{ "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "session_id": "91100160-1a16-4165-bf1d-6b5876fb4e11", "status": "completed", "filename": "2022-01-07-traffic-analysis-exercise.pcap", "source_sha256": "a86b11ee443ee59d95e4590bdf761235c5d240128d6d195233d065ab57777e8b", "source_size_bytes": 4722992, "schema_version": "pcap-analysis-v1", "semantic_sha256": "d99f9f0718d2f13b17822949ddc765679358c5ce545ed0bc49ba70534ed25482", "analyzer_manifest": { "schema_version": "pcap-analyzer-manifest-v1", "profile_id": "tshark-evidence-v3", "rulepack_version": "pcap-rules-v3", "tshark_version": "TShark (Wireshark) 4.4.18.", "implementation_sha256": "9e8d2397c92213d4143ee2e4e2f86f0c1606d085cc7a81fd3ab98e687a5a9388", "capinfos_version": "Capinfos (Wireshark) 4.4.18.", "limits": { "max_upload_bytes": 536870912, "tool_timeout_seconds": 300, "max_tool_output_bytes": 268435456, "max_events_per_kind": 50000, "max_flows": 50000, "max_endpoints": 20000, "max_exported_objects": 500, "max_object_hash_index": 50000, "max_exported_object_bytes": 52428800, "max_exported_total_bytes": 268435456 }, "requested_fields_sha256": "fb9865915ed277886a75f522c6f27708f67e4e28e7a9d4a051ed816dd6783b15", "supported_profile_fields_sha256": "917cc2ac17024ecb151d0baaf8ddfb0767624db4f29d127ec668d6ebb5d80604", "profile_sha256": "7bdd5b06266e645efbbef1674e9934e21a27fcb37b084c18bcfe6abd8192ade3", "manifest_sha256": "ee952aeb7cdc6958f4ae5178c54c274a1e4f0aec4d42f3bdb95baaff063b3dde" }, "summary": "Decoded 5880 packets across 27 IP endpoints and 157 transport flows. Observed 88 DNS events, 24 HTTP requests, 24 TLS ClientHello events, and 14 exported HTTP object(s). Deterministic rules produced 8 finding(s): 0 high, 2 medium, and 6 low. Findings are evidence-bound candidates and require analyst review; encrypted payload contents remain unavailable.", "report": "# AdversaryGraph Deterministic PCAP Analysis\n\nSource: 2022-01-07-traffic-analysis-exercise.pcap\nCapture SHA-256: `a86b11ee443ee59d95e4590bdf761235c5d240128d6d195233d065ab57777e8b`\nSemantic result SHA-256: `d99f9f0718d2f13b17822949ddc765679358c5ce545ed0bc49ba70534ed25482`\nAnalyzer manifest SHA-256: `ee952aeb7cdc6958f4ae5178c54c274a1e4f0aec4d42f3bdb95baaff063b3dde`\n\n## Executive summary\n\nDecoded 5880 packets across 27 IP endpoints and 157 transport flows. Observed 88 DNS events, 24 HTTP requests, 24 TLS ClientHello events, and 14 exported HTTP object(s). Deterministic rules produced 8 finding(s): 0 high, 2 medium, and 6 low. Findings are evidence-bound candidates and require analyst review; encrypted payload contents remain unavailable.\n\n## Capture facts\n\n- Packets: 5880\n- Duration: 1172563861.65932 seconds\n- Captured bytes: 4628888\n- Endpoints: 27\n- Flows: 157\n\n## Deterministic findings\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v3`; confidence: 0.86; evidence: frame 5309 / TCP stream 76, frame 5315 / TCP stream 76, frame 5317 / TCP stream 76, frame 5636 / TCP stream 76.\n\nMetrics: `{\"content_type\":\"application/octet-stream\",\"declared_body_bytes\":307634,\"destination\":\"192.168.1.216\",\"response_count\":2,\"source\":\"23.38.189.225\",\"uri\":\"/c/msdownload/update/software/defu/2022/01/am_delta_patch_1.355.1569.0_f5fe52e10a18f6ce4bc39541e4aae4a97c270c81.exe\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v3`; confidence: 0.86; evidence: frame 5313 / TCP stream 77, frame 5316 / TCP stream 77.\n\nMetrics: `{\"content_type\":\"application/octet-stream\",\"declared_body_bytes\":2,\"destination\":\"192.168.1.216\",\"response_count\":1,\"source\":\"23.38.189.201\",\"uri\":\"/c/msdownload/update/software/defu/2022/01/am_delta_patch_1.355.1569.0_f5fe52e10a18f6ce4bc39541e4aae4a97c270c81.exe\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 246 / TCP stream 6, frame 253 / TCP stream 6, frame 254 / TCP stream 10, frame 257 / TCP stream 6, frame 262 / TCP stream 6.\n\nMetrics: `{\"destination\":\"192.168.1.216\",\"event_count\":30,\"operation_numbers\":[\"0\",\"1\",\"12\",\"13\",\"30\"],\"protocol\":\"drsuapi\",\"source\":\"192.168.1.2\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 29 / TCP stream 0, frame 191 / TCP stream 15, frame 213 / TCP stream 15, frame 219 / TCP stream 15, frame 221 / TCP stream 15.\n\nMetrics: `{\"destination\":\"192.168.1.216\",\"event_count\":47,\"operation_numbers\":[\"\",\"1\",\"4,19,19,19,5\",\"4,5\",\"5\"],\"protocol\":\"ldap\",\"source\":\"192.168.1.2\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 931 / TCP stream 43, frame 933 / TCP stream 43, frame 935 / TCP stream 43, frame 937 / TCP stream 43, frame 939 / TCP stream 43.\n\nMetrics: `{\"destination\":\"192.168.1.216\",\"event_count\":15,\"operation_numbers\":[\"1\",\"16\",\"17\",\"3\",\"34\",\"36\",\"39\",\"5\",\"6\",\"64\",\"7\"],\"protocol\":\"samr\",\"source\":\"192.168.1.2\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 241 / TCP stream 6, frame 251 / TCP stream 6, frame 252 / TCP stream 10, frame 255 / TCP stream 6, frame 256 / TCP stream 10.\n\nMetrics: `{\"destination\":\"192.168.1.2\",\"event_count\":30,\"operation_numbers\":[\"0\",\"1\",\"12\",\"13\",\"30\"],\"protocol\":\"drsuapi\",\"source\":\"192.168.1.216\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 27 / TCP stream 0, frame 189 / TCP stream 15, frame 210 / TCP stream 15, frame 218 / TCP stream 15, frame 220 / TCP stream 15.\n\nMetrics: `{\"destination\":\"192.168.1.2\",\"event_count\":58,\"operation_numbers\":[\"\",\"0\",\"2\",\"3\"],\"protocol\":\"ldap\",\"source\":\"192.168.1.216\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 930 / TCP stream 43, frame 932 / TCP stream 43, frame 934 / TCP stream 43, frame 936 / TCP stream 43, frame 938 / TCP stream 43.\n\nMetrics: `{\"destination\":\"192.168.1.2\",\"event_count\":15,\"operation_numbers\":[\"1\",\"16\",\"17\",\"3\",\"34\",\"36\",\"39\",\"5\",\"6\",\"64\",\"7\"],\"protocol\":\"samr\",\"source\":\"192.168.1.216\"}`\n\n## ATT&CK candidates\n\n- T1105 Ingress Tool Transfer (command-and-control), confidence=0.8, status=suggested; basis=versioned-deterministic-rule.\n\n## Identities\n\n- account: `desktop-gxmyno2$`; client IPs: 192.168.1.216; frames: 75, 108, 126, 127, 129\n- account: `steve.smith`; client IPs: 192.168.1.216; frames: 829, 837, 839, 851, 891\n- domain: `SPOONWATCH`; client IPs: 192.168.1.216; frames: 914\n- full-name: `Steve Smith`; client IPs: 192.168.1.216; frames: 945\n- hostname: `DESKTOP-GXMYNO2`; client IPs: 192.168.1.216; frames: 1, 694, 756, 757, 914\n- hostname: `DESKTOP-GXNYNO2`; client IPs: 192.168.1.216; frames: 35, 51, 367, 395, 595\n- netbios-group: `SPOONWATCH`; client IPs: unbound subject; frames: 34, 366, 581, 596, 598\n\n## IOC and artifact candidates\n\n- domain: `api.msn.com`; roles: dns-query, tls-sni\n- domain: `au.download.windowsupdate.com`; roles: dns-query, http-host\n- domain: `client.wns.windows.com`; roles: dns-query, tls-sni\n- domain: `cp801.prod.do.dsp.mp.microsoft.com`; roles: dns-query, tls-sni\n- domain: `ctldl.windowsupdate.com`; roles: dns-query, http-host\n- domain: `dns.msftncsi.com`; roles: dns-query\n- domain: `download.windowsupdate.com`; roles: dns-query, http-host\n- domain: `fe2cr.update.microsoft.com`; roles: dns-query, tls-sni\n- domain: `fe3cr.delivery.mp.microsoft.com`; roles: dns-query, tls-sni\n- domain: `geo.prod.do.dsp.mp.microsoft.com`; roles: dns-query, tls-sni\n- domain: `kv801.prod.do.dsp.mp.microsoft.com`; roles: dns-query, tls-sni\n- domain: `pti.store.microsoft.com`; roles: dns-query, tls-sni\n- domain: `self.events.data.microsoft.com`; roles: dns-query, tls-sni\n- domain: `settings-win.data.microsoft.com`; roles: dns-query, tls-sni\n- domain: `settingsfd-geo.trafficmanager.net`; roles: dns-cname\n- domain: `spoonwatch-dc.spoonwatch.net`; roles: dns-query\n- domain: `spoonwatch.net`; roles: dns-query\n- domain: `v10.events.data.microsoft.com`; roles: dns-query, tls-sni\n- domain: `v20.events.data.microsoft.com`; roles: dns-query, tls-sni\n- domain: `wns.notify.trafficmanager.net`; roles: dns-cname\n- domain: `wpad.localdomain`; roles: dns-query\n- domain: `wpad.spoonwatch.net`; roles: dns-query\n- domain: `www.bing.com`; roles: dns-query, tls-sni\n- ipv4: `0.0.0.0`; roles: network-endpoint\n- ipv4: `104.212.67.47`; roles: dns-answer, network-endpoint\n- ipv4: `13.107.21.200`; roles: dns-answer\n- ipv4: `131.107.255.255`; roles: dns-answer\n- ipv4: `184.50.62.43`; roles: dns-answer, network-endpoint\n- ipv4: `192.168.1.1`; roles: network-endpoint\n- ipv4: `192.168.1.2`; roles: dns-answer, network-endpoint\n- ipv4: `192.168.1.216`; roles: network-endpoint\n- ipv4: `192.168.1.255`; roles: network-endpoint\n- ipv4: `2.56.57.108`; roles: http-host, network-endpoint\n- ipv4: `20.189.173.1`; roles: dns-answer, network-endpoint\n- ipv4: `20.50.80.210`; roles: dns-answer, network-endpoint\n- ipv4: `20.54.89.15`; roles: dns-answer, network-endpoint\n- ipv4: `204.79.197.200`; roles: dns-answer, network-endpoint\n- ipv4: `204.79.197.203`; roles: dns-answer, network-endpoint\n- ipv4: `224.0.0.22`; roles: network-endpoint\n- ipv4: `224.0.0.251`; roles: network-endpoint\n- ipv4: `224.0.0.252`; roles: network-endpoint\n- ipv4: `23.38.189.201`; roles: dns-answer, network-endpoint\n- ipv4: `23.38.189.225`; roles: dns-answer, network-endpoint\n- ipv4: `239.255.255.250`; roles: http-host, network-endpoint\n- ipv4: `255.255.255.255`; roles: network-endpoint\n- ipv4: `40.83.240.146`; roles: dns-answer, network-endpoint\n- ipv4: `52.168.112.67`; roles: dns-answer, network-endpoint\n- ipv4: `52.178.17.2`; roles: dns-answer, network-endpoint\n- ipv4: `52.179.216.235`; roles: dns-answer, network-endpoint\n- ipv4: `52.183.220.149`; roles: dns-answer, network-endpoint\n- ipv4: `52.238.248.1`; roles: dns-answer\n- ipv4: `52.249.36.204`; roles: dns-answer, network-endpoint\n- ipv4: `67.27.123.126`; roles: dns-answer\n- ipv4: `8.240.136.254`; roles: dns-answer\n- ipv4: `8.249.3.254`; roles: dns-answer\n- ipv4: `8.249.7.254`; roles: dns-answer\n- ipv4: `8.253.189.126`; roles: dns-answer, network-endpoint\n- ja3: `28a2c9bd18a11de089ef85a160da29e4`; roles: tls-client-fingerprint\n- ja3: `37f463bf4616ecd445d4a1937da06e19`; roles: tls-client-fingerprint\n- ja3: `3b5074b1b5d032e5620f69f9f700ff0e`; roles: tls-client-fingerprint\n- ja3: `6271f898ce5be7dd52b0fc260d0662b3`; roles: tls-client-fingerprint\n- ja3: `a0e9f5d64349fb13191bc781f81f42e1`; roles: tls-client-fingerprint\n- sha256: `0cb0222fbde977f15ebc3a7d555ed658763d9a3f507b3f7869416e1b2885adf2`; roles: exported-object\n- sha256: `16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660`; roles: exported-object\n- sha256: `18180895844cba1cd9d310f04e0cfa26cff43b84eebacdc74809edf0e165d082`; roles: exported-object\n- sha256: `1ecee6ff37e03c1160b8bf66d5ca8dc784e0b35fb9fd105f0964b314d310c07f`; roles: exported-object\n- sha256: `334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4`; roles: exported-object\n- sha256: `3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd`; roles: exported-object\n- sha256: `43536adef2ddcc811c28d35fa6ce3031029a2424ad393989db36169ff2995083`; roles: exported-object\n- sha256: `6482cf553a8dd0d2b4812ed1e4916423e9b233e77b3f73e8dcf1e1afdef0d1e9`; roles: exported-object\n- sha256: `7b8ab07521c24e8ec610611e7e15d2fd39336166db6509885b8500d2a2bbfb14`; roles: exported-object\n- sha256: `835eb064fabd072bd2aa6079f0b0949fbaf6fb677369c1a0cadcec666dbfffc7`; roles: exported-object\n- sha256: `9b8db510ef42b8ed54a3712636fda55a4f8cfcd5493e20b74ab00cd4f3979f2d`; roles: exported-object\n- sha256: `a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba`; roles: exported-object\n- sha256: `c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d`; roles: exported-object\n- sha256: `e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78`; roles: exported-object\n- url: `http://2.56.57.108/osk/`; roles: http-request\n- url: `http://2.56.57.108/osk//1.jpg`; roles: http-request\n- url: `http://2.56.57.108/osk//2.jpg`; roles: http-request\n- url: `http://2.56.57.108/osk//3.jpg`; roles: http-request\n- url: `http://2.56.57.108/osk//4.jpg`; roles: http-request\n- url: `http://2.56.57.108/osk//5.jpg`; roles: http-request\n- url: `http://2.56.57.108/osk//6.jpg`; roles: http-request\n- url: `http://2.56.57.108/osk//7.jpg`; roles: http-request\n- url: `http://2.56.57.108/osk//main.php`; roles: http-request\n- url: `http://239.255.255.250:1900*`; roles: http-request\n- url: `http://au.download.windowsupdate.com/c/msdownload/update/software/defu/2022/01/am_delta_patch_1.355.1569.0_f5fe52e10a18f6ce4bc39541e4aae4a97c270c81.exe`; roles: http-request\n- url: `http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?f622d06ddf57408d`; roles: http-request\n- url: `http://download.windowsupdate.com/c/msdownload/update/others/2022/01/35969515_2975e5b79f9857b7a2d7aa07e0d43359735c8e80.cab`; roles: http-request\n- url: `http://download.windowsupdate.com/c/msdownload/update/others/2022/01/35969516_5bcaf676a3e98426394e538836033ea5ce2bb8c3.cab`; roles: http-request\n- url: `http://download.windowsupdate.com/c/msdownload/update/others/2022/01/35969632_c422aaaf8becdd90e50fb6936708c77c7f97631f.cab`; roles: http-request\n- user_agent: `Microsoft-CryptoAPI/10.0`; roles: http-client\n- user_agent: `Microsoft-Delivery-Optimization/10.0`; roles: http-client\n- user_agent: `Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.32`; roles: http-client\n- exported object `5(1).jpg`; SHA-256 `e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78`; size 1246160 bytes\n Static content: `{\"content_kind\":\"pe\",\"features\":[],\"inspected_bytes\":262144,\"inspection_truncated\":true,\"interpretation\":\"Static content only; not proof of execution, intent, or malware family\"}`. Not execution proof.\n- exported object `1(1).jpg`; SHA-256 `16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660`; size 645592 bytes\n Static content: `{\"content_kind\":\"pe\",\"features\":[],\"inspected_bytes\":262144,\"inspection_truncated\":true,\"interpretation\":\"Static content only; not proof of execution, intent, or malware family\"}`. Not execution proof.\n- exported object `4(1).jpg`; SHA-256 `334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4`; size 440120 bytes\n Static content: `{\"content_kind\":\"pe\",\"features\":[],\"inspected_bytes\":262144,\"inspection_truncated\":true,\"interpretation\":\"Static content only; not proof of execution, intent, or malware family\"}`. Not execution proof.\n- exported object `2(1).jpg`; SHA-256 `a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba`; size 334288 bytes\n Static content: `{\"content_kind\":\"pe\",\"features\":[],\"inspected_bytes\":262144,\"inspection_truncated\":true,\"interpretation\":\"Static content only; not proof of execution, intent, or malware family\"}`. Not execution proof.\n- exported object `am_delta_patch_1.355.1569.0_f5fe52e10a18f6ce4bc39541e4aae4a97c270c81(2).exe`; SHA-256 `6482cf553a8dd0d2b4812ed1e4916423e9b233e77b3f73e8dcf1e1afdef0d1e9`; size 307632 bytes\n Static content: `{\"content_kind\":\"pe\",\"features\":[],\"inspected_bytes\":262144,\"inspection_truncated\":true,\"interpretation\":\"Static content only; not proof of execution, intent, or malware family\"}`. Not execution proof.\n- exported object `6(1).jpg`; SHA-256 `43536adef2ddcc811c28d35fa6ce3031029a2424ad393989db36169ff2995083`; size 144848 bytes\n Static content: `{\"content_kind\":\"pe\",\"features\":[{\"excerpt\":\"IEX\",\"feature\":\"dynamic-evaluation\",\"offset\":135147}],\"inspected_bytes\":144848,\"inspection_truncated\":false,\"interpretation\":\"Static content only; not proof of execution, intent, or malware family\"}`. Not execution proof.\n- exported object `3(1).jpg`; SHA-256 `3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd`; size 137168 bytes\n Static content: `{\"content_kind\":\"pe\",\"features\":[{\"excerpt\":\"IEX\",\"feature\":\"dynamic-evaluation\",\"offset\":126724}],\"inspected_bytes\":137168,\"inspection_truncated\":false,\"interpretation\":\"Static content only; not proof of execution, intent, or malware family\"}`. Not execution proof.\n- exported object `7(1).jpg`; SHA-256 `c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d`; size 83784 bytes\n Static content: `{\"content_kind\":\"pe\",\"features\":[],\"inspected_bytes\":83784,\"inspection_truncated\":false,\"interpretation\":\"Static content only; not proof of execution, intent, or malware family\"}`. Not execution proof.\n- exported object `osk`; SHA-256 `1ecee6ff37e03c1160b8bf66d5ca8dc784e0b35fb9fd105f0964b314d310c07f`; size 379629 bytes\n- exported object `35969632_c422aaaf8becdd90e50fb6936708c77c7f97631f.cab`; SHA-256 `18180895844cba1cd9d310f04e0cfa26cff43b84eebacdc74809edf0e165d082`; size 10885 bytes\n- exported object `35969516_5bcaf676a3e98426394e538836033ea5ce2bb8c3.cab`; SHA-256 `0cb0222fbde977f15ebc3a7d555ed658763d9a3f507b3f7869416e1b2885adf2`; size 7317 bytes\n- exported object `35969515_2975e5b79f9857b7a2d7aa07e0d43359735c8e80.cab`; SHA-256 `835eb064fabd072bd2aa6079f0b0949fbaf6fb677369c1a0cadcec666dbfffc7`; size 7313 bytes\n- exported object `1.jpg`; SHA-256 `7b8ab07521c24e8ec610611e7e15d2fd39336166db6509885b8500d2a2bbfb14`; size 25 bytes\n- exported object `am_delta_patch_1.355.1569.0_f5fe52e10a18f6ce4bc39541e4aae4a97c270c81(1).exe`; SHA-256 `9b8db510ef42b8ed54a3712636fda55a4f8cfcd5493e20b74ab00cd4f3979f2d`; size 2 bytes\n\n## Actor similarity leads\n\n- Volatile Cedar (G0123): 20% TTP overlap. This is an investigation lead, not attribution.\n- Winnti Group (G0044): 17% TTP overlap. This is an investigation lead, not attribution.\n- Ajax Security Team (G0130): 17% TTP overlap. This is an investigation lead, not attribution.\n- IndigoZebra (G0136): 14% TTP overlap. This is an investigation lead, not attribution.\n- Nomadic Octopus (G0133): 14% TTP overlap. This is an investigation lead, not attribution.\n- Whitefly (G0107): 11% TTP overlap. This is an investigation lead, not attribution.\n- Metador (G1013): 11% TTP overlap. This is an investigation lead, not attribution.\n- Elderwood (G0066): 11% TTP overlap. This is an investigation lead, not attribution.\n- Rancor (G0075): 11% TTP overlap. This is an investigation lead, not attribution.\n- Evilnum (G0120): 9% TTP overlap. This is an investigation lead, not attribution.\n\n## Local enrichment and correlations\n\nNo match means unknown in this corpus. Local CTI may postdate the capture. Matches and shared infrastructure require review; no automatic promotion or attribution.\nSnapshot: `4775c16cd4ef1258e6af0730109f96f3ed0ac43a533ee465dd460c85c852613e`; recorded 2026-09-19T12:09:31.260950+00:00; mode: local-only.\nCoverage: `{\"matched_observables\":0,\"no_exact_match\":94,\"observable_limit\":5000,\"observables_checked\":94,\"observables_total\":94,\"prior_case_limit_reached\":false,\"prior_cases_checked\":12,\"truncated\":false}`\n\n- Catalog T1105: https://attack.mitre.org/techniques/T1105; detection strategies: [{\"attack_id\":\"DET0060\",\"name\":\"Detect Ingress Tool Transfers via Behavioral Chain\",\"stix_id\":\"x-mitre-detection-strategy--67677c4c-5778-49eb-ae74-1920645b8554\"}]\n- Prior analysis `43bc93eb-d6db-4400-b983-b0dd404c8ca4` shares 27 observations. This does not establish a common campaign.\n- Prior analysis `6df36b51-4b44-4660-b534-2fa89705e807` shares 18 observations. This does not establish a common campaign.\n- Prior analysis `29aa3ef8-47c9-4c47-b4cc-1ff3e0708142` shares 13 observations. This does not establish a common campaign.\n- Prior analysis `b79032a8-d69e-4ac1-bdd4-542473fa8e3b` shares 15 observations. This does not establish a common campaign.\n- Prior analysis `faf041c3-70e0-4a01-8780-10917e5e187c` shares 14 observations. This does not establish a common campaign.\n- Prior analysis `08324647-35af-4af2-8d82-4387eec03918` shares 14 observations. This does not establish a common campaign.\n- Prior analysis `616a90fa-f15e-4fcb-8d56-7b8e0eff5785` shares 5 observations. This does not establish a common campaign.\n- Prior analysis `459e119d-191f-49e8-85ea-c78f9de41826` shares 18 observations. This does not establish a common campaign.\n- Prior analysis `7a2cfe72-f48d-4894-8a2d-8889cb3b11b2` shares 15 observations. This does not establish a common campaign.\n- Prior analysis `81373b30-6a59-49d1-89b0-bad73ed19eaa` shares 12 observations. This does not establish a common campaign.