame_number": 486, "timestamp_epoch": "1631315817.013900000", "display_filter": "frame.number == 486", "tcp_stream": 22 }, { "frame_number": 493, "timestamp_epoch": "1631315817.083271000", "display_filter": "frame.number == 493", "tcp_stream": 23 }, { "frame_number": 496, "timestamp_epoch": "1631315817.092275000", "display_filter": "frame.number == 496", "tcp_stream": 23 }, { "frame_number": 498, "timestamp_epoch": "1631315817.096649000", "display_filter": "frame.number == 498", "tcp_stream": 23 }, { "frame_number": 500, "timestamp_epoch": "1631315817.117237000", "display_filter": "frame.number == 500", "tcp_stream": 22 }, { "frame_number": 502, "timestamp_epoch": "1631315817.146873000", "display_filter": "frame.number == 502", "tcp_stream": 23 }, { "frame_number": 506, "timestamp_epoch": "1631315817.172122000", "display_filter": "frame.number == 506", "tcp_stream": 22 }, { "frame_number": 2114, "timestamp_epoch": "1631315877.084598000", "display_filter": "frame.number == 2114", "tcp_stream": 68 }, { "frame_number": 2119, "timestamp_epoch": "1631315877.088427000", "display_filter": "frame.number == 2119", "tcp_stream": 68 }, { "frame_number": 2122, "timestamp_epoch": "1631315877.092174000", "display_filter": "frame.number == 2122", "tcp_stream": 68 }, { "frame_number": 2124, "timestamp_epoch": "1631315877.095051000", "display_filter": "frame.number == 2124", "tcp_stream": 68 }, { "frame_number": 2126, "timestamp_epoch": "1631315877.096954000", "display_filter": "frame.number == 2126", "tcp_stream": 68 }, { "frame_number": 2133, "timestamp_epoch": "1631315877.114050000", "display_filter": "frame.number == 2133", "tcp_stream": 69 }, { "frame_number": 2137, "timestamp_epoch": "1631315877.116412000", "display_filter": "frame.number == 2137", "tcp_stream": 69 }, { "frame_number": 2143, "timestamp_epoch": "1631315877.117625000", "display_filter": "frame.number == 2143", "tcp_stream": 69 }, { "frame_number": 2145, "timestamp_epoch": "1631315877.119480000", "display_filter": "frame.number == 2145", "tcp_stream": 69 }, { "frame_number": 2149, "timestamp_epoch": "1631315877.119841000", "display_filter": "frame.number == 2149", "tcp_stream": 68 }, { "frame_number": 2982, "timestamp_epoch": "1631316142.356887000", "display_filter": "frame.number == 2982", "tcp_stream": 87 }, { "frame_number": 2987, "timestamp_epoch": "1631316142.361415000", "display_filter": "frame.number == 2987", "tcp_stream": 87 }, { "frame_number": 2990, "timestamp_epoch": "1631316142.365679000", "display_filter": "frame.number == 2990", "tcp_stream": 87 }, { "frame_number": 2992, "timestamp_epoch": "1631316142.368425000", "display_filter": "frame.number == 2992", "tcp_stream": 87 }, { "frame_number": 2995, "timestamp_epoch": "1631316142.370645000", "display_filter": "frame.number == 2995", "tcp_stream": 87 }, { "frame_number": 3001, "timestamp_epoch": "1631316142.407882000", "display_filter": "frame.number == 3001", "tcp_stream": 88 }, { "frame_number": 3004, "timestamp_epoch": "1631316142.411917000", "display_filter": "frame.number == 3004", "tcp_stream": 88 }, { "frame_number": 3009, "timestamp_epoch": "1631316142.414145000", "display_filter": "frame.number == 3009", "tcp_stream": 88 }, { "frame_number": 3011, "timestamp_epoch": "1631316142.416576000", "display_filter": "frame.number == 3011", "tcp_stream": 88 }, { "frame_number": 3014, "timestamp_epoch": "1631316142.416733000", "display_filter": "frame.number == 3014", "tcp_stream": 87 }, { "frame_number": 8725, "timestamp_epoch": "1631319742.090149000", "display_filter": "frame.number == 8725", "tcp_stream": 147 }, { "frame_number": 8730, "timestamp_epoch": "1631319742.094653000", "display_filter": "frame.number == 8730", "tcp_stream": 147 }, { "frame_number": 8733, "timestamp_epoch": "1631319742.098736000", "display_filter": "frame.number == 8733", "tcp_stream": 147 }, { "frame_number": 8735, "timestamp_epoch": "1631319742.101487000", "display_filter": "frame.number == 8735", "tcp_stream": 147 }, { "frame_number": 8737, "timestamp_epoch": "1631319742.104235000", "display_filter": "frame.number == 8737", "tcp_stream": 147 }, { "frame_number": 8744, "timestamp_epoch": "1631319742.157383000", "display_filter": "frame.number == 8744", "tcp_stream": 148 }, { "frame_number": 8747, "timestamp_epoch": "1631319742.160222000", "display_filter": "frame.number == 8747", "tcp_stream": 148 }, { "frame_number": 8752, "timestamp_epoch": "1631319742.162360000", "display_filter": "frame.number == 8752", "tcp_stream": 148 }, { "frame_number": 8754, "timestamp_epoch": "1631319742.164839000", "display_filter": "frame.number == 8754", "tcp_stream": 148 }, { "frame_number": 8756, "timestamp_epoch": "1631319742.164919000", "display_filter": "frame.number == 8756", "tcp_stream": 147 }, { "frame_number": 8912, "timestamp_epoch": "1631320086.882518000", "display_filter": "frame.number == 8912", "tcp_stream": 155 }, { "frame_number": 8917, "timestamp_epoch": "1631320086.887609000", "display_filter": "frame.number == 8917", "tcp_stream": 155 }, { "frame_number": 8923, "timestamp_epoch": "1631320087.008355000", "display_filter": "frame.number == 8923", "tcp_stream": 155 }, { "frame_number": 8930, "timestamp_epoch": "1631320087.069008000", "display_filter": "frame.number == 8930", "tcp_stream": 156 }, { "frame_number": 8933, "timestamp_epoch": "1631320087.073105000", "display_filter": "frame.number == 8933", "tcp_stream": 156 }, { "frame_number": 8935, "timestamp_epoch": "1631320087.075730000", "display_filter": "frame.number == 8935", "tcp_stream": 156 }, { "frame_number": 8937, "timestamp_epoch": "1631320087.079435000", "display_filter": "frame.number == 8937", "tcp_stream": 155 }, { "frame_number": 9078, "timestamp_epoch": "1631320088.311246000", "display_filter": "frame.number == 9078", "tcp_stream": 156 }, { "frame_number": 9082, "timestamp_epoch": "1631320088.319916000", "display_filter": "frame.number == 9082", "tcp_stream": 155 } ], "metrics": { "source": "10.9.10.102", "destination": "10.9.10.9", "protocol": "ldap", "event_count": 50, "operation_numbers": [ "0", "2", "3" ] } }, { "finding_id": "finding-7fc4e438e831d844a0841cfe", "rule_id": "directory-service-activity", "rule_version": "pcap-rules-v3", "severity": "low", "title": "Directory-service protocol activity", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "confidence": 0.95, "status": "candidate", "evidence": [ { "frame_number": 440, "timestamp_epoch": "1631315816.243133000", "display_filter": "frame.number == 440", "tcp_stream": 19 }, { "frame_number": 442, "timestamp_epoch": "1631315816.245054000", "display_filter": "frame.number == 442", "tcp_stream": 19 }, { "frame_number": 444, "timestamp_epoch": "1631315816.246899000", "display_filter": "frame.number == 444", "tcp_stream": 19 }, { "frame_number": 446, "timestamp_epoch": "1631315816.248730000", "display_filter": "frame.number == 446", "tcp_stream": 19 }, { "frame_number": 448, "timestamp_epoch": "1631315816.250617000", "display_filter": "frame.number == 448", "tcp_stream": 19 }, { "frame_number": 450, "timestamp_epoch": "1631315816.252375000", "display_filter": "frame.number == 450", "tcp_stream": 19 }, { "frame_number": 452, "timestamp_epoch": "1631315816.254369000", "display_filter": "frame.number == 452", "tcp_stream": 19 }, { "frame_number": 454, "timestamp_epoch": "1631315816.256268000", "display_filter": "frame.number == 454", "tcp_stream": 19 }, { "frame_number": 456, "timestamp_epoch": "1631315816.258395000", "display_filter": "frame.number == 456", "tcp_stream": 19 }, { "frame_number": 458, "timestamp_epoch": "1631315816.260346000", "display_filter": "frame.number == 458", "tcp_stream": 19 }, { "frame_number": 460, "timestamp_epoch": "1631315816.262280000", "display_filter": "frame.number == 460", "tcp_stream": 19 }, { "frame_number": 462, "timestamp_epoch": "1631315816.264186000", "display_filter": "frame.number == 462", "tcp_stream": 19 }, { "frame_number": 464, "timestamp_epoch": "1631315816.265989000", "display_filter": "frame.number == 464", "tcp_stream": 19 }, { "frame_number": 466, "timestamp_epoch": "1631315816.267805000", "display_filter": "frame.number == 466", "tcp_stream": 19 }, { "frame_number": 468, "timestamp_epoch": "1631315816.269633000", "display_filter": "frame.number == 468", "tcp_stream": 19 }, { "frame_number": 2705, "timestamp_epoch": "1631315966.505945000", "display_filter": "frame.number == 2705", "tcp_stream": 80 }, { "frame_number": 2707, "timestamp_epoch": "1631315966.508802000", "display_filter": "frame.number == 2707", "tcp_stream": 80 }, { "frame_number": 2709, "timestamp_epoch": "1631315966.511562000", "display_filter": "frame.number == 2709", "tcp_stream": 80 }, { "frame_number": 2711, "timestamp_epoch": "1631315966.514181000", "display_filter": "frame.number == 2711", "tcp_stream": 80 }, { "frame_number": 2713, "timestamp_epoch": "1631315966.516818000", "display_filter": "frame.number == 2713", "tcp_stream": 80 }, { "frame_number": 2717, "timestamp_epoch": "1631315966.895289000", "display_filter": "frame.number == 2717", "tcp_stream": 80 }, { "frame_number": 2719, "timestamp_epoch": "1631315966.897682000", "display_filter": "frame.number == 2719", "tcp_stream": 80 }, { "frame_number": 2721, "timestamp_epoch": "1631315966.900014000", "display_filter": "frame.number == 2721", "tcp_stream": 80 }, { "frame_number": 2723, "timestamp_epoch": "1631315966.902012000", "display_filter": "frame.number == 2723", "tcp_stream": 80 }, { "frame_number": 2725, "timestamp_epoch": "1631315966.903988000", "display_filter": "frame.number == 2725", "tcp_stream": 80 }, { "frame_number": 2737, "timestamp_epoch": "1631315966.916394000", "display_filter": "frame.number == 2737", "tcp_stream": 80 }, { "frame_number": 2739, "timestamp_epoch": "1631315966.918290000", "display_filter": "frame.number == 2739", "tcp_stream": 80 }, { "frame_number": 2741, "timestamp_epoch": "1631315966.920310000", "display_filter": "frame.number == 2741", "tcp_stream": 80 }, { "frame_number": 2743, "timestamp_epoch": "1631315966.922243000", "display_filter": "frame.number == 2743", "tcp_stream": 80 }, { "frame_number": 2745, "timestamp_epoch": "1631315966.923956000", "display_filter": "frame.number == 2745", "tcp_stream": 80 }, { "frame_number": 2747, "timestamp_epoch": "1631315966.925841000", "display_filter": "frame.number == 2747", "tcp_stream": 80 }, { "frame_number": 2749, "timestamp_epoch": "1631315966.927916000", "display_filter": "frame.number == 2749", "tcp_stream": 80 }, { "frame_number": 2751, "timestamp_epoch": "1631315966.929933000", "display_filter": "frame.number == 2751", "tcp_stream": 80 }, { "frame_number": 2753, "timestamp_epoch": "1631315966.932162000", "display_filter": "frame.number == 2753", "tcp_stream": 80 }, { "frame_number": 2755, "timestamp_epoch": "1631315966.934106000", "display_filter": "frame.number == 2755", "tcp_stream": 80 }, { "frame_number": 2757, "timestamp_epoch": "1631315966.936076000", "display_filter": "frame.number == 2757", "tcp_stream": 80 }, { "frame_number": 2770, "timestamp_epoch": "1631315967.107975000", "display_filter": "frame.number == 2770", "tcp_stream": 80 }, { "frame_number": 2772, "timestamp_epoch": "1631315967.109802000", "display_filter": "frame.number == 2772", "tcp_stream": 80 }, { "frame_number": 2774, "timestamp_epoch": "1631315967.111638000", "display_filter": "frame.number == 2774", "tcp_stream": 80 }, { "frame_number": 2776, "timestamp_epoch": "1631315967.113444000", "display_filter": "frame.number == 2776", "tcp_stream": 80 }, { "frame_number": 2778, "timestamp_epoch": "1631315967.115360000", "display_filter": "frame.number == 2778", "tcp_stream": 80 }, { "frame_number": 2780, "timestamp_epoch": "1631315967.117411000", "display_filter": "frame.number == 2780", "tcp_stream": 80 }, { "frame_number": 2782, "timestamp_epoch": "1631315967.119332000", "display_filter": "frame.number == 2782", "tcp_stream": 80 }, { "frame_number": 2784, "timestamp_epoch": "1631315967.121257000", "display_filter": "frame.number == 2784", "tcp_stream": 80 }, { "frame_number": 2786, "timestamp_epoch": "1631315967.123094000", "display_filter": "frame.number == 2786", "tcp_stream": 80 }, { "frame_number": 2788, "timestamp_epoch": "1631315967.124946000", "display_filter": "frame.number == 2788", "tcp_stream": 80 }, { "frame_number": 2800, "timestamp_epoch": "1631315967.137311000", "display_filter": "frame.number == 2800", "tcp_stream": 80 }, { "frame_number": 2802, "timestamp_epoch": "1631315967.139190000", "display_filter": "frame.number == 2802", "tcp_stream": 80 }, { "frame_number": 2804, "timestamp_epoch": "1631315967.141123000", "display_filter": "frame.number == 2804", "tcp_stream": 80 }, { "frame_number": 2806, "timestamp_epoch": "1631315967.142993000", "display_filter": "frame.number == 2806", "tcp_stream": 80 }, { "frame_number": 2808, "timestamp_epoch": "1631315967.144878000", "display_filter": "frame.number == 2808", "tcp_stream": 80 }, { "frame_number": 2810, "timestamp_epoch": "1631315967.146886000", "display_filter": "frame.number == 2810", "tcp_stream": 80 }, { "frame_number": 2812, "timestamp_epoch": "1631315967.148810000", "display_filter": "frame.number == 2812", "tcp_stream": 80 }, { "frame_number": 2814, "timestamp_epoch": "1631315967.150926000", "display_filter": "frame.number == 2814", "tcp_stream": 80 }, { "frame_number": 2816, "timestamp_epoch": "1631315967.152894000", "display_filter": "frame.number == 2816", "tcp_stream": 80 }, { "frame_number": 2818, "timestamp_epoch": "1631315967.154700000", "display_filter": "frame.number == 2818", "tcp_stream": 80 }, { "frame_number": 2820, "timestamp_epoch": "1631315967.156536000", "display_filter": "frame.number == 2820", "tcp_stream": 80 } ], "metrics": { "source": "10.9.10.102", "destination": "10.9.10.9", "protocol": "samr", "event_count": 57, "operation_numbers": [ "1", "16", "17", "18", "19", "20", "25", "3", "34", "36", "39", "5", "6", "64", "7" ] } }, { "finding_id": "finding-66057f32f2a0cf52c87223fb", "rule_id": "directory-service-activity", "rule_version": "pcap-rules-v3", "severity": "low", "title": "Directory-service protocol activity", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "confidence": 0.95, "status": "candidate", "evidence": [ { "frame_number": 391, "timestamp_epoch": "1631315816.202503000", "display_filter": "frame.number == 391", "tcp_stream": 15 }, { "frame_number": 401, "timestamp_epoch": "1631315816.204127000", "display_filter": "frame.number == 