\n- Prior analysis `38851ad7-b3a0-423d-ae89-3b7be4e4b908` shares 14 observations. This does not establish a common campaign.\n- Prior analysis `bfccc426-aa9b-4007-8558-a66d37ecb90c` shares 21 observations. This does not establish a common campaign.\n- External provider queries: 0. Not requested; no unknown indicator is classified as benign.\n\n## Coverage and limitations\n\n- Packet and protocol facts are deterministic for the recorded analyzer manifest.\n- Encrypted application payloads are not decrypted; only available metadata is reported.\n- ATT&CK mappings and actor overlaps are candidates until analyst review and promotion.\n- HTTP object inventory: `{\"compact_objects\":0,\"complete\":true,\"detailed_objects\":14,\"exported_objects\":22,\"hashed_bytes\":3744940,\"hashed_objects\":22,\"omitted_unique_hashes\":0,\"returned_unique_hashes\":14,\"selection\":\"content-classified first, then size descending, SHA256 tie-break; deduplicated by full hash; overflow retains a compact hash index\",\"unhashed_objects\":0,\"unique_hashes\":14}`. Compact overflow hashes are retained in JSON coverage and observables.\n- A directory subject is not necessarily a logged-in user; consult identity bindings in the JSON evidence.\n- Rendered / available: findings 8/8, identities 7/7, observables 94/94, artifacts 14/14. Full returned inventory is in the JSON result.\n", "result": { "schema_version": "pcap-analysis-v1", "analysis_key_material": { "source_sha256": "a86b11ee443ee59d95e4590bdf761235c5d240128d6d195233d065ab57777e8b", "analyzer_manifest_sha256": "ee952aeb7cdc6958f4ae5178c54c274a1e4f0aec4d42f3bdb95baaff063b3dde", "rulepack_version": "pcap-rules-v3" }, "analyzer_manifest": { "schema_version": "pcap-analyzer-manifest-v1", "profile_id": "tshark-evidence-v3", "rulepack_version": "pcap-rules-v3", "tshark_version": "TShark (Wireshark) 4.4.18.", "implementation_sha256": "9e8d2397c92213d4143ee2e4e2f86f0c1606d085cc7a81fd3ab98e687a5a9388", "capinfos_version": "Capinfos (Wireshark) 4.4.18.", "limits": { "max_upload_bytes": 536870912, "tool_timeout_seconds": 300, "max_tool_output_bytes": 268435456, "max_events_per_kind": 50000, "max_flows": 50000, "max_endpoints": 20000, "max_exported_objects": 500, "max_object_hash_index": 50000, "max_exported_object_bytes": 52428800, "max_exported_total_bytes": 268435456 }, "requested_fields_sha256": "fb9865915ed277886a75f522c6f27708f67e4e28e7a9d4a051ed816dd6783b15", "supported_profile_fields_sha256": "917cc2ac17024ecb151d0baaf8ddfb0767624db4f29d127ec668d6ebb5d80604", "profile_sha256": "7bdd5b06266e645efbbef1674e9934e21a27fcb37b084c18bcfe6abd8192ade3", "manifest_sha256": "ee952aeb7cdc6958f4ae5178c54c274a1e4f0aec4d42f3bdb95baaff063b3dde" }, "capture": { "packet_count": 5880, "captured_bytes": 4628888, "first_packet_epoch": "469008338.376658", "last_packet_epoch": "1641572200.035978", "duration_seconds": 1172563861.65932, "interface_ids": [], "encapsulation_types": [ 1 ], "format": "pcap-le-microsecond", "source_sha256": "a86b11ee443ee59d95e4590bdf761235c5d240128d6d195233d065ab57777e8b", "source_size_bytes": 4722992, "protocol_counts": { "eth": 5880, "ethertype": 5880, "ip": 5850, "tcp": 5647, "x509sat": 479, "x509ce": 364, "tls": 268, "nbss": 256, "spnego-krb5": 254, "smb2": 222, "udp": 195, "dcerpc": 186, "ldap": 111, "gss-api": 107, "dns": 88, "spnego": 75, "nbns": 51, "kerberos": 48, "pkix1implicit": 48, "smb": 39, "cldap": 32, "http": 32, "arp": 30, "data": 24, "igmp": 16, "ntlmssp": 15, "pkix1explicit": 13, "media": 11, "ocsp": 10, "browser": 9, "mime_multipart": 9, "nbdgm": 9, "ssdp": 8, "pkcs-1": 6, "dhcp": 2, "mdns": 2, "ntp": 2, "llmnr": 1 } }, "endpoints": [ { "endpoint_id": "endpoint-0ad5b133e019ced47e9fe54d", "ip": "0.0.0.0", "ip_version": 4, "is_private": true, "mac_addresses": [ "9c:5c:8e:32:58:f9" ], "packets_sent": 1, "packets_received": 0, "bytes_sent": 379, "bytes_received": 0, "first_seen_epoch": "1641571449.195191", "last_seen_epoch": "1641571449.195191", "evidence_frames": [ 1 ] }, { "endpoint_id": "endpoint-8539652a8e1e792318de6af5", "ip": "104.212.67.47", "ip_version": 4, "is_private": false, "mac_addresses": [ "1c:17:d3:f6:df:0a" ], "packets_sent": 17, "packets_received": 13, "bytes_sent": 7772, "bytes_received": 2866, "first_seen_epoch": "1641571629.863062", "last_seen_epoch": "1641571630.517165", "evidence_frames": [ 1438, 1445, 1446, 1447, 1448 ] }, { "endpoint_id": "endpoint-e878702438be8cd9f575da80", "ip": "184.50.62.43", "ip_version": 4, "is_private": false, "mac_addresses": [ "1c:17:d3:f6:df:0a" ], "packets_sent": 29, "packets_received": 22, "bytes_sent": 15153, "bytes_received": 2882, "first_seen_epoch": "1641572062.085609", "last_seen_epoch": "1641572081.420959", "evidence_frames": [ 5261, 5264, 5265, 5266, 5267 ] }, { "endpoint_id": "endpoint-434e71670b1ab54f4b449a32", "ip": "192.168.1.1", "ip_version": 4, "is_private": true, "mac_addresses": [ "1c:17:d3:f6:df:0a" ], "packets_sent": 1, "packets_received": 33, "bytes_sent": 342, "bytes_received": 3576, "first_seen_epoch": "1641571449.195531", "last_seen_epoch": "1641572172.27142", "evidence_frames": [ 2, 34, 35, 51, 366 ] }, { "endpoint_id": "endpoint-02a3d9fc89dc376b145a075a", "ip": "192.168.1.2", "ip_version": 4, "is_private": true, "mac_addresses": [ "20:47:47:62:ae:26" ], "packets_sent": 576, "packets_received": 647, "bytes_sent": 147159, "bytes_received": 161912, "first_seen_epoch": "1641571449.662793", "last_seen_epoch": "1641572200.035978", "evidence_frames": [ 16, 17, 18, 19, 20 ] }, { "endpoint_id": "endpoint-5bb77c7a0d75aebcdcde84d1", "ip": "192.168.1.216", "ip_version": 4, "is_private": true, "mac_addresses": [ "9c:5c:8e:32:58:f9" ], "packets_sent": 2176, "packets_received": 3673, "bytes_sent": 746500, "bytes_received": 3880749, "first_seen_epoch": "469008338.376658", "last_seen_epoch": "1641572200.035978", "evidence_frames": [ 2, 3, 4, 6, 7 ] }, { "endpoint_id": "endpoint-303ab513d4cd1194d2123a81", "ip": "192.168.1.255", "ip_version": 4, "is_private": true, "mac_addresses": [ "ff:ff:ff:ff:ff:ff" ], "packets_sent": 0, "packets_received": 26, "bytes_sent": 0, "bytes_received": 3949, "first_seen_epoch": "1641571454.466709", "last_seen_epoch": "1641572199.99212", "evidence_frames": [ 603, 604, 676, 677, 678 ] }, { "endpoint_id": "endpoint-e3a00da1eca3ec80c7389696", "ip": "2.56.57.108", "ip_version": 4, "is_private": false, "mac_addresses": [ "1c:17:d3:f6:df:0a" ], "packets_sent": 2387, "packets_received": 948, "bytes_sent": 3163815, "bytes_received": 435174, "first_seen_epoch": "469008338.376658", "last_seen_epoch": "1641571657.145044", "evidence_frames": [ 1498, 1499, 1500, 1501, 1502 ] }, { "endpoint_id": "endpoint-b95c99b4ffdccc1787482fc8", "ip": "20.189.173.1", "ip_version": 4, "is_private": false, "mac_addresses": [ "1c:17:d3:f6:df:0a" ], "packets_sent": 32, "packets_received": 25, "bytes_sent": 8220, "bytes_received": 18970, "first_seen_epoch": "1641571594.652673", "last_seen_epoch": "1641571595.730965", "evidence_frames": [ 1353, 1354, 1355, 1356, 1357 ] }, { "endpoint_id": "endpoint-d274837c301d9929c55f6dfa", "ip": "20.50.80.210", "ip_version": 4, "is_private": false, "mac_addresses": [ "1c:17:d3:f6:df:0a" ], "packets_sent": 13, "packets_received": 9, "bytes_sent": 5566, "bytes_received": 2403, "first_seen_epoch": "1641571493.105998", "last_seen_epoch": "1641571494.000719", "evidence_frames": [ 1039, 1040, 1041, 1042, 1043 ] }, { "endpoint_id": "endpoint-0d8cf95c8d63763e4c506880", "ip": "20.54.89.15", "ip_version": 4, "is_private": false, "mac_addresses": [ "1c:17:d3:f6:df:0a" ], "packets_sent": 31, "packets_received": 26, "bytes_sent": 6531, "bytes_received": 16574, "first_seen_epoch": "1641572059.425608", "last_seen_epoch": "1641572061.606902", "evidence_frames": [ 5150, 5151, 5152, 5153, 5154 ] }, { "endpoint_id": "endpoint-2babe64f5ac67a5e5b843c18", "ip": "204.79.197.200", "ip_version": 4, "is_private": false, "mac_addresses": [ "1c:17:d3:f6:df:0a" ], "packets_sent": 49, "packets_received": 49, "bytes_sent": 24335, "bytes_received": 10832, "first_seen_epoch": "1641571496.553567", "last_seen_epoch": "1641572171.064829", "evidence_frames": [ 1087, 1088, 1089, 1090, 1091 ] }, { "endpoint_id": "endpoint-6d0131ca7597d5f96e39d52c", "ip": "204.79.197.203", "ip_version": 4, "is_private": false, "mac_addresses": [ "1c:17:d3:f6:df:0a" ], "packets_sent": 12, "packets_received": 11, "bytes_sent": 9234, "bytes_received": 1591, "first_seen_epoch": "1641571494.131381", "last_seen_epoch": "1641571562.584109", "evidence_frames": [ 1063, 1064, 1065, 1066, 1067 ] }, { "endpoint_id": "endpoint-1241bb5112879d8c71bab689", "ip": "224.0.0.22", "ip_version": 4, "is_private": false, "mac_addresses": [ "01:00:5e:00:00:16" ], "packets_sent": 0, "packets_received": 8, "bytes_sent": 0, "bytes_received": 440, "first_seen_epoch": "1641571449.283946", "last_seen_epoch": "1641571492.795628", "evidence_frames": [ 3, 4, 6, 7, 8 ] }, { "endpoint_id": "endpoint-28e9c9902620ee85024bed99", "ip": "224.0.0.251", "ip_version": 4, "is_private": false, "mac_addresses": [ "01:00:5e:00:00:fb" ], "packets_sent": 0, "packets_received": 2, "bytes_sent": 0, "bytes_received": 172, "first_seen_epoch": "1641571449.337155", "last_seen_epoch": "1641571449.337975", "evidence_frames": [ 9, 10 ] }, { "endpoint_id": "endpoint-02ccf8414566427163ee5748", "ip": "224.0.0.252", "ip_version": 4, "is_private": false, "mac_addresses": [ "01:00:5e:00:00:fc" ], "packets_sent": 0, "packets_received": 1, "bytes_sent": 0, "bytes_received": 75, "first_seen_epoch": "1641571449.34657", "last_seen_epoch": "1641571449.34657", "evidence_frames": [ 11 ] }, { "endpoint_id": "endpoint-86282483ec580c40dc6901da", "ip": "23.38.189.201", "ip_version": 4, "is_private": false, "mac_addresses": [ "1c:17:d3:f6:df:0a" ], "packets_sent": 5, "packets_received": 6, "bytes_sent": 664, "bytes_received": 672, "first_seen_epoch": "1641572062.438638", "last_seen_epoch": "1641572092.676286", "evidence_frames": [ 5305, 5311, 5312, 5313, 5314 ] }, { "endpoint_id": "endpoint-e8f1b270d6d8e922ee5e1d7a", "ip": "23.38.189.225", "ip_version": 4, "is_private": false, "mac_addresses": [ "1c:17:d3:f6:df:0a" ], "packets_sent": 246, "packets_received": 127, "bytes_sent": 348291, "bytes_received": 8306, "first_seen_epoch": "1641572058.224318", "last_seen_epoch": "1641572092.677261", "evidence_frames": [ 5044, 5045, 5046, 5047, 5048 ] }, { "endpoint_id": "endpoint-7988d8f95f8baa8865403eb5", "ip": "239.255.255.250", "ip_version": 4, "is_private": false, "mac_addresses": [ "01:00:5e:7f:ff:fa" ], "packets_sent": 0, "packets_received": 8, "bytes_sent": 0, "bytes_received": 1432, "first_seen_epoch": "1641572065.601007", "last_seen_epoch": "1641572071.597874", "evidence_frames": [ 5688, 5689, 5690, 5691, 5692 ] }, { "endpoint_id": "endpoint-1066efcd2ba7d5625e92b15d", "ip": "255.255.255.255", "ip_version": 4, "is_private": true, "mac_addresses": [ "ff:ff:ff:ff:ff:ff" ], "packets_sent": 0, "packets_received": 1, "bytes_sent": 0, "bytes_received": 379, "first_seen_epoch": "1641571449.195191", "last_seen_epoch": "1641571449.195191", "evidence_frames": [ 1 ] }, { "endpoint_id": "endpoint-d6ae85649b47591f1067b0ac", "ip": "40.83.240.146", "ip_version": 4, "is_private": false, "mac_addresses": [ "1c:17:d3:f6:df:0a" ], "packets_sent": 15, "packets_received": 12, "bytes_sent": 5436, "bytes_received": 2909, "first_seen_epoch": "1641571629.758888", "last_seen_epoch": "1641571630.226689", "evidence_frames": [ 1431, 1433, 1434, 1435, 1436 ] }, { "endpoint_id": "endpoint-e3250ed5c7affe997f2946da", "ip": "52.168.112.67", "ip_version": 4, "is_private": false, "mac_addresses": [ "1c:17:d3:f6:df:0a" ], "packets_sent": 39, "packets_received": 37, "bytes_sent": 15912, "bytes_received": 18385, "first_seen_epoch": "1641571461.715656", "last_seen_epoch": "1641571892.363718", "evidence_frames": [ 762, 768, 769, 770, 771 ] }, { "endpoint_id": "endpoint-6f439b087495cf828c9cf2bc", "ip": "52.178.17.2", "ip_version": 4, "is_private": false, "mac_addresses": [ "1c:17:d3:f6:df:0a" ], "packets_sent": 69, "packets_received": 53, "bytes_sent": 28049, "bytes_received": 19940, "first_seen_epoch": "1641572058.364959", "last_seen_epoch": "1641572072.936913", "evidence_frames": [ 5085, 5110, 5111, 5112, 5113 ] }, { "endpoint_id": "endpoint-75a71a7a2167fbf6f19423fb", "ip": "52.179.216.235", "ip_version": 4, "is_private": false, "mac_addresses": [ "1c:17:d3:f6:df:0a" ], "packets_sent": 13, "packets_received": 11, "bytes_sent": 3875, "bytes_received": 1286, "first_seen_epoch": "1641572061.713827", "last_seen_epoch": "1641572062.095903", "evidence_frames": [ 5237, 5238, 5239, 5240, 5241 ] }, { "endpoint_id": "endpoint-8bf4587bc3fe53d7b53b7344", "ip": "52.183.220.149", "ip_version": 4, "is_private": false, "mac_addresses": [ "1c:17:d3:f6:df:0a" ], "packets_sent": 51, "packets_received": 39, "bytes_sent": 23619, "bytes_received": 5087, "first_seen_epoch": "1641571508.836384", "last_seen_epoch": "1641572052.212752", "evidence_frames": [ 1145, 1146, 1147, 1148, 1149 ] }, { "endpoint_id": "endpoint-c6373ef830e3d69762029970", "ip": "52.249.36.204", "ip_version": 4, "is_private": false, "mac_addresses": [ "1c:17:d3:f6:df:0a" ], "packets_sent": 83, "packets_received": 57, "bytes_sent": 66168, "bytes_received": 26444, "first_seen_epoch": "1641572057.610119", "last_seen_epoch": "1641572058.844458", "evidence_frames": [ 4938, 4939, 4940, 4941, 4942 ] }, { "endpoint_id": "endpoint-7153802250cfcb5d88abc584", "ip": "8.253.189.126", "ip_version": 4, "is_private": false, "mac_addresses": [ "1c:17:d3:f6:df:0a" ], "packets_sent": 5, "packets_received": 6, "bytes_sent": 608, "bytes_received": 623, "first_seen_epoch": "1641572117.893981", "last_seen_epoch": "1641572177.970807", "evidence_frames": [ 5776, 5777, 5778, 5779, 5780 ] } ], "identities": [ { "identity_id": "identity-abb2d446808afab74c49aa3a", "type": "account", "value": "desktop-gxmyno2$", "ip_addresses": [ "192.168.1.216" ], "mac_addresses": [ "9c:5c:8e:32:58:f9" ], "evidence": [ { "frame_number": 75, "timestamp_epoch": "1641571450.952502000", "display_filter": "frame.number == 75", "tcp_stream": 2 }, { "frame_number": 108, "timestamp_epoch": "1641571450.966124000", "display_filter": "frame.number == 108", "tcp_stream": 7 }, { "frame_number": 126, "timestamp_epoch": "1641571450.978225000", "display_filter": "frame.number == 126", "tcp_stream": 9 }, { "frame_number": 127, "timestamp_epoch": "1641571450.978271000", "display_filter": "frame.number == 127", "tcp_stream": 8 }, { "frame_number": 129, "timestamp_epoch": "1641571450.978973000", "display_filter": "frame.number == 129", "tcp_stream": 8 }, { "frame_number": 131, "timestamp_epoch": "1641571450.979011000", "display_filter": "frame.number == 131", "tcp_stream": 9 }, { "frame_number": 147, "timestamp_epoch": "1641571450.983292000", "display_filter": "frame.number == 147", "tcp_stream": 11 }, { "frame_number": 155, "timestamp_epoch": "1641571450.984540000", "display_filter": "frame.number == 155", "tcp_stream": 12 }, { "frame_number": 157, "timestamp_epoch": "1641571450.985092000", "display_filter": "frame.number == 157", "tcp_stream": 12 }, { "frame_number": 175, "timestamp_epoch": "1641571450.987159000", "display_filter": "frame.number == 175", "tcp_stream": 13 }, { "frame_number": 177, "timestamp_epoch": "1641571450.987278000", "display_filter": "frame.number == 177", "tcp_stream": 14 }, { "frame_number": 200, "timestamp_epoch": "1641571450.991397000", "display_filter": "frame.number == 200", "tcp_stream": 16 }, { "frame_number": 243, "timestamp_epoch": "1641571451.003567000", "display_filter": "frame.number == 243", "tcp_stream": 17 }, { "frame_number": 318, "timestamp_epoch": "1641571451.124781000", "display_filter": "frame.number == 318", "tcp_stream": 20 }, { "frame_number": 416, "timestamp_epoch": "1641571452.357882000", "display_filter": "frame.number == 416", "tcp_stream": 26 }, { "frame_number": 445, "timestamp_epoch": "1641571452.580512000", "display_filter": "frame.number == 445", "tcp_stream": 28 }, { "frame_number": 457, "timestamp_epoch": "1641571452.582126000", "display_filter": "frame.number == 457", "tcp_stream": 29 }, { "frame_number": 725, "timestamp_epoch": "1641571460.169844000", "display_filter": "frame.number == 725", "tcp_stream": 35 }, { "frame_number": 733, "timestamp_epoch": "1641571460.171188000", "display_filter": "frame.number == 733", "tcp_stream": 36 }, { "frame_number": 735, "timestamp_epoch": "1641571460.171965000", "display_filter": "frame.number == 735", "tcp_stream": 36 } ], "bindings": [ { "frame_number": 75, "relationship": "kerberos-client-principal", "owner_ip": "192.168.1.216", "conversation_src": "192.168.1.216", "conversation_dst": "192.168.1.2", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 108, "relationship": "kerberos-client-principal", "owner_ip": "192.168.1.216", "conversation_src": "192.168.1.216", "conversation_dst": "192.168.1.2", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 126, "relationship": "kerberos-client-principal", "owner_ip": "192.168.1.216", "conversation_src": "192.168.1.216", "conversation_dst": "192.168.1.2", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 127, "relationship": "kerberos-client-principal", "owner_ip": "192.168.1.216", "conversation_src": "192.168.1.216", "conversation_dst": "192.168.1.2", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 129, "relationship": "kerberos-client-principal", "owner_ip": "192.168.1.216", "conversation_src": "192.168.1.2", "conversation_dst": "192.168.1.216", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 131, "relationship": "kerberos-client-principal", "owner_ip": "192.168.1.216", "conversation_src": "192.168.1.2", "conversation_dst": "192.168.1.216", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 147, "relationship": "kerberos-client-principal", "owner_ip": "192.168.1.216", "conversation_src": "192.168.1.216", "conversation_dst": "192.168.1.2", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 155, "relationship": "kerberos-client-principal", "owner_ip": "192.168.1.216", "conversation_src": "192.168.1.216", "conversation_dst": "192.168.1.2", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 157, "relationship": "kerberos-client-principal", "owner_ip": "192.168.1.216", "conversation_src": "192.168.1.2", "conversation_dst": "192.168.1.216", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 175, "relationship": "kerberos-client-principal", "owner_ip": "192.168.1.216", "conversation_src": "192.168.1.2", "conversation_dst": "192.168.1.216", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 177, "relationship": "kerberos-client-principal", "owner_ip": "192.168.1.216", "conversation_src": "192.168.1.2", "conversation_dst": "192.168.1.216", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 200, "relationship": "kerberos-client-principal", "owner_ip": "192.168.1.216", "conversation_src": "192.168.1.2", "conversation_dst": "192.168.1.216", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 243, "relationship": "kerberos-client-principal", "owner_ip": "192.168.1.216", "conversation_src": "192.168.1.2", "conversation_dst": "192.168.1.216", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 318, "relationship": "kerberos-client-principal", "owner_ip": "192.168.1.216", "conversation_src": "192.168.1.2", "conversation_dst": "192.168.1.216", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 416, "relationship": "kerberos-client-principal", "owner_ip": "192.168.1.216", "conversation_src": "192.168.1.2", "conversation_dst": "192.168.1.216", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 445, "relationship": "kerberos-client-principal", "owner_ip": "192.168.1.216", "conversation_src": "192.168.1.2", "conversation_dst": "192.168.1.216", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 457, "relationship": "kerberos-client-principal", "owner_ip": "192.168.1.216", "conversation_src": "192.168.1.2", "conversation_dst": "192.168.1.216", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 725, "relationship": "kerberos-client-principal", "owner_ip": "192.168.1.216", "conversation_src": "192.168.1.216", "conversation_dst": "192.168.1.2", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 733, "relationship": "kerberos-client-principal", "owner_ip": "192.168.1.216", "conversation_src": "192.168.1.216", "conversation_dst": "192.168.1.2", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 