401", "tcp_stream": 15 }, { "frame_number": 406, "timestamp_epoch": "1631315816.205807000", "display_filter": "frame.number == 406", "tcp_stream": 15 }, { "frame_number": 418, "timestamp_epoch": "1631315816.208461000", "display_filter": "frame.number == 418", "tcp_stream": 15 }, { "frame_number": 2060, "timestamp_epoch": "1631315877.057161000", "display_filter": "frame.number == 2060", "tcp_stream": 67 }, { "frame_number": 2068, "timestamp_epoch": "1631315877.062420000", "display_filter": "frame.number == 2068", "tcp_stream": 67 }, { "frame_number": 2070, "timestamp_epoch": "1631315877.064849000", "display_filter": "frame.number == 2070", "tcp_stream": 67 }, { "frame_number": 2074, "timestamp_epoch": "1631315877.070829000", "display_filter": "frame.number == 2074", "tcp_stream": 67 }, { "frame_number": 2076, "timestamp_epoch": "1631315877.073778000", "display_filter": "frame.number == 2076", "tcp_stream": 67 }, { "frame_number": 2078, "timestamp_epoch": "1631315877.076183000", "display_filter": "frame.number == 2078", "tcp_stream": 67 }, { "frame_number": 2963, "timestamp_epoch": "1631316142.057859000", "display_filter": "frame.number == 2963", "tcp_stream": 86 }, { "frame_number": 2967, "timestamp_epoch": "1631316142.301796000", "display_filter": "frame.number == 2967", "tcp_stream": 86 }, { "frame_number": 2969, "timestamp_epoch": "1631316142.304324000", "display_filter": "frame.number == 2969", "tcp_stream": 86 }, { "frame_number": 2973, "timestamp_epoch": "1631316142.310861000", "display_filter": "frame.number == 2973", "tcp_stream": 86 }, { "frame_number": 2975, "timestamp_epoch": "1631316142.313717000", "display_filter": "frame.number == 2975", "tcp_stream": 86 }, { "frame_number": 2977, "timestamp_epoch": "1631316142.316213000", "display_filter": "frame.number == 2977", "tcp_stream": 86 }, { "frame_number": 8703, "timestamp_epoch": "1631319741.452370000", "display_filter": "frame.number == 8703", "tcp_stream": 146 }, { "frame_number": 8707, "timestamp_epoch": "1631319741.699401000", "display_filter": "frame.number == 8707", "tcp_stream": 146 }, { "frame_number": 8709, "timestamp_epoch": "1631319741.701932000", "display_filter": "frame.number == 8709", "tcp_stream": 146 }, { "frame_number": 8713, "timestamp_epoch": "1631319741.708518000", "display_filter": "frame.number == 8713", "tcp_stream": 146 }, { "frame_number": 8715, "timestamp_epoch": "1631319741.711246000", "display_filter": "frame.number == 8715", "tcp_stream": 146 }, { "frame_number": 8718, "timestamp_epoch": "1631319741.761575000", "display_filter": "frame.number == 8718", "tcp_stream": 146 }, { "frame_number": 8903, "timestamp_epoch": "1631320086.166565000", "display_filter": "frame.number == 8903", "tcp_stream": 154 }, { "frame_number": 8905, "timestamp_epoch": "1631320086.168976000", "display_filter": "frame.number == 8905", "tcp_stream": 154 }, { "frame_number": 8907, "timestamp_epoch": "1631320086.170812000", "display_filter": "frame.number == 8907", "tcp_stream": 154 } ], "metrics": { "source": "10.9.10.9", "destination": "10.9.10.102", "protocol": "drsuapi", "event_count": 25, "operation_numbers": [ "0", "1", "12" ] } }, { "finding_id": "finding-04c71321ef5dbb606946d222", "rule_id": "directory-service-activity", "rule_version": "pcap-rules-v3", "severity": "low", "title": "Directory-service protocol activity", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "confidence": 0.95, "status": "candidate", "evidence": [ { "frame_number": 82, "timestamp_epoch": "1631315714.905140000", "display_filter": "frame.number == 82", "tcp_stream": 1 }, { "frame_number": 480, "timestamp_epoch": "1631315816.964799000", "display_filter": "frame.number == 480", "tcp_stream": 22 }, { "frame_number": 485, "timestamp_epoch": "1631315816.975285000", "display_filter": "frame.number == 485", "tcp_stream": 22 }, { "frame_number": 487, "timestamp_epoch": "1631315817.014530000", "display_filter": "frame.number == 487", "tcp_stream": 22 }, { "frame_number": 495, "timestamp_epoch": "1631315817.084711000", "display_filter": "frame.number == 495", "tcp_stream": 23 }, { "frame_number": 497, "timestamp_epoch": "1631315817.092525000", "display_filter": "frame.number == 497", "tcp_stream": 23 }, { "frame_number": 499, "timestamp_epoch": "1631315817.097104000", "display_filter": "frame.number == 499", "tcp_stream": 23 }, { "frame_number": 501, "timestamp_epoch": "1631315817.117819000", "display_filter": "frame.number == 501", "tcp_stream": 22 }, { "frame_number": 2116, "timestamp_epoch": "1631315877.085324000", "display_filter": "frame.number == 2116", "tcp_stream": 68 }, { "frame_number": 2121, "timestamp_epoch": "1631315877.089901000", "display_filter": "frame.number == 2121", "tcp_stream": 68 }, { "frame_number": 2123, "timestamp_epoch": "1631315877.092602000", "display_filter": "frame.number == 2123", "tcp_stream": 68 }, { "frame_number": 2125, "timestamp_epoch": "1631315877.095417000", "display_filter": "frame.number == 2125", "tcp_stream": 68 }, { "frame_number": 2127, "timestamp_epoch": "1631315877.097372000", "display_filter": "frame.number == 2127", "tcp_stream": 68 }, { "frame_number": 2135, "timestamp_epoch": "1631315877.114813000", "display_filter": "frame.number == 2135", "tcp_stream": 69 }, { "frame_number": 2140, "timestamp_epoch": "1631315877.117000000", "display_filter": "frame.number == 2140", "tcp_stream": 69 }, { "frame_number": 2144, "timestamp_epoch": "1631315877.117965000", "display_filter": "frame.number == 2144", "tcp_stream": 69 }, { "frame_number": 2984, "timestamp_epoch": "1631316142.357695000", "display_filter": "frame.number == 2984", "tcp_stream": 87 }, { "frame_number": 2989, "timestamp_epoch": "1631316142.363093000", "display_filter": "frame.number == 2989", "tcp_stream": 87 }, { "frame_number": 2991, "timestamp_epoch": "1631316142.366144000", "display_filter": "frame.number == 2991", "tcp_stream": 87 }, { "frame_number": 2993, "timestamp_epoch": "1631316142.368873000", "display_filter": "frame.number == 2993", "tcp_stream": 87 }, { "frame_number": 2996, "timestamp_epoch": "1631316142.370955000", "display_filter": "frame.number == 2996", "tcp_stream": 87 }, { "frame_number": 3003, "timestamp_epoch": "1631316142.409360000", "display_filter": "frame.number == 3003", "tcp_stream": 88 }, { "frame_number": 3007, "timestamp_epoch": "1631316142.412719000", "display_filter": "frame.number == 3007", "tcp_stream": 88 }, { "frame_number": 3010, "timestamp_epoch": "1631316142.414320000", "display_filter": "frame.number == 3010", "tcp_stream": 88 }, { "frame_number": 8727, "timestamp_epoch": "1631319742.090941000", "display_filter": "frame.number == 8727", "tcp_stream": 147 }, { "frame_number": 8732, "timestamp_epoch": "1631319742.096110000", "display_filter": "frame.number == 8732", "tcp_stream": 147 }, { "frame_number": 8734, "timestamp_epoch": "1631319742.099162000", "display_filter": "frame.number == 8734", "tcp_stream": 147 }, { "frame_number": 8736, "timestamp_epoch": "1631319742.101962000", "display_filter": "frame.number == 8736", "tcp_stream": 147 }, { "frame_number": 8738, "timestamp_epoch": "1631319742.104757000", "display_filter": "frame.number == 8738", "tcp_stream": 147 }, { "frame_number": 