735, "relationship": "kerberos-client-principal", "owner_ip": "192.168.1.216", "conversation_src": "192.168.1.2", "conversation_dst": "192.168.1.216", "account": "", "source_field": "kerberos.CNameString" } ], "raw_values": [ "DESKTOP-GXMYNO2$", "desktop-gxmyno2$" ] }, { "identity_id": "identity-365401ea82bb1bcf88b24846", "type": "account", "value": "steve.smith", "ip_addresses": [ "192.168.1.216" ], "mac_addresses": [ "9c:5c:8e:32:58:f9" ], "evidence": [ { "frame_number": 829, "timestamp_epoch": "1641571491.641944000", "display_filter": "frame.number == 829", "tcp_stream": 39 }, { "frame_number": 837, "timestamp_epoch": "1641571491.650430000", "display_filter": "frame.number == 837", "tcp_stream": 40 }, { "frame_number": 839, "timestamp_epoch": "1641571491.651134000", "display_filter": "frame.number == 839", "tcp_stream": 40 }, { "frame_number": 851, "timestamp_epoch": "1641571491.653884000", "display_filter": "frame.number == 851", "tcp_stream": 41 }, { "frame_number": 891, "timestamp_epoch": "1641571491.749061000", "display_filter": "frame.number == 891", "tcp_stream": 45 }, { "frame_number": 914, "timestamp_epoch": "1641571491.757908000", "display_filter": "frame.number == 914", "tcp_stream": 43 }, { "frame_number": 945, "timestamp_epoch": "1641571491.767646000", "display_filter": "frame.number == 945", "tcp_stream": 43 }, { "frame_number": 976, "timestamp_epoch": "1641571491.976783000", "display_filter": "frame.number == 976", "tcp_stream": 47 }, { "frame_number": 988, "timestamp_epoch": "1641571491.978061000", "display_filter": "frame.number == 988", "tcp_stream": 48 } ], "bindings": [ { "frame_number": 829, "relationship": "kerberos-client-principal", "owner_ip": "192.168.1.216", "conversation_src": "192.168.1.216", "conversation_dst": "192.168.1.2", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 837, "relationship": "kerberos-client-principal", "owner_ip": "192.168.1.216", "conversation_src": "192.168.1.216", "conversation_dst": "192.168.1.2", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 839, "relationship": "kerberos-client-principal", "owner_ip": "192.168.1.216", "conversation_src": "192.168.1.2", "conversation_dst": "192.168.1.216", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 851, "relationship": "kerberos-client-principal", "owner_ip": "192.168.1.216", "conversation_src": "192.168.1.2", "conversation_dst": "192.168.1.216", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 891, "relationship": "kerberos-client-principal", "owner_ip": "192.168.1.216", "conversation_src": "192.168.1.2", "conversation_dst": "192.168.1.216", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 914, "relationship": "client-asserted", "owner_ip": "192.168.1.216", "conversation_src": "192.168.1.216", "conversation_dst": "192.168.1.2", "account": "", "source_field": "ntlmssp.auth.username" }, { "frame_number": 945, "relationship": "directory-subject-returned-to-client", "owner_ip": null, "conversation_src": "192.168.1.2", "conversation_dst": "192.168.1.216", "account": "steve.smith", "source_field": "samr.samr_UserInfo21.account_name" }, { "frame_number": 976, "relationship": "kerberos-client-principal", "owner_ip": "192.168.1.216", "conversation_src": "192.168.1.2", "conversation_dst": "192.168.1.216", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 988, "relationship": "kerberos-client-principal", "owner_ip": "192.168.1.216", "conversation_src": "192.168.1.2", "conversation_dst": "192.168.1.216", "account": "", "source_field": "kerberos.CNameString" } ], "raw_values": [ "steve.smith" ] }, { "identity_id": "identity-5bd6742609b9581037c4c48a", "type": "domain", "value": "SPOONWATCH", "ip_addresses": [ "192.168.1.216" ], "mac_addresses": [ "9c:5c:8e:32:58:f9" ], "evidence": [ { "frame_number": 914, "timestamp_epoch": "1641571491.757908000", "display_filter": "frame.number == 914", "tcp_stream": 43 } ], "bindings": [ { "frame_number": 914, "relationship": "client-asserted", "owner_ip": "192.168.1.216", "conversation_src": "192.168.1.216", "conversation_dst": "192.168.1.2", "account": "", "source_field": "ntlmssp.auth.domain" } ], "raw_values": [ "SPOONWATCH" ] }, { "identity_id": "identity-6dae22143111db7ea808966a", "type": "full-name", "value": "Steve Smith", "ip_addresses": [ "192.168.1.216" ], "mac_addresses": [], "evidence": [ { "frame_number": 945, "timestamp_epoch": "1641571491.767646000", "display_filter": "frame.number == 945", "tcp_stream": 43 } ], "bindings": [ { "frame_number": 945, "relationship": "directory-name-correlated-with-client-principal", "owner_ip": "192.168.1.216", "conversation_src": "192.168.1.2", "conversation_dst": "192.168.1.216", "account": "steve.smith", "source_field": "samr.samr_UserInfo21.full_name" } ], "raw_values": [ "Steve Smith" ] }, { "identity_id": "identity-39f8d603084a921de3d8af92", "type": "hostname", "value": "DESKTOP-GXMYNO2", "ip_addresses": [ "192.168.1.216" ], "mac_addresses": [ "9c:5c:8e:32:58:f9", "9c:5c:8e:32:58:f9,9c:5c:8e:32:58:f9" ], "evidence": [ { "frame_number": 1, "timestamp_epoch": "1641571449.195191000", "display_filter": "frame.number == 1", "udp_stream": 0 }, { "frame_number": 694, "timestamp_epoch": "1641571458.269061000", "display_filter": "frame.number == 694", "udp_stream": 32 }, { "frame_number": 756, "timestamp_epoch": "1641571460.439069000", "display_filter": "frame.number == 756", "udp_stream": 32 }, { "frame_number": 757, "timestamp_epoch": "1641571460.447405000", "display_filter": "frame.number == 757", "udp_stream": 32 }, { "frame_number": 914, "timestamp_epoch": "1641571491.757908000", "display_filter": "frame.number == 914", "tcp_stream": 43 }, { "frame_number": 4898, "timestamp_epoch": "1641571941.773819000", "display_filter": "frame.number == 4898", "udp_stream": 32 }, { "frame_number": 5789, "timestamp_epoch": "1641572165.411535000", "display_filter": "frame.number == 5789", "udp_stream": 32 }, { "frame_number": 5804, "timestamp_epoch": "1641572169.963306000", "display_filter": "frame.number == 5804", "tcp_stream": 84 }, { "frame_number": 5810, "timestamp_epoch": "1641572169.966188000", "display_filter": "frame.number == 5810", "udp_stream": 32 }, { "frame_number": 5813, "timestamp_epoch": "1641572169.974570000", "display_filter": "frame.number == 5813", "udp_stream": 32 }, { "frame_number": 5870, "timestamp_epoch": "1641572199.980643000", "display_filter": "frame.number == 5870", "tcp_stream": 86 }, { "frame_number": 5876, "timestamp_epoch": "1641572199.983522000", "display_filter": "frame.number == 5876", "udp_stream": 32 }, { "frame_number": 5879, "timestamp_epoch": "1641572199.992120000", "display_filter": "frame.number == 5879", "udp_stream": 32 } ], "bindings": [ { "frame_number": 1, "relationship": "dhcp-client-assertion", "owner_ip": "0.0.0.0", "conversation_src": "0.0.0.0", "conversation_dst": "255.255.255.255", "account": "", "source_field": "dhcp.option.hostname" }, { "frame_number": 694, "relationship": "client-asserted", "owner_ip": "192.168.1.216", "conversation_src": "192.168.1.216", "conversation_dst": "192.168.1.255", "account": "", "source_field": "browser.server" }, { "frame_number": 756, "relationship": "client-asserted", "owner_ip": "192.168.1.216", "conversation_src": "192.168.1.216", "conversation_dst": "192.168.1.255", "account": "", "source_field": "browser.response_computer_name" }, { "frame_number": 757, "relationship": "client-asserted", "owner_ip": "192.168.1.216", "conversation_src": "192.168.1.216", "conversation_dst": "192.168.1.255", "account": "", "source_field": "browser.server" }, { "frame_number": 914, "relationship": "client-asserted", "owner_ip": "192.168.1.216", "conversation_src": "192.168.1.216", "conversation_dst": "192.168.1.2", "account": "", "source_field": "ntlmssp.auth.hostname" }, { "frame_number": 4898, "relationship": "client-asserted", "owner_ip": "192.168.1.216", "conversation_src": "192.168.1.216", "conversation_dst": "192.168.1.255", "account": "", "source_field": "browser.server" }, { "frame_number": 5789, "relationship": "client-asserted", "owner_ip": "192.168.1.216", "conversation_src": "192.168.1.216", "conversation_dst": "192.168.1.255", "account": "", "source_field": "browser.response_computer_name" }, { "frame_number": 5804, "relationship": "client-asserted", "owner_ip": "192.168.1.216", "conversation_src": "192.168.1.216", "conversation_dst": "192.168.1.2", "account": "", "source_field": "ntlmssp.auth.hostname" }, { "frame_number": 5810, "relationship": "client-asserted", "owner_ip": "192.168.1.216", "conversation_src": "192.168.1.216", "conversation_dst": "192.168.1.255", "account": "", "source_field": "browser.response_computer_name" }, { "frame_number": 5813, "relationship": "client-asserted", "owner_ip": "192.168.1.216", "conversation_src": "192.168.1.216", "conversation_dst": "192.168.1.255", "account": "", "source_field": "browser.response_computer_name" }, { "frame_number": 5870, "relationship": "client-asserted", "owner_ip": "192.168.1.216", "conversation_src": "192.168.1.216", "conversation_dst": "192.168.1.2", "account": "", "source_field": "ntlmssp.auth.hostname" }, { "frame_number": 5876, "relationship": "client-asserted", "owner_ip": "192.168.1.216", "conversation_src": "192.168.1.216", "conversation_dst": "192.168.1.255", "account": "", "source_field": "browser.response_computer_name" }, { "frame_number": 5879, "relationship": "client-asserted", "owner_ip": "192.168.1.216", "conversation_src": "192.168.1.216", "conversation_dst": "192.168.1.255", "account": "", "source_field": "browser.response_computer_name" } ], "raw_values": [ "DESKTOP-GXMYNO2" ] }, { "identity_id": "identity-02fbdd3de412f87f2ca963b7", "type": "hostname", "value": "DESKTOP-GXNYNO2", "ip_addresses": [ "192.168.1.216" ], "mac_addresses": [ "9c:5c:8e:32:58:f9" ], "evidence": [ { "frame_number": 35, "timestamp_epoch": "1641571449.914853000", "display_filter": "frame.number == 35", "udp_stream": 9 }, { "frame_number": 51, "timestamp_epoch": "1641571450.508277000", "display_filter": "frame.number == 51", "udp_stream": 9 }, { "frame_number": 367, "timestamp_epoch": "1641571451.419654000", "display_filter": "frame.number == 367", "udp_stream": 9 }, { "frame_number": 395, "timestamp_epoch": "1641571452.013737000", "display_filter": "frame.number == 395", "udp_stream": 9 }, { "frame_number": 595, "timestamp_epoch": "1641571452.919844000", "display_filter": "frame.number == 595", "udp_stream": 9 }, { "frame_number": 597, "timestamp_epoch": "1641571453.529149000", "display_filter": "frame.number == 597", "udp_stream": 9 }, { "frame_number": 604, "timestamp_epoch": "1641571454.466774000", "display_filter": "frame.number == 604", "udp_stream": 31 }, { "frame_number": 676, "timestamp_epoch": "1641571455.091589000", "display_filter": "frame.number == 676", "udp_stream": 31 }, { "frame_number": 677, "timestamp_epoch": "1641571455.216798000", "display_filter": "frame.number == 677", "udp_stream": 31 }, { "frame_number": 685, "timestamp_epoch": "1641571455.858375000", "display_filter": "frame.number == 685", "udp_stream": 31 }, { "frame_number": 687, "timestamp_epoch": "1641571455.967816000", "display_filter": "frame.number == 687", "udp_stream": 31 }, { "frame_number": 688, "timestamp_epoch": "1641571456.655208000", "display_filter": "frame.number == 688", "udp_stream": 31 }, { "frame_number": 689, "timestamp_epoch": "1641571456.732270000", "display_filter": "frame.number == 689", "udp_stream": 31 }, { "frame_number": 692, "timestamp_epoch": "1641571457.421213000", "display_filter": "frame.number == 692", "udp_stream": 31 } ], "bindings": [ { "frame_number": 35, "relationship": "netbios-registration", "owner_ip": "192.168.1.216", "conversation_src": "192.168.1.216", "conversation_dst": "192.168.1.1", "account": "", "source_field": "nbns.name" }, { "frame_number": 51, "relationship": "netbios-registration", "owner_ip": "192.168.1.216", "conversation_src": "192.168.1.216", "conversation_dst": "192.168.1.1", "account": "", "source_field": "nbns.name" }, { "frame_number": 367, "relationship": "netbios-registration", "owner_ip": "192.168.1.216", "conversation_src": "192.168.1.216", "conversation_dst": "192.168.1.1", "account": "", "source_field": "nbns.name" }, { "frame_number": 395, "relationship": "netbios-registration", "owner_ip": "192.168.1.216", "conversation_src": "192.168.1.216", "conversation_dst": "192.168.1.1", "account": "", "source_field": "nbns.name" }, { "frame_number": 595, "relationship": "netbios-registration", "owner_ip": "192.168.1.216", "conversation_src": "192.168.1.216", "conversation_dst": "192.168.1.1", "account": "", "source_field": "nbns.name" }, { "frame_number": 597, "relationship": "netbios-registration", "owner_ip": "192.168.1.216", "conversation_src": "192.168.1.216", "conversation_dst": "192.168.1.1", "account": "", "source_field": "nbns.name" }, { "frame_number": 604, "relationship": "netbios-registration", "owner_ip": "192.168.1.216", "conversation_src": "192.168.1.216", "conversation_dst": "192.168.1.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 676, "relationship": "netbios-registration", "owner_ip": "192.168.1.216", "conversation_src": "192.168.1.216", "conversation_dst": "192.168.1.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 677, "relationship": "netbios-registration", "owner_ip": "192.168.1.216", "conversation_src": "192.168.1.216", "conversation_dst": "192.168.1.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 685, "relationship": "netbios-registration", "owner_ip": "192.168.1.216", "conversation_src": "192.168.1.216", "conversation_dst": "192.168.1.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 687, "relationship": "netbios-registration", "owner_ip": "192.168.1.216", "conversation_src": "192.168.1.216", "conversation_dst": "192.168.1.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 688, "relationship": "netbios-registration", "owner_ip": "192.168.1.216", "conversation_src": "192.168.1.216", "conversation_dst": "192.168.1.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 689, "relationship": "netbios-registration", "owner_ip": "192.168.1.216", "conversation_src": "192.168.1.216", "conversation_dst": "192.168.1.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 692, "relationship": "netbios-registration", "owner_ip": "192.168.1.216", "conversation_src": "192.168.1.216", "conversation_dst": "192.168.1.255", "account": "", "source_field": "nbns.name" } ], "raw_values": [ "DESKTOP-GXNYNO2<00>,DESKTOP-GXNYNO2<00> (Workstation/Redirector)", "DESKTOP-GXNYNO2<20>,DESKTOP-GXNYNO2<20> (Server service)" ] }, { "identity_id": "identity-5eddb325abca3c4744cca6ba", "type": "netbios-group", "value": "SPOONWATCH", "ip_addresses": [], "mac_addresses": [], "evidence": [ { "frame_number": 34, "timestamp_epoch": "1641571449.914575000", "display_filter": "frame.number == 34", "udp_stream": 9 }, { "frame_number": 366, "timestamp_epoch": "1641571451.419583000", "display_filter": "frame.number == 366", "udp_stream": 9 }, { "frame_number": 581, "timestamp_epoch": "1641571452.634484000", "display_filter": "frame.number == 581", "udp_stream": 9 }, { "frame_number": 596, "timestamp_epoch": "1641571452.919945000", "display_filter": "frame.number == 596", "udp_stream": 9 }, { "frame_number": 598, "timestamp_epoch": "1641571454.122849000", "display_filter": "frame.number == 598", "udp_stream": 9 }, { "frame_number": 603, "timestamp_epoch": "1641571454.466709000", "display_filter": "frame.number == 603", "udp_stream": 31 }, { "frame_number": 678, "timestamp_epoch": "1641571455.217047000", "display_filter": "frame.number == 678", "udp_stream": 31 }, { "frame_number": 684, "timestamp_epoch": "1641571455.669911000", "display_filter": "frame.number == 684", "udp_stream": 9 }, { "frame_number": 686, "timestamp_epoch": "1641571455.967670000", "display_filter": "frame.number == 686", "udp_stream": 31 }, { "frame_number": 690, "timestamp_epoch": "1641571456.732412000", "display_filter": "frame.number == 690", "udp_stream": 31 }, { "frame_number": 691, "timestamp_epoch": "1641571457.280575000", "display_filter": "frame.number == 691", "udp_stream": 31 }, { "frame_number": 693, "timestamp_epoch": "1641571458.061405000", "display_filter": "frame.number == 693", "udp_stream": 31 }, { "frame_number": 695, "timestamp_epoch": "1641571458.842505000", "display_filter": "frame.number == 695", "udp_stream": 31 }, { "frame_number": 698, "timestamp_epoch": "1641571459.639695000", "display_filter": "frame.number == 698", "udp_stream": 31 } ], "bindings": [ { "frame_number": 34, "relationship": "group-membership-not-hostname", "owner_ip": null, "conversation_src": "192.168.1.216", "conversation_dst": "192.168.1.1", "account": "", "source_field": "nbns.name" }, { "frame_number": 366, "relationship": "group-membership-not-hostname", "owner_ip": null, "conversation_src": "192.168.1.216", "conversation_dst": "192.168.1.1", "account": "", "source_field": "nbns.name" }, { "frame_number": 581, "relationship": "group-membership-not-hostname", "owner_ip": null, "conversation_src": "192.168.1.216", "conversation_dst": "192.168.1.1", "account": "", "source_field": "nbns.name" }, { "frame_number": 596, "relationship": "group-membership-not-hostname", "owner_ip": null, "conversation_src": "192.168.1.216", "conversation_dst": "192.168.1.1", "account": "", "source_field": "nbns.name" }, { "frame_number": 598, "relationship": "group-membership-not-hostname", "owner_ip": null, "conversation_src": "192.168.1.216", "conversation_dst": "192.168.1.1", "account": "", "source_field": "nbns.name" }, { "frame_number": 603, "relationship": "group-membership-not-hostname", "owner_ip": null, "conversation_src": "192.168.1.216", "conversation_dst": "192.168.1.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 678, "relationship": "group-membership-not-hostname", "owner_ip": null, "conversation_src": "192.168.1.216", "conversation_dst": "192.168.1.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 684, "relationship": "group-membership-not-hostname", "owner_ip": null, "conversation_src": "192.168.1.216", "conversation_dst": "192.168.1.1", "account": "", "source_field": "nbns.name" }, { "frame_number": 686, "relationship": "group-membership-not-hostname", "owner_ip": null, "conversation_src": "192.168.1.216", "conversation_dst": "192.168.1.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 690, "relationship": "group-membership-not-hostname", "owner_ip": null, "conversation_src": "192.168.1.216", "conversation_dst": "192.168.1.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 691, "relationship": "group-membership-not-hostname", "owner_ip": null, "conversation_src": "192.168.1.216", "conversation_dst": "192.168.1.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 693, "relationship": "group-membership-not-hostname", "owner_ip": null, "conversation_src": "192.168.1.216", "conversation_dst": "192.168.1.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 695, "relationship": "group-membership-not-hostname", "owner_ip": null, "conversation_src": "192.168.1.216", "conversation_dst": "192.168.1.