8746, "timestamp_epoch": "1631319742.158067000", "display_filter": "frame.number == 8746", "tcp_stream": 148 }, { "frame_number": 8750, "timestamp_epoch": "1631319742.160990000", "display_filter": "frame.number == 8750", "tcp_stream": 148 }, { "frame_number": 8753, "timestamp_epoch": "1631319742.162606000", "display_filter": "frame.number == 8753", "tcp_stream": 148 }, { "frame_number": 8914, "timestamp_epoch": "1631320086.883277000", "display_filter": "frame.number == 8914", "tcp_stream": 155 }, { "frame_number": 8919, "timestamp_epoch": "1631320086.889082000", "display_filter": "frame.number == 8919", "tcp_stream": 155 }, { "frame_number": 8924, "timestamp_epoch": "1631320087.008995000", "display_filter": "frame.number == 8924", "tcp_stream": 155 }, { "frame_number": 8932, "timestamp_epoch": "1631320087.070473000", "display_filter": "frame.number == 8932", "tcp_stream": 156 }, { "frame_number": 8934, "timestamp_epoch": "1631320087.073375000", "display_filter": "frame.number == 8934", "tcp_stream": 156 }, { "frame_number": 8936, "timestamp_epoch": "1631320087.076111000", "display_filter": "frame.number == 8936", "tcp_stream": 156 }, { "frame_number": 8938, "timestamp_epoch": "1631320087.080419000", "display_filter": "frame.number == 8938", "tcp_stream": 155 } ], "metrics": { "source": "10.9.10.9", "destination": "10.9.10.102", "protocol": "ldap", "event_count": 39, "operation_numbers": [ "1", "4,19,19,19,5", "4,5", "5" ] } }, { "finding_id": "finding-94f3fd9fea4406cb12e7ecdf", "rule_id": "directory-service-activity", "rule_version": "pcap-rules-v3", "severity": "low", "title": "Directory-service protocol activity", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "confidence": 0.95, "status": "candidate", "evidence": [ { "frame_number": 441, "timestamp_epoch": "1631315816.243557000", "display_filter": "frame.number == 441", "tcp_stream": 19 }, { "frame_number": 443, "timestamp_epoch": "1631315816.245465000", "display_filter": "frame.number == 443", "tcp_stream": 19 }, { "frame_number": 445, "timestamp_epoch": "1631315816.247380000", "display_filter": "frame.number == 445", "tcp_stream": 19 }, { "frame_number": 447, "timestamp_epoch": "1631315816.249191000", "display_filter": "frame.number == 447", "tcp_stream": 19 }, { "frame_number": 449, "timestamp_epoch": "1631315816.250931000", "display_filter": "frame.number == 449", "tcp_stream": 19 }, { "frame_number": 451, "timestamp_epoch": "1631315816.252925000", "display_filter": "frame.number == 451", "tcp_stream": 19 }, { "frame_number": 453, "timestamp_epoch": "1631315816.254812000", "display_filter": "frame.number == 453", "tcp_stream": 19 }, { "frame_number": 455, "timestamp_epoch": "1631315816.256961000", "display_filter": "frame.number == 455", "tcp_stream": 19 }, { "frame_number": 457, "timestamp_epoch": "1631315816.258946000", "display_filter": "frame.number == 457", "tcp_stream": 19 }, { "frame_number": 459, "timestamp_epoch": "1631315816.260793000", "display_filter": "frame.number == 459", "tcp_stream": 19 }, { "frame_number": 461, "timestamp_epoch": "1631315816.262733000", "display_filter": "frame.number == 461", "tcp_stream": 19 }, { "frame_number": 463, "timestamp_epoch": "1631315816.264601000", "display_filter": "frame.number == 463", "tcp_stream": 19 }, { "frame_number": 465, "timestamp_epoch": "1631315816.266340000", "display_filter": "frame.number == 465", "tcp_stream": 19 }, { "frame_number": 467, "timestamp_epoch": "1631315816.268210000", "display_filter": "frame.number == 467", "tcp_stream": 19 }, { "frame_number": 469, "timestamp_epoch": "1631315816.269868000", "display_filter": "frame.number == 469", "tcp_stream": 19 }, { "frame_number": 2706, "timestamp_epoch": "1631315966.506606000", "display_filter": "frame.number == 2706", "tcp_stream": 80 }, { "frame_number": 2708, "timestamp_epoch": "1631315966.509355000", "display_filter": "frame.number == 2708", "tcp_stream": 80 }, { "frame_number": 2710, "timestamp_epoch": "1631315966.512048000", "display_filter": "frame.number == 2710", "tcp_stream": 80 }, { "frame_number": 2712, "timestamp_epoch": "1631315966.514600000", "display_filter": "frame.number == 2712", "tcp_stream": 80 }, { "frame_number": 2714, "timestamp_epoch": "1631315966.517327000", "display_filter": "frame.number == 2714", "tcp_stream": 80 }, { "frame_number": 2718, "timestamp_epoch": "1631315966.896127000", "display_filter": "frame.number == 2718", "tcp_stream": 80 }, { "frame_number": 2720, "timestamp_epoch": "1631315966.898450000", "display_filter": "frame.number == 2720", "tcp_stream": 80 }, { "frame_number": 2722, "timestamp_epoch": "1631315966.900524000", "display_filter": "frame.number == 2722", "tcp_stream": 80 }, { "frame_number": 2724, "timestamp_epoch": "1631315966.902430000", "display_filter": "frame.number == 2724", "tcp_stream": 80 }, { "frame_number": 2726, "timestamp_epoch": "1631315966.904500000", "display_filter": "frame.number == 2726", "tcp_stream": 80 }, { "frame_number": 2738, "timestamp_epoch": "1631315966.916801000", "display_filter": "frame.number == 2738", "tcp_stream": 80 }, { "frame_number": 2740, "timestamp_epoch": "1631315966.918651000", "display_filter": "frame.number == 2740", "tcp_stream": 80 }, { "frame_number": 2742, "timestamp_epoch": "1631315966.920672000", "display_filter": "frame.number == 2742", "tcp_stream": 80 }, { "frame_number": 2744, "timestamp_epoch": "1631315966.922457000", "display_filter": "frame.number == 2744", "tcp_stream": 80 }, { "frame_number": 2746, "timestamp_epoch": "1631315966.924393000", "display_filter": "frame.number == 2746", "tcp_stream": 80 }, { "frame_number": 2748, "timestamp_epoch": "1631315966.926357000", "display_filter": "frame.number == 2748", "tcp_stream": 80 }, { "frame_number": 2750, "timestamp_epoch": "1631315966.928378000", "display_filter": "frame.number == 2750", "tcp_stream": 80 }, { "frame_number": 2752, "timestamp_epoch": "1631315966.930497000", "display_filter": "frame.number == 2752", "tcp_stream": 80 }, { "frame_number": 2754, "timestamp_epoch": "1631315966.932520000", "display_filter": "frame.number == 2754", "tcp_stream": 80 }, { "frame_number": 2756, "timestamp_epoch": "1631315966.934472000", "display_filter": "frame.number == 2756", "tcp_stream": 80 }, { "frame_number": 2758, "timestamp_epoch": "1631315966.936436000", "display_filter": "frame.number == 2758", "tcp_stream": 80 }, { "frame_number": 2771, "timestamp_epoch": "1631315967.108357000", "display_filter": "frame.number == 2771", "tcp_stream": 80 }, { "frame_number": 2773, "timestamp_epoch": "1631315967.110185000", "display_filter": "frame.number == 2773", "tcp_stream": 80 }, { "frame_number": 2775, "timestamp_epoch": "1631315967.112004000", "display_filter": "frame.number == 2775", "tcp_stream": 80 }, { "frame_number": 2777, "timestamp_epoch": "1631315967.113908000", "display_filter": "frame.number == 2777", "tcp_stream": 80 }, { "frame_number": 2779, "timestamp_epoch": "1631315967.115884000", "display_filter": "frame.number == 2779", "tcp_stream": 80 }, { "frame_number": 2781, "timestamp_epoch": "1631315967.117894000", "display_filter": "frame.number == 2781", "tcp_stream": 80 }, { "frame_number": 2783, "timestamp_epoch": "1631315967.119790000", "display_filter": "frame.number == 2783", "tcp_stream": 80 }, { "frame_number": 2785, "timestamp_epoch": "1631315967.121621000", "display_filter": "frame.number == 2785", "tcp_stream": 80 }, { "frame_number": 2787, "timestamp_epoch": "1631315967.123453000", "display_filter": "frame.number == 2787", "tcp_stream": 80 }, { "frame_number": 2789, "timestamp_epoch": "1631315967.125283000", "display_filter": "frame.number == 2789", "tcp_stream": 80 }, { "frame_number": 2801, "timestamp_epoch": "1631315967.137715000", "display_filter": "frame.number == 2801", "tcp_stream": 80 }, { "frame_number": 2803, "timestamp_epoch": "1631315967.139701000", "display_filter": "frame.number == 2803", "tcp_stream": 80 }, { "frame_number": 2805, "timestamp_epoch": "1631315967.141536000", "display_filter": "frame.number == 2805", "tcp_stream": 80 }, { "frame_number": 2807, "timestamp_epoch": "1631315967.143458000", "display_filter": "frame.number == 2807", "tcp_stream": 80 }, { "frame_number": 2809, "timestamp_epoch": "1631315967.145402000", "display_filter": "frame.number == 2809", "tcp_stream": 80 }, { "frame_number": 2811, "timestamp_epoch": "1631315967.147382000", "display_filter": "frame.number == 2811", "tcp_stream": 80 }, { "frame_number": 2813, "timestamp_epoch": "1631315967.149337000", "display_filter": "frame.number == 2813", "tcp_stream": 80 }, { "frame_number": 2815, "timestamp_epoch": "1631315967.151339000", "display_filter": "frame.number == 2815", "tcp_stream": 80 }, { "frame_number": 2817, "timestamp_epoch": "1631315967.153273000", "display_filter": "frame.number == 2817", "tcp_stream": 80 }, { "frame_number": 2819, "timestamp_epoch": "1631315967.155105000", "display_filter": "frame.number == 2819", "tcp_stream": 80 }, { "frame_number": 2821, "timestamp_epoch": "1631315967.156946000", "display_filter": "frame.number == 2821", "tcp_stream": 80 } ], "metrics": { "source": "10.9.10.9", "destination": "10.9.10.102", "protocol": "samr", "event_count": 57, "operation_numbers": [ "1", "16", "17", "18", "19", "20", "25", "3", "34", "36", "39", "5", "6", "64", "7" ] } } ], "attack_candidates": [ { "attack_id": "T1105", "name": "Ingress Tool Transfer", "tactic": "command-and-control", "confidence": 0.8, "status": "suggested", "mapping_basis": "versioned-deterministic-rule", "finding_ids": [ "finding-4a3305add3580028359ef7dc", "finding-888e9c1168af2bb2521c2e9a" ], "evidence": [ { "frame_number": 4193, "timestamp_epoch": "1631316288.773365000", "display_filter": "frame.number == 4193", "tcp_stream": 100 }, { "frame_number": 4195, "timestamp_epoch": "1631316288.774253000", "display_filter": "frame.number == 4195", "tcp_stream": 101 }, { "frame_number": 4198, "timestamp_epoch": "1631316288.847386000", "display_filter": "frame.number == 4198", "tcp_stream": 100 }, { "frame_number": 4199, "timestamp_epoch": "1631316288.850212000", "display_filter": "frame.number == 4199", "tcp_stream": 101 }, { "frame_number": 4200, "timestamp_epoch": "1631316288.853317000", "display_filter": "frame.number == 4200", "tcp_stream": 100 }, { "frame_number": 4201, "timestamp_epoch": "1631316288.853479000", "display_filter": "frame.number == 4201", "tcp_stream": 101 }, { "frame_number": 6356, "timestamp_epoch": "1631316290.372399000", "display_filter": "frame.number == 6356", "tcp_stream": 101 }, { "frame_number": 6371, "timestamp_epoch": "1631316290.377646000", "display_filter": "frame.number == 6371", "tcp_stream": 101 }, { "frame_number": 6404, "timestamp_epoch": "1631316290.461273000", "display_filter": "frame.number == 6404", "tcp_stream": 100 } ] } ], "actor_leads": [], "coverage": { "event_limits": { "dns": { "returned": 199, "truncated": false }, "http_request": { "returned": 58, "truncated": false }, "http_response": { "returned": 48, "truncated": false }, "tls_client_hello": { "returned": 105, "truncated": false }, "dhcp": { "returned": 4, "truncated": false }, "identity": { "returned": 581, "truncated": false }, "directory_service": { "returned": 253, "truncated": false }, "unclassified_tcp": { "returned": 54, "truncated": false } }, "warnings": [], "encrypted_payload_visibility": "metadata-only", "name_resolution": false, "http_objects": { "exported_objects": 46, "hashed_objects": 46, "unique_hashes": 45, "returned_unique_hashes": 45, "detailed_objects": 45, "compact_hash_index": [], "compact_objects": 0, "omitted_unique_hashes": 0, "unhashed_objects": 0, "hashed_bytes": 3675348, "selection": "content-classified first, then size descending, SHA256 tie-break; deduplicated by full hash; overflow retains a compact hash index", "complete": true }, "complete_within_profile": true, "limitations": [ "Encrypted application contents are not decrypted", "Protocol decoding and heuristic findings do not establish malware family or attribution", "No endpoint execution, persistence, or credential-theft proof without corresponding evidence" ] }, "summary": "Decoded 9221 packets across 66 IP endpoints and 263 transport flows. Observed 199 DNS events, 58 HTTP requests, 105 TLS ClientHello events, and 45 exported HTTP object(s). Deterministic rules produced 9 finding(s): 0 high, 2 medium, and 7 low. Findings are evidence-bound candidates and require analyst review; encrypted payload contents remain unavailable.", "semantic_sha256": "ce8b10a4ba7a6615d2c58f5895ecb69dca768d904402026068da26b4ef7db5ed" }, "context": { "schema_version": "pcap-context-v1", "created_at": "2026-09-19T12:10:32.214995+00:00", "session_id": "869e7fd1-f976-40e4-affa-f9960f431cf8", "source_semantic_sha256": "ce8b10a4ba7a6615d2c58f5895ecb69dca768d904402026068da26b4ef7db5ed", "mode": "local-only", "external_enrichment": { "status": "not-requested", "requests": 0, "reason": "Requires explicit provider consent and privacy review" }, "coverage": { "observables_total": 248, "observables_checked": 248, "observable_limit": 5000, "truncated": false, "matched_observables": 0, "no_exact_match": 248, "prior_cases_checked": 15, "prior_case_limit_reached": false }, "matches": [], "source_actor_links": [], "techniques": [ { "attack_id": "T1105", "name": "Ingress Tool Transfer", "catalog_version_id": 851, "url": "https://attack.mitre.org/techniques/T1105", "platforms": [ "ESXi", "Linux", "macOS", "Network Devices", "Windows" ], "data_sources": [ "WinEventLog:Sysmon", "auditd:SYSCALL", "iptables:LOG", "macos:endpointsecurity", "macos:unifiedlog", "esxi:hostd", "esxi:vmkernel", "NSM:Flow", "snmp:syslog" ], "detection": "", "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--67677c4c-5778-49eb-ae74-1920645b8554", "attack_id": "DET0060", "name": "Detect Ingress Tool Transfers via Behavioral Chain" } ], "detection_links_truncated": false, "status": "catalog-context-not-validation-of-behavior" } ], "cross_case_correlations": [ { "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "session_id": "2b5677d6-f466-4831-89aa-be3126dddaef", "source_sha256": "95074aea864749524df5b0a6c9fd58a3111038157b3400902486b96d902b3455", "shared_observables": [ { "type": "domain", "value": "a-ring.msedge.net" }, { "type": "domain", "value": "api.msn.com" }, { "type": "domain", "value": "bing.com" }, { "type": "domain", "value": "client.wns.windows.com" }, { "type": "domain", "value": "ctldl.windowsupdate.com" }, { "type": "domain", "value": "dns.msftncsi.com" }, { "type": "domain", "value": "fe2cr.update.microsoft.com" }, { "type": "domain", "value": "fe2cr.update.microsoft.com.akadns.net" }, { "type": "domain", "value": "fe3cr.delivery.mp.microsoft.com" }, { "type": "domain", "value": "fp-afd.azurefd.us" }, { "type": "domain", "value": "fp-vs-nocache.azureedge.net" }, { "type": "domain", "value": "k-ring.msedge.net" }, { "type": "domain", "value": "login.live.com" }, { "type": "domain", "value": "microsoft.com" }, { "type": "domain", "value": "myexternalip.com" }, { "type": "domain", "value": "nexusrules.officeapps.live.com" }, { "type": "domain", "value": "prod.nexusrules.live.com.akadns.net" }, { "type": "domain", "value": "settings-win.data.microsoft.com" }, { "type": "domain", "value": "settingsfd-geo.trafficmanager.net" }, { "type": "domain", "value": "spo-ring.msedge.net" }, { "type": "domain", "value": "storeedgefd.dsx.mp.microsoft.com" }, { "type": "domain", "value": "t-ring.msedge.net" }, { "type": "domain", "value": "teams-ring.msedge.net" }, { "type": "domain", "value": "v10.events.data.microsoft.com" }, { "type": "domain", "value": "www.bing.com" }, { "type": "domain", "value": "www.microsoft.com" }, { "type": "ipv4", "value": "104.215.148.63" }, { "type": "ipv4", "value": "104.46.162.226" }, { "type": "ipv4", "value": "13.107.136.254" }, { "type": "ipv4", "value": "13.107.18.254" }, { "type": "ipv4", "value": "13.107.21.200" }, { "type": "ipv4", "value": "13.107.246.254" }, { "type": "ipv4", "value": "13.69.239.72" }, { "type": "ipv4", "value": "13.77.161.179" }, { "type": "ipv4", "value": "131.107.255.255" }, { "type": "ipv4", "value": "20.189.173.7" }, { "type": "ipv4", "value": "204.79.197.200" }, { "type": "ipv4", "value": "204.79.197.203" }, { "type": "ipv4", "value": "204.79.197.254" }, { "type": "ipv4", "value": "224.0.0.22" }, { "type": "ipv4", "value": "224.0.0.251" }, { "type": "ipv4", "value": "224.0.0.252" }, { "type": "ipv4", "value": "239.255.255.250" }, { "type": "ipv4", "value": "34.117.59.81" }, { "type": "ipv4", "value": "40.112.72.205" }, { "type": "ipv4", "value": "40.113.200.201" }, { "type": "ipv4", "value": "40.76.4.15" }, { "type": "ipv4", "value": "52.109.76.32" }, { "type": "ipv4", "value": "52.113.196.254" }, { "type": "ipv4", "value": "52.242.97.97" }, { "type": "ipv4", "value": "72.21.81.200" } ], "shared_count": 51, "status": "shared-observation-not-common-campaign" }, { "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e", "session_id": "69fc74e8-a685-4c8b-bde3-5ee0bb1190f6", "source_sha256": "91e547acc39e8ef27d7ec549404157fe527e090bd5caf6fe189c2bae6d4a57ef", "shared_observables": [ { "type": "domain", "value": "api.msn.com" }, { "type": "domain", "value": "client.wns.windows.com" }, { "type": "domain", "value": "dns.msftncsi.com" }, { "type": "domain", "value": "gameplayapi.intel.com" }, { "type": "domain", "value": "nexus.officeapps.live.com" }, { "type": "domain", "value": "nexusrules.officeapps.live.com" }, { "type": "domain", "value": "office15client.microsoft.com" }, { "type": "domain", "value": "prod-w.nexus.live.com.akadns.net" }, { "type": "domain", "value": "settings-win.data.microsoft.com" }, { "type": "domain", "value": "settingsfd-geo.trafficmanager.net" }, { "type": "domain", "value": "v10.events.data.microsoft.com" }, { "type": "domain", "value": "www.bing.com" }, { "type": "domain", "value": "www.microsoft.com" }, { "type": "ipv4", "value": "13.107.21.200" }, { "type": "ipv4", "value": "131.107.255.255" }, { "type": "ipv4", "value": "204.79.197.200" }, { "type": "ipv4", "value": "204.79.197.203" }, { "type": "ipv4", "value": "224.0.0.22" }, { "type": "ipv4", "value": "224.0.0.251" }, { "type": "ipv4", "value": "224.0.0.252" }, { "type": "ipv4", "value": "23.3.6.28" }, { "type": "ipv4", "value": "239.255.255.250" }, { "type": "ipv4", "value": "40.83.240.146" } ], "shared_count": 23, "status": "shared-observation-not-common-campaign" }, { "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "session_id": "91100160-1a16-4165-bf1d-6b5876fb4e11", "source_sha256": "a86b11ee443ee59d95e4590bdf761235c5d240128d6d195233d065ab57777e8b", "shared_observables": [ { "type": "domain", "value": "api.msn.com" }, { "type": "domain", "value": "au.download.windowsupdate.com" }, { "type": "domain", "value": "client.wns.windows.com" }, { "type": "domain", "value": "ctldl.windowsupdate.com" }, { "type": "domain", "value": "dns.msftncsi.com" }, { "type": "domain", "value": "download.windowsupdate.com" }, { "type": "domain", "value": "fe2cr.update.microsoft.com" }, { "type": "domain", "value": "fe3cr.delivery.mp.microsoft.com" }, { "type": "domain", "value": "geo.prod.do.dsp.mp.microsoft.com" }, { "type": "domain", "value": "settings-win.data.microsoft.com" }, { "type": "domain", "value": "settingsfd-geo.trafficmanager.net" }, { "type": "domain", "value": "v10.events.data.microsoft.com" }, { "type": "domain", "value": "www.bing.com" }, { "type": "ipv4", "value": "13.107.21.200" }, { "type": "ipv4", "value": "131.107.255.255" }, { "type": "ipv4", "value": "204.79.197.200" }, { "type": "ipv4", "value": "204.79.197.203" }, { "type": "ipv4", "value": "224.0.0.22" }, { "type": "ipv4", "value": "224.0.0.251" }, { "type": "ipv4", "value": "224.0.0.252" }, { "type": "ipv4", "value": "239.255.255.250" }, { "type": "ipv4", "value": "40.83.240.146" }, { "type": "sha256", "value": "9b8db510ef42b8ed54a3712636fda55a4f8cfcd5493e20b74ab00cd4f3979f2d" } ], "shared_count": 23, "status": "shared-observation-not-common-campaign" }, { "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4", "session_id": "bfa8693a-227f-4f5d-8e70-aff8c425ac42", "source_sha256": "eefc7e61b50e7846f5a3282d7645539d7b2b4b85aa08a09d0b823896c9449d1f", "shared_observables": [ { "type": "domain", "value": "a-ring.msedge.net" }, { "type": "domain", "value": "api.msn.com" }, { "type": "domain", "value": "client.wns.windows.com" }, { "type": "domain", "value": "ctldl.windowsupdate.com" }, { "type": "domain", "value": "dns.msftncsi.com" }, { "type": "domain", "value": "fe2cr.update.microsoft.com" }, { "type": "domain", "value": "fe3cr.delivery.mp.microsoft.com" }, { "type": "domain", "value": "fp-afd.azureedge.us" }, { "type": "domain", "value": "fp-afd.azurefd.us" }, { "type": "domain", "value": "fs.microsoft.com" }, { "type": "domain", "value": "login.live.com" }, { "type": "domain", "value": "nexusrules.officeapps.live.com" }, { "type": "domain", "value": "prod.nexusrules.live.com.akadns.net" }, { "type": "domain", "value": "s-ring.msedge.net" }, { "type": "domain", "value": "settings-win.data.microsoft.com" }, { "type": "domain", "value": "v10.events.data.microsoft.com" }, { "type": "domain", "value": "www.bing.com" }, { "type": "domain", "value": "www.msftncsi.com" }, { "type": "ipv4", "value": "13.107.21.200" }, { "type": "ipv4", "value": "13.107.246.254" }, { "type": "ipv4", "value": "13.107.3.254" }, { "type": "ipv4", "value": "131.107.255.255" }, { "type": "ipv4", "value": "20.42.73.25" }, { "type": "ipv4", "value": "204.79.197.200" }, { "type": "ipv4", "value": "204.79.197.203" }, { "type": "ipv4", "value": "204.79.197.254" }, { "type": "ipv4", "value": "224.0.0.22" }, { "type": "ipv4", "value": "224.0.0.251" }, { "type": "ipv4", "value": "224.0.0.252" }, { "type": "ipv4", "value": "239.255.255.250" }, { "type": "ipv4", "value": "40.125.122.151" }, { "type": "ipv4", "value": "40.83.240.146" }, { "type": "ipv4", "value": "52.109.8.19" }, { "type": "ipv4", "value": "72.21.81.200" }, { "type": "sha256", "value": "6137f8db2192e638e13610f75e73b9247c05f4706f0afd1fdb132d86de6b4012" } ], "shared_count": 