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 698, "relationship": "group-membership-not-hostname", "owner_ip": null, "conversation_src": "192.168.1.216", "conversation_dst": "192.168.1.255", "account": "", "source_field": "nbns.name" } ], "raw_values": [ "SPOONWATCH<00>,SPOONWATCH<00> (Workstation/Redirector)", "SPOONWATCH<1e>,SPOONWATCH<1e> (Browser Election Service)" ] } ], "flows": [ { "flow_id": "flow-5874cabb767ec5c34d0a3db6", "transport": "udp", "stream": 0, "initiator_ip": "0.0.0.0", "initiator_port": 68, "responder_ip": "255.255.255.255", "responder_port": 67, "first_frame": 1, "last_frame": 1, "first_seen_epoch": "1641571449.195191", "last_seen_epoch": "1641571449.195191", "packets": 1, "bytes": 379, "initiator_bytes": 379, "responder_bytes": 0 }, { "flow_id": "flow-0a42e2f967a2c1b02ffe0b21", "transport": "udp", "stream": 1, "initiator_ip": "192.168.1.1", "initiator_port": 67, "responder_ip": "192.168.1.216", "responder_port": 68, "first_frame": 2, "last_frame": 2, "first_seen_epoch": "1641571449.195531", "last_seen_epoch": "1641571449.195531", "packets": 1, "bytes": 342, "initiator_bytes": 342, "responder_bytes": 0 }, { "flow_id": "flow-075c3e7cc88f75edaeacadc4", "transport": "udp", "stream": 2, "initiator_ip": "192.168.1.216", "initiator_port": 5353, "responder_ip": "224.0.0.251", "responder_port": 5353, "first_frame": 9, "last_frame": 10, "first_seen_epoch": "1641571449.337155", "last_seen_epoch": "1641571449.337975", "packets": 2, "bytes": 172, "initiator_bytes": 172, "responder_bytes": 0 }, { "flow_id": "flow-855ea94b47e07070de9e5597", "transport": "udp", "stream": 3, "initiator_ip": "192.168.1.216", "initiator_port": 57210, "responder_ip": "224.0.0.252", "responder_port": 5355, "first_frame": 11, "last_frame": 11, "first_seen_epoch": "1641571449.34657", "last_seen_epoch": "1641571449.34657", "packets": 1, "bytes": 75, "initiator_bytes": 75, "responder_bytes": 0 }, { "flow_id": "flow-1e5bde224f9c6f95fb40bd44", "transport": "udp", "stream": 4, "initiator_ip": "192.168.1.216", "initiator_port": 61726, "responder_ip": "192.168.1.2", "responder_port": 53, "first_frame": 16, "last_frame": 17, "first_seen_epoch": "1641571449.662793", "last_seen_epoch": "1641571449.663053", "packets": 2, "bytes": 254, "initiator_bytes": 95, "responder_bytes": 159 }, { "flow_id": "flow-d96bce095f7d29bf0e416b0d", "transport": "udp", "stream": 5, "initiator_ip": "192.168.1.216", "initiator_port": 65037, "responder_ip": "192.168.1.2", "responder_port": 53, "first_frame": 18, "last_frame": 19, "first_seen_epoch": "1641571449.667717", "last_seen_epoch": "1641571449.667971", "packets": 2, "bytes": 192, "initiator_bytes": 88, "responder_bytes": 104 }, { "flow_id": "flow-6cc61d61d62a06158603170b", "transport": "udp", "stream": 6, "initiator_ip": "192.168.1.216", "initiator_port": 65039, "responder_ip": "192.168.1.2", "responder_port": 389, "first_frame": 20, "last_frame": 21, "first_seen_epoch": "1641571449.705623", "last_seen_epoch": "1641571449.70597", "packets": 2, "bytes": 496, "initiator_bytes": 264, "responder_bytes": 232 }, { "flow_id": "flow-cb014c67baf9864eaecaf72f", "transport": "udp", "stream": 7, "initiator_ip": "192.168.1.216", "initiator_port": 63494, "responder_ip": "192.168.1.2", "responder_port": 53, "first_frame": 22, "last_frame": 23, "first_seen_epoch": "1641571449.759391", "last_seen_epoch": "1641571449.759693", "packets": 2, "bytes": 289, "initiator_bytes": 107, "responder_bytes": 182 }, { "flow_id": "flow-9e14e372198af75bea94f91d", "transport": "tcp", "stream": 0, "initiator_ip": "192.168.1.216", "initiator_port": 49668, "responder_ip": "192.168.1.2", "responder_port": 389, "first_frame": 24, "last_frame": 278, "first_seen_epoch": "1641571449.760028", "last_seen_epoch": "1641571451.008364", "packets": 15, "bytes": 6267, "initiator_bytes": 2894, "responder_bytes": 3373 }, { "flow_id": "flow-e5c230a260d4d9e18df7b9d7", "transport": "udp", "stream": 8, "initiator_ip": "192.168.1.216", "initiator_port": 65355, "responder_ip": "192.168.1.2", "responder_port": 53, "first_frame": 31, "last_frame": 32, "first_seen_epoch": "1641571449.767426", "last_seen_epoch": "1641571449.767708", "packets": 2, "bytes": 289, "initiator_bytes": 107, "responder_bytes": 182 }, { "flow_id": "flow-54885cd62a887300329514f2", "transport": "udp", "stream": 9, "initiator_ip": "192.168.1.216", "initiator_port": 137, "responder_ip": "192.168.1.1", "responder_port": 137, "first_frame": 34, "last_frame": 5850, "first_seen_epoch": "1641571449.914575", "last_seen_epoch": "1641572172.27142", "packets": 33, "bytes": 3576, "initiator_bytes": 3576, "responder_bytes": 0 }, { "flow_id": "flow-6b85595ca3b3d8c0faec6f2a", "transport": "udp", "stream": 10, "initiator_ip": "192.168.1.216", "initiator_port": 65357, "responder_ip": "192.168.1.2", "responder_port": 389, "first_frame": 36, "last_frame": 37, "first_seen_epoch": "1641571449.948116", "last_seen_epoch": "1641571449.948428", "packets": 2, "bytes": 496, "initiator_bytes": 264, "responder_bytes": 232 }, { "flow_id": "flow-0c8ea860d0f429d637f531da", "transport": "tcp", "stream": 1, "initiator_ip": "192.168.1.216", "initiator_port": 49670, "responder_ip": "192.168.1.2", "responder_port": 445, "first_frame": 40, "last_frame": 1494, "first_seen_epoch": "1641571450.187339", "last_seen_epoch": "1641571635.30503", "packets": 178, "bytes": 46243, "initiator_bytes": 24202, "responder_bytes": 22041 }, { "flow_id": "flow-4fba899fb0b27e9a2359f23a", "transport": "udp", "stream": 11, "initiator_ip": "192.168.1.216", "initiator_port": 53268, "responder_ip": "192.168.1.2", "responder_port": 53, "first_frame": 49, "last_frame": 50, "first_seen_epoch": "1641571450.459752", "last_seen_epoch": "1641571450.489184", "packets": 2, "bytes": 168, "initiator_bytes": 76, "responder_bytes": 92 }, { "flow_id": "flow-4d1dcb70365274ebf2367244", "transport": "udp", "stream": 12, "initiator_ip": "192.168.1.216", "initiator_port": 60964, "responder_ip": "192.168.1.2", "responder_port": 53, "first_frame": 52, "last_frame": 53, "first_seen_epoch": "1641571450.649768", "last_seen_epoch": "1641571450.650111", "packets": 2, "bytes": 316, "initiator_bytes": 126, "responder_bytes": 190 }, { "flow_id": "flow-3fcc98386f2df56ee6e80e73", "transport": "udp", "stream": 13, "initiator_ip": "192.168.1.216", "initiator_port": 55912, "responder_ip": "192.168.1.2", "responder_port": 53, "first_frame": 54, "last_frame": 55, "first_seen_epoch": "1641571450.65957", "last_seen_epoch": "1641571450.659897", "packets": 2, "bytes": 324, "initiator_bytes": 130, "responder_bytes": 194 }, { "flow_id": "flow-86f65d2c2d4f3e56c8e30844", "transport": "udp", "stream": 14, "initiator_ip": "192.168.1.216", "initiator_port": 63059, "responder_ip": "192.168.1.2", "responder_port": 53, "first_frame": 56, "last_frame": 57, "first_seen_epoch": "1641571450.735414", "last_seen_epoch": "1641571450.735787", "packets": 2, "bytes": 233, "initiator_bytes": 79, "responder_bytes": 154 }, { "flow_id": "flow-a11f9560dcd76616c0050fda", "transport": "udp", "stream": 15, "initiator_ip": "192.168.1.216", "initiator_port": 52741, "responder_ip": "192.168.1.2", "responder_port": 53, "first_frame": 58, "last_frame": 59, "first_seen_epoch": "1641571450.736957", "last_seen_epoch": "1641571450.737214", "packets": 2, "bytes": 227, "initiator_bytes": 76, "responder_bytes": 151 }, { "flow_id": "flow-9df0624ee37cb84de49de9c9", "transport": "udp", "stream": 16, "initiator_ip": "192.168.1.216", "initiator_port": 52744, "responder_ip": "192.168.1.2", "responder_port": 389, "first_frame": 60, "last_frame": 62, "first_seen_epoch": "1641571450.835076", "last_seen_epoch": "1641571450.835423", "packets": 2, "bytes": 497, "initiator_bytes": 265, "responder_bytes": 232 }, { "flow_id": "flow-086f4a32d16dffebad90801d", "transport": "udp", "stream": 17, "initiator_ip": "192.168.1.216", "initiator_port": 52743, "responder_ip": "192.168.1.2", "responder_port": 389, "first_frame": 61, "last_frame": 63, "first_seen_epoch": "1641571450.835386", "last_seen_epoch": "1641571450.83563", "packets": 2, "bytes": 540, "initiator_bytes": 308, "responder_bytes": 232 }, { "flow_id": "flow-7b84e9e02a99a548039f8234", "transport": "udp", "stream": 18, "initiator_ip": "192.168.1.216", "initiator_port": 52745, "responder_ip": "192.168.1.2", "responder_port": 389, "first_frame": 64, "last_frame": 65, "first_seen_epoch": "1641571450.837889", "last_seen_epoch": "1641571450.838276", "packets": 2, "bytes": 496, "initiator_bytes": 264, "responder_bytes": 232 }, { "flow_id": "flow-b4108799bde69f93aaeaf867", "transport": "udp", "stream": 19, "initiator_ip": "192.168.1.216", "initiator_port": 52746, "responder_ip": "192.168.1.2", "responder_port": 389, "first_frame": 66, "last_frame": 67, "first_seen_epoch": "1641571450.844215", "last_seen_epoch": "1641571450.844661", "packets": 2, "bytes": 564, "initiator_bytes": 311, "responder_bytes": 253 }, { "flow_id": "flow-a0e6d1c306c3cd1ee82a5400", "transport": "udp", "stream": 20, "initiator_ip": "192.168.1.216", "initiator_port": 52747, "responder_ip": "192.168.1.2", "responder_port": 389, "first_frame": 68, "last_frame": 69, "first_seen_epoch": "1641571450.879137", "last_seen_epoch": "1641571450.879495", "packets": 2, "bytes": 497, "initiator_bytes": 265, "responder_bytes": 232 }, { "flow_id": "flow-fac26b15442a037bdeeae595", "transport": "udp", "stream": 21, "initiator_ip": "192.168.1.216", "initiator_port": 52748, "responder_ip": "192.168.1.2", "responder_port": 389, "first_frame": 70, "last_frame": 71, "first_seen_epoch": "1641571450.881553", "last_seen_epoch": "1641571450.881858", "packets": 2, "bytes": 496, "initiator_bytes": 264, "responder_bytes": 232 }, { "flow_id": "flow-bee1818a3d462193ce01f833", "transport": "tcp", "stream": 2, "initiator_ip": "192.168.1.216", "initiator_port": 49673, "responder_ip": "192.168.1.2", "responder_port": 88, "first_frame": 72, "last_frame": 79, "first_seen_epoch": "1641571450.951921", "last_seen_epoch": "1641571450.953508", "packets": 8, "bytes": 924, "initiator_bytes": 472, "responder_bytes": 452 }, { "flow_id": "flow-a41ee776aa5e77a371636db9", "transport": "tcp", "stream": 3, "initiator_ip": "192.168.1.216", "initiator_port": 49674, "responder_ip": "192.168.1.2", "responder_port": 135, "first_frame": 80, "last_frame": 819, "first_seen_epoch": "1641571450.960685", "last_seen_epoch": "1641571478.501417", "packets": 19, "bytes": 2678, "initiator_bytes": 1438, "responder_bytes": 1240 }, { "flow_id": "flow-cfcbf70dc2483b005fe4c627", "transport": "tcp", "stream": 4, "initiator_ip": "192.168.1.216", "initiator_port": 49675, "responder_ip": "192.168.1.2", "responder_port": 135, "first_frame": 83, "last_frame": 813, "first_seen_epoch": "1641571450.962417", "last_seen_epoch": "1641571478.500806", "packets": 12, "bytes": 1364, "initiator_bytes": 730, "responder_bytes": 634 }, { "flow_id": "flow-72acdc7bf6000d8966b6e568", "transport": "tcp", "stream": 5, "initiator_ip": "192.168.1.216", "initiator_port": 49676, "responder_ip": "192.168.1.2", "responder_port": 49676, "first_frame": 94, "last_frame": 820, "first_seen_epoch": "1641571450.964641", "last_seen_epoch": "1641571478.501439", "packets": 20, "bytes": 4492, "initiator_bytes": 2610, "responder_bytes": 1882 }, { "flow_id": "flow-a3681b8e096e87eced146891", "transport": "tcp", "stream": 