35, "status": "shared-observation-not-common-campaign" }, { "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807", "session_id": "2571013a-e926-41d7-b13c-b180a0720a96", "source_sha256": "d9b67e18bca13cf6135874fd81d167403c7cb6b8a422679948db914e9959b90d", "shared_observables": [ { "type": "domain", "value": "api.msn.com" }, { "type": "domain", "value": "client.wns.windows.com" }, { "type": "domain", "value": "ctldl.windowsupdate.com" }, { "type": "domain", "value": "dns.msftncsi.com" }, { "type": "domain", "value": "fp-vs-nocache.azureedge.net" }, { "type": "domain", "value": "nexusrules.officeapps.live.com" }, { "type": "domain", "value": "prod.nexusrules.live.com.akadns.net" }, { "type": "domain", "value": "settings-win.data.microsoft.com" }, { "type": "domain", "value": "spo-ring.msedge.net" }, { "type": "domain", "value": "t-ring.msedge.net" }, { "type": "domain", "value": "teams-ring.msedge.net" }, { "type": "domain", "value": "v10.events.data.microsoft.com" }, { "type": "domain", "value": "www.bing.com" }, { "type": "ipv4", "value": "13.107.136.254" }, { "type": "ipv4", "value": "13.107.21.200" }, { "type": "ipv4", "value": "13.107.246.254" }, { "type": "ipv4", "value": "131.107.255.255" }, { "type": "ipv4", "value": "20.190.154.139" }, { "type": "ipv4", "value": "20.190.154.16" }, { "type": "ipv4", "value": "20.190.154.17" }, { "type": "ipv4", "value": "20.190.154.18" }, { "type": "ipv4", "value": "20.190.154.19" }, { "type": "ipv4", "value": "204.79.197.200" }, { "type": "ipv4", "value": "204.79.197.203" }, { "type": "ipv4", "value": "224.0.0.22" }, { "type": "ipv4", "value": "224.0.0.251" }, { "type": "ipv4", "value": "224.0.0.252" }, { "type": "ipv4", "value": "239.255.255.250" }, { "type": "ipv4", "value": "40.126.26.134" }, { "type": "ipv4", "value": "40.126.26.135" }, { "type": "ipv4", "value": "40.83.240.146" }, { "type": "ipv4", "value": "52.109.8.19" }, { "type": "ipv4", "value": "52.113.196.254" }, { "type": "ipv4", "value": "52.182.143.208" }, { "type": "ipv4", "value": "72.21.81.200" } ], "shared_count": 35, "status": "shared-observation-not-common-campaign" }, { "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "session_id": "ce8cf5b8-2927-4b30-804c-2fedaec840f1", "source_sha256": "c48854c24223cf7b4e9880ea72a21a877e4138e4ce36df7b7656e5c6c4043f68", "shared_observables": [ { "type": "domain", "value": "api.msn.com" }, { "type": "domain", "value": "client.wns.windows.com" }, { "type": "domain", "value": "settings-win.data.microsoft.com" }, { "type": "domain", "value": "v10.events.data.microsoft.com" }, { "type": "domain", "value": "www.bing.com" }, { "type": "ipv4", "value": "204.79.197.203" }, { "type": "ipv4", "value": "224.0.0.22" }, { "type": "ipv4", "value": "224.0.0.251" }, { "type": "ipv4", "value": "224.0.0.252" }, { "type": "ipv4", "value": "239.255.255.250" } ], "shared_count": 10, "status": "shared-observation-not-common-campaign" }, { "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "session_id": "a894fbbc-d0d5-4309-bd04-2eda8773adfa", "source_sha256": "e154de6895c5f0a9edd07b1279b33014507236dbb44a449790c255b87a327a3c", "shared_observables": [ { "type": "domain", "value": "api.msn.com" }, { "type": "domain", "value": "client.wns.windows.com" }, { "type": "domain", "value": "fe2cr.update.microsoft.com" }, { "type": "domain", "value": "fe3cr.delivery.mp.microsoft.com" }, { "type": "domain", "value": "fp.msedge.net" }, { "type": "domain", "value": "settings-win.data.microsoft.com" }, { "type": "domain", "value": "v10.events.data.microsoft.com" }, { "type": "domain", "value": "www.bing.com" }, { "type": "ipv4", "value": "204.79.197.203" }, { "type": "ipv4", "value": "204.79.197.222" }, { "type": "ipv4", "value": "224.0.0.22" }, { "type": "ipv4", "value": "224.0.0.251" }, { "type": "ipv4", "value": "224.0.0.252" }, { "type": "ipv4", "value": "239.255.255.250" }, { "type": "ipv4", "value": "52.137.106.217" } ], "shared_count": 15, "status": "shared-observation-not-common-campaign" }, { "analysis_id": "faf041c3-70e0-4a01-8780-10917e5e187c", "session_id": "df6c55a2-3630-4e95-82d0-0eebb41c3b51", "source_sha256": "8fee06d0b1686faab4364f5b7a741e736ad7e713d5ca9299ff9161a4b4d4862e", "shared_observables": [ { "type": "domain", "value": "api.msn.com" }, { "type": "domain", "value": "client.wns.windows.com" }, { "type": "domain", "value": "ctldl.windowsupdate.com" }, { "type": "domain", "value": "dns.msftncsi.com" }, { "type": "domain", "value": "download.windowsupdate.com" }, { "type": "domain", "value": "settings-win.data.microsoft.com" }, { "type": "domain", "value": "v10.events.data.microsoft.com" }, { "type": "domain", "value": "www.bing.com" }, { "type": "ipv4", "value": "131.107.255.255" }, { "type": "ipv4", "value": "204.79.197.203" }, { "type": "ipv4", "value": "224.0.0.251" }, { "type": "ipv4", "value": "224.0.0.252" } ], "shared_count": 12, "status": "shared-observation-not-common-campaign" }, { "analysis_id": "08324647-35af-4af2-8d82-4387eec03918", "session_id": "426471ed-5e63-4b7e-ac6c-d36e060a4739", "source_sha256": "a38267943a7bf3b0e445d7e51cb0a68b3dee797d67081bc9a033f73d079c0f50", "shared_observables": [ { "type": "domain", "value": "api.msn.com" }, { "type": "domain", "value": "client.wns.windows.com" }, { "type": "domain", "value": "ctldl.windowsupdate.com" }, { "type": "domain", "value": "dns.msftncsi.com" }, { "type": "domain", "value": "fe3cr.delivery.mp.microsoft.com" }, { "type": "domain", "value": "login.live.com" }, { "type": "domain", "value": "v10.events.data.microsoft.com" }, { "type": "domain", "value": "www.bing.com" }, { "type": "ipv4", "value": "131.107.255.255" }, { "type": "ipv4", "value": "20.42.73.25" }, { "type": "ipv4", "value": "204.79.197.203" }, { "type": "ipv4", "value": "224.0.0.251" }, { "type": "ipv4", "value": "224.0.0.252" }, { "type": "ipv4", "value": "239.255.255.250" } ], "shared_count": 14, "status": "shared-observation-not-common-campaign" }, { "analysis_id": "616a90fa-f15e-4fcb-8d56-7b8e0eff5785", "session_id": "1ea146b9-1fb6-4be9-8adc-154756a8642c", "source_sha256": "21bb800849459709a7ceb5513573b2b20f090ffccd00eb89b9886feedd47a2df", "shared_observables": [ { "type": "domain", "value": "login.live.com" }, { "type": "domain", "value": "settings-win.data.microsoft.com" }, { "type": "domain", "value": "v10.events.data.microsoft.com" }, { "type": "domain", "value": "www.bing.com" } ], "shared_count": 4, "status": "shared-observation-not-common-campaign" }, { "analysis_id": "459e119d-191f-49e8-85ea-c78f9de41826", "session_id": "45dead98-56f7-41bd-bcd0-62bcf13e9f9b", "source_sha256": "0ea6b597732a9ce6af9a7e3adff4512c9a91b4bce27184c8fdeb746f05cce170", "shared_observables": [ { "type": "domain", "value": "api.msn.com" }, { "type": "domain", "value": "au.download.windowsupdate.com" }, { "type": "domain", "value": "client.wns.windows.com" }, { "type": "domain", "value": "ctldl.windowsupdate.com" }, { "type": "domain", "value": "download.windowsupdate.com" }, { "type": "domain", "value": "fe2cr.update.microsoft.com" }, { "type": "domain", "value": "geo.prod.do.dsp.mp.microsoft.com" }, { "type": "domain", "value": "login.live.com" }, { "type": "domain", "value": "settings-win.data.microsoft.com" }, { "type": "domain", "value": "v10.events.data.microsoft.com" }, { "type": "domain", "value": "www.bing.com" }, { "type": "ipv4", "value": "204.79.197.203" }, { "type": "ipv4", "value": "224.0.0.22" }, { "type": "ipv4", "value": "224.0.0.251" }, { "type": "ipv4", "value": "224.0.0.252" } ], "shared_count": 15, "status": "shared-observation-not-common-campaign" }, { "analysis_id": "7a2cfe72-f48d-4894-8a2d-8889cb3b11b2", "session_id": "d201ef05-c1ff-4b51-bfb6-594810367b62", "source_sha256": "3dc470f5490ec15b4024c513e87c67e0b17caeae2a2ce3d83541be24ef407e61", "shared_observables": [ { "type": "domain", "value": "api.msn.com" }, { "type": "domain", "value": "client.wns.windows.com" }, { "type": "domain", "value": "ctldl.windowsupdate.com" }, { "type": "domain", "value": "settings-win.data.microsoft.com" }, { "type": "domain", "value": "update.googleapis.com" }, { "type": "domain", "value": "v10.events.data.microsoft.com" }, { "type": "domain", "value": "www.bing.com" }, { "type": "ipv4", "value": "204.79.197.203" }, { "type": "ipv4", "value": "224.0.0.251" }, { "type": "ipv4", "value": "224.0.0.252" }, { "type": "ipv4", "value": "239.255.255.250" }, { "type": "ipv4", "value": "52.137.106.217" } ], "shared_count": 12, "status": "shared-observation-not-common-campaign" }, { "analysis_id": "81373b30-6a59-49d1-89b0-bad73ed19eaa", "session_id": "28d700f9-1f64-46d0-ab25-5dd6123537fa", "source_sha256": "f755444d0b6eac847e07b73dea0774084b232d8577f536547a12f39b959d7833", "shared_observables": [ { "type": "domain", "value": "api.msn.com" }, { "type": "domain", "value": "client.wns.windows.com" }, { "type": "domain", "value": "dns.msftncsi.com" }, { "type": "domain", "value": "login.live.com" }, { "type": "domain", "value": "settings-win.data.microsoft.com" }, { "type": "domain", "value": "update.googleapis.com" }, { "type": "domain", "value": "v10.events.data.microsoft.com" }, { "type": "domain", "value": "www.bing.com" }, { "type": "ipv4", "value": "131.107.255.255" }, { "type": "ipv4", "value": "204.79.197.203" }, { "type": "ipv4", "value": "224.0.0.251" }, { "type": "ipv4", "value": "224.0.0.252" }, { "type": "ipv4", "value": "239.255.255.250" } ], "shared_count": 13, "status": "shared-observation-not-common-campaign" }, { "analysis_id": "38851ad7-b3a0-423d-ae89-3b7be4e4b908", "session_id": "d001b3fc-7e55-401a-8bb6-381e0c10fbda", "source_sha256": "33e274d7246f4eca8fbe7337c465c7ded077cd650d5d4d42481cad822c962741", "shared_observables": [ { "type": "domain", "value": "api.msn.com" }, { "type": "domain", "value": "client.wns.windows.com" }, { "type": "domain", "value": "ctldl.windowsupdate.com" }, { "type": "domain", "value": "dns.msftncsi.com" }, { "type": "domain", "value": "fp.msedge.net" }, { "type": "domain", "value": "geo.prod.do.dsp.mp.microsoft.com" }, { "type": "domain", "value": "k-ring.msedge.net" }, { "type": "domain", "value": "kv601.prod.do.dsp.mp.microsoft.com" }, { "type": "domain", "value": "login.live.com" }, { "type": "domain", "value": "settings-win.data.microsoft.com" }, { "type": "domain", "value": "teams-ring.msedge.net" }, { "type": "domain", "value": "v10.events.data.microsoft.com" }, { "type": "domain", "value": "www.bing.com" }, { "type": "ipv4", "value": "13.107.18.254" }, { "type": "ipv4", "value": "131.107.255.255" }, { "type": "ipv4", "value": "204.79.197.203" }, { "type": "ipv4", "value": "204.79.197.222" }, { "type": "ipv4", "value": "224.0.0.251" }, { "type": "ipv4", "value": "224.0.0.252" }, { "type": "ipv4", "value": "239.255.255.250" }, { "type": "ipv4", "value": "52.113.196.254" } ], "shared_count": 21, "status": "shared-observation-not-common-campaign" }, { "analysis_id": "bfccc426-aa9b-4007-8558-a66d37ecb90c", "session_id": "bc2c808d-5171-4ed5-9832-5cbf7c3a8866", "source_sha256": "e59db1c07c6fdefafa0abdbca03248c341cdc36c09c34753204d3162802a3586", "shared_observables": [ { "type": "domain", "value": "api.msn.com" }, { "type": "domain", "value": "au.download.windowsupdate.com" }, { "type": "domain", "value": "client.wns.windows.com" }, { "type": "domain", "value": "ctldl.windowsupdate.com" }, { "type": "domain", "value": "dns.msftncsi.com" }, { "type": "domain", "value": "download.windowsupdate.com" }, { "type": "domain", "value": "fe2cr.update.microsoft.com" }, { "type": "domain", "value": "geo.prod.do.dsp.mp.microsoft.com" }, { "type": "domain", "value": "login.live.com" }, { "type": "domain", "value": "settings-win.data.microsoft.com" }, { "type": "domain", "value": "v10.events.data.microsoft.com" }, { "type": "domain", "value": "www.bing.com" }, { "type": "domain", "value": "www.microsoft.com" }, { "type": "ipv4", "value": "131.107.255.255" }, { "type": "ipv4", "value": "204.79.197.203" }, { "type": "ipv4", "value": "224.0.0.251" }, { "type": "ipv4", "value": "224.0.0.252" }, { "type": "ipv4", "value": "239.255.255.250" } ], "shared_count": 18, "status": "shared-observation-not-common-campaign" } ], "interpretation": "No match means unknown in this corpus. Local CTI may postdate the capture. Matches and shared infrastructure require review; no automatic promotion or attribution.", "snapshot_sha256": "fd1ef8f35792013eb051dd90b6a512f313f5655d99849d97a044c7dc6beb785f" }, "techniques": [ { "attack_id": "T1105", "name": "Ingress Tool Transfer", "tactic": "command-and-control", "confidence": 0.8, "evidence": "T1105 Ingress Tool Transfer", "review_status": "suggested", "evidence_start": 6294, "evidence_end": 6321, "evidence_source": "source-text", "llm_verified": true, "review_note": null, "reviewer": null, "reviewed_at": null } ], "apt_matches": [ { "group_attack_id": "G0123", "group_name": "Volatile Cedar", "similarity": 0.2, "shared_count": 1, "shared_techniques": [ "T1105" ] }, { "group_attack_id": "G0044", "group_name": "Winnti Group", "similarity": 0.1667, "shared_count": 1, "shared_techniques": [ "T1105" ] }, { "group_attack_id": "G0130", "group_name": "Ajax Security Team", "similarity": 0.1667, "shared_count": 1, "shared_techniques": [ "T1105" ] }, { "group_attack_id": "G0136", "group_name": "IndigoZebra", "similarity": 0.1429, "shared_count": 1, "shared_techniques": [ "T1105" ] }, { "group_attack_id": "G0133", "group_name": "Nomadic Octopus", "similarity": 0.1429, "shared_count": 1, "shared_techniques": [ "T1105" ] }, { "group_attack_id": "G0107", "group_name": "Whitefly", "similarity": 0.1111, "shared_count": 1, "shared_techniques": [ "T1105" ] }, { "group_attack_id": "G1013", "group_name": "Metador", "similarity": 0.1111, "shared_count": 1, "shared_techniques": [ "T1105" ] }, { "group_attack_id": "G0066", "group_name": "Elderwood", "similarity": 0.1111, "shared_count": 1, "shared_techniques": [ "T1105" ] }, { "group_attack_id": "G0075", "group_name": "Rancor", "similarity": 0.1111, "shared_count": 1, "shared_techniques": [ "T1105" ] }, { "group_attack_id": "G0120", "group_name": "Evilnum", "similarity": 0.0909, "shared_count": 1, "shared_techniques": [ "T1105" ] } ] }