6, "initiator_ip": "192.168.1.216", "initiator_port": 49677, "responder_ip": "192.168.1.2", "responder_port": 49667, "first_frame": 98, "last_frame": 823, "first_seen_epoch": "1641571450.965044", "last_seen_epoch": "1641571478.502071", "packets": 44, "bytes": 12554, "initiator_bytes": 8460, "responder_bytes": 4094 }, { "flow_id": "flow-efcb29336e45d1fed3f0c930", "transport": "tcp", "stream": 7, "initiator_ip": "192.168.1.216", "initiator_port": 49678, "responder_ip": "192.168.1.2", "responder_port": 88, "first_frame": 104, "last_frame": 113, "first_seen_epoch": "1641571450.965851", "last_seen_epoch": "1641571450.966959", "packets": 8, "bytes": 924, "initiator_bytes": 472, "responder_bytes": 452 }, { "flow_id": "flow-260aad6c0acdb01926d3138f", "transport": "tcp", "stream": 8, "initiator_ip": "192.168.1.216", "initiator_port": 49679, "responder_ip": "192.168.1.2", "responder_port": 88, "first_frame": 120, "last_frame": 138, "first_seen_epoch": "1641571450.97783", "last_seen_epoch": "1641571450.97953", "packets": 10, "bytes": 2699, "initiator_bytes": 606, "responder_bytes": 2093 }, { "flow_id": "flow-cfb96656ee4fbe991e6d566d", "transport": "tcp", "stream": 9, "initiator_ip": "192.168.1.216", "initiator_port": 49680, "responder_ip": "192.168.1.2", "responder_port": 88, "first_frame": 121, "last_frame": 139, "first_seen_epoch": "1641571450.977832", "last_seen_epoch": "1641571450.979618", "packets": 10, "bytes": 2699, "initiator_bytes": 606, "responder_bytes": 2093 }, { "flow_id": "flow-c91e7c9b711166fd5db5fc63", "transport": "tcp", "stream": 10, "initiator_ip": "192.168.1.216", "initiator_port": 49681, "responder_ip": "192.168.1.2", "responder_port": 49667, "first_frame": 142, "last_frame": 1225, "first_seen_epoch": "1641571450.98294", "last_seen_epoch": "1641571538.507279", "packets": 35, "bytes": 10562, "initiator_bytes": 7204, "responder_bytes": 3358 }, { "flow_id": "flow-2b8cd91153555254ed277004", "transport": "tcp", "stream": 11, "initiator_ip": "192.168.1.216", "initiator_port": 49682, "responder_ip": "192.168.1.2", "responder_port": 88, "first_frame": 143, "last_frame": 152, "first_seen_epoch": "1641571450.98295", "last_seen_epoch": "1641571450.984141", "packets": 7, "bytes": 870, "initiator_bytes": 418, "responder_bytes": 452 }, { "flow_id": "flow-9b1870af920a4b25295ac3d1", "transport": "tcp", "stream": 12, "initiator_ip": "192.168.1.216", "initiator_port": 49683, "responder_ip": "192.168.1.2", "responder_port": 88, "first_frame": 151, "last_frame": 161, "first_seen_epoch": "1641571450.984111", "last_seen_epoch": "1641571450.985448", "packets": 10, "bytes": 2700, "initiator_bytes": 607, "responder_bytes": 2093 }, { "flow_id": "flow-06df1bda38e42add80dd5ea7", "transport": "tcp", "stream": 13, "initiator_ip": "192.168.1.216", "initiator_port": 49684, "responder_ip": "192.168.1.2", "responder_port": 88, "first_frame": 162, "last_frame": 184, "first_seen_epoch": "1641571450.985813", "last_seen_epoch": "1641571450.987705", "packets": 12, "bytes": 4351, "initiator_bytes": 2206, "responder_bytes": 2145 }, { "flow_id": "flow-ac555cbd24b188898907e7f3", "transport": "tcp", "stream": 14, "initiator_ip": "192.168.1.216", "initiator_port": 49685, "responder_ip": "192.168.1.2", "responder_port": 88, "first_frame": 163, "last_frame": 185, "first_seen_epoch": "1641571450.98583", "last_seen_epoch": "1641571450.987792", "packets": 12, "bytes": 4319, "initiator_bytes": 2190, "responder_bytes": 2129 }, { "flow_id": "flow-b4c673b53bc619d14fde96a1", "transport": "tcp", "stream": 15, "initiator_ip": "192.168.1.216", "initiator_port": 49686, "responder_ip": "192.168.1.2", "responder_port": 389, "first_frame": 186, "last_frame": 386, "first_seen_epoch": "1641571450.98896", "last_seen_epoch": "1641571451.462365", "packets": 30, "bytes": 9877, "initiator_bytes": 4827, "responder_bytes": 5050 }, { "flow_id": "flow-b51f279b7691514b4e12974e", "transport": "tcp", "stream": 16, "initiator_ip": "192.168.1.216", "initiator_port": 49687, "responder_ip": "192.168.1.2", "responder_port": 88, "first_frame": 193, "last_frame": 204, "first_seen_epoch": "1641571450.99053", "last_seen_epoch": "1641571450.991793", "packets": 12, "bytes": 3999, "initiator_bytes": 1985, "responder_bytes": 2014 }, { "flow_id": "flow-2261d0695e718893d8e5f5a1", "transport": "udp", "stream": 22, "initiator_ip": "192.168.1.216", "initiator_port": 60456, "responder_ip": "192.168.1.2", "responder_port": 53, "first_frame": 222, "last_frame": 223, "first_seen_epoch": "1641571450.996084", "last_seen_epoch": "1641571450.996311", "packets": 2, "bytes": 326, "initiator_bytes": 131, "responder_bytes": 195 }, { "flow_id": "flow-df9db00bbf17db8342d199c4", "transport": "tcp", "stream": 17, "initiator_ip": "192.168.1.216", "initiator_port": 49688, "responder_ip": "192.168.1.2", "responder_port": 88, "first_frame": 229, "last_frame": 250, "first_seen_epoch": "1641571451.002059", "last_seen_epoch": "1641571451.00409", "packets": 12, "bytes": 4351, "initiator_bytes": 2206, "responder_bytes": 2145 }, { "flow_id": "flow-9e394be30faf361cec013891", "transport": "udp", "stream": 23, "initiator_ip": "192.168.1.216", "initiator_port": 60457, "responder_ip": "192.168.1.2", "responder_port": 389, "first_frame": 281, "last_frame": 282, "first_seen_epoch": "1641571451.010316", "last_seen_epoch": "1641571451.010612", "packets": 2, "bytes": 479, "initiator_bytes": 243, "responder_bytes": 236 }, { "flow_id": "flow-bcfe7f9abf8a49a42d811fde", "transport": "tcp", "stream": 18, "initiator_ip": "192.168.1.216", "initiator_port": 49689, "responder_ip": "192.168.1.2", "responder_port": 135, "first_frame": 298, "last_frame": 1204, "first_seen_epoch": "1641571451.107903", "last_seen_epoch": "1641571509.959534", "packets": 12, "bytes": 1292, "initiator_bytes": 730, "responder_bytes": 562 }, { "flow_id": "flow-8de9824fe883ab5b7a3ff3fc", "transport": "tcp", "stream": 19, "initiator_ip": "192.168.1.216", "initiator_port": 49690, "responder_ip": "192.168.1.2", "responder_port": 49667, "first_frame": 305, "last_frame": 1201, "first_seen_epoch": "1641571451.12166", "last_seen_epoch": "1641571509.959073", "packets": 22, "bytes": 5784, "initiator_bytes": 4251, "responder_bytes": 1533 }, { "flow_id": "flow-35dd92fbd6d1169a7fcc4c9b", "transport": "tcp", "stream": 20, "initiator_ip": "192.168.1.216", "initiator_port": 49691, "responder_ip": "192.168.1.2", "responder_port": 88, "first_frame": 308, "last_frame": 322, "first_seen_epoch": "1641571451.12313", "last_seen_epoch": "1641571451.125152", "packets": 12, "bytes": 4319, "initiator_bytes": 2190, "responder_bytes": 2129 }, { "flow_id": "flow-e45f6529ea4d30524f6e0596", "transport": "tcp", "stream": 21, "initiator_ip": "192.168.1.216", "initiator_port": 49692, "responder_ip": "192.168.1.2", "responder_port": 389, "first_frame": 310, "last_frame": 335, "first_seen_epoch": "1641571451.123307", "last_seen_epoch": "1641571451.129702", "packets": 6, "bytes": 348, "initiator_bytes": 174, "responder_bytes": 174 }, { "flow_id": "flow-014b7448b8d4e7a00bf15876", "transport": "udp", "stream": 24, "initiator_ip": "192.168.1.216", "initiator_port": 57004, "responder_ip": "192.168.1.2", "responder_port": 53, "first_frame": 342, "last_frame": 343, "first_seen_epoch": "1641571451.139079", "last_seen_epoch": "1641571451.139418", "packets": 2, "bytes": 326, "initiator_bytes": 131, "responder_bytes": 195 }, { "flow_id": "flow-b3dba4646d4f5bfce7c6059a", "transport": "udp", "stream": 25, "initiator_ip": "192.168.1.216", "initiator_port": 57005, "responder_ip": "192.168.1.2", "responder_port": 389, "first_frame": 347, "last_frame": 348, "first_seen_epoch": "1641571451.180452", "last_seen_epoch": "1641571451.180787", "packets": 2, "bytes": 479, "initiator_bytes": 243, "responder_bytes": 236 }, { "flow_id": "flow-5d93a612d430bdac32e27418", "transport": "tcp", "stream": 22, "initiator_ip": "192.168.1.216", "initiator_port": 49693, "responder_ip": "192.168.1.2", "responder_port": 389, "first_frame": 350, "last_frame": 356, "first_seen_epoch": "1641571451.295102", "last_seen_epoch": "1641571451.296697", "packets": 6, "bytes": 348, "initiator_bytes": 174, "responder_bytes": 174 }, { "flow_id": "flow-86db4f6665f900b3d0086b20", "transport": "udp", "stream": 26, "initiator_ip": "192.168.1.216", "initiator_port": 53374, "responder_ip": "192.168.1.2", "responder_port": 53, "first_frame": 358, "last_frame": 359, "first_seen_epoch": "1641571451.297155", "last_seen_epoch": "1641571451.297339", "packets": 2, "bytes": 296, "initiator_bytes": 116, "responder_bytes": 180 }, { "flow_id": "flow-888587b091bff5a80f5689f2", "transport": "udp", "stream": 27, "initiator_ip": "192.168.1.216", "initiator_port": 53375, "responder_ip": "192.168.1.2", "responder_port": 389, "first_frame": 360, "last_frame": 361, "first_seen_epoch": "1641571451.297763", "last_seen_epoch": "1641571451.297962", "packets": 2, "bytes": 496, "initiator_bytes": 264, "responder_bytes": 232 }, { "flow_id": "flow-850df50215138d487be53017", "transport": "tcp", "stream": 23, "initiator_ip": "192.168.1.216", "initiator_port": 49694, "responder_ip": "192.168.1.2", "responder_port": 389, "first_frame": 363, "last_frame": 372, "first_seen_epoch": "1641571451.40414", "last_seen_epoch": "1641571451.42953", "packets": 6, "bytes": 348, "initiator_bytes": 174, "responder_bytes": 174 }, { "flow_id": "flow-a7af6f2018182b88f769fce7", "transport": "udp", "stream": 28, "initiator_ip": "192.168.1.216", "initiator_port": 53645, "responder_ip": "192.168.1.2", "responder_port": 53, "first_frame": 369, "last_frame": 374, "first_seen_epoch": "1641571451.429178", "last_seen_epoch": "1641571451.429803", "packets": 2, "bytes": 192, "initiator_bytes": 88, "responder_bytes": 104 }, { "flow_id": "flow-374f7307dd718eeda1a6478b", "transport": "tcp", "stream": 24, "initiator_ip": "192.168.1.216", "initiator_port": 49695, "responder_ip": "192.168.1.2", "responder_port": 389, "first_frame": 375, "last_frame": 381, "first_seen_epoch": "1641571451.430341", "last_seen_epoch": "1641571451.460658", "packets": 6, "bytes": 348, "initiator_bytes": 174, "responder_bytes": 174 }, { "flow_id": "flow-9928386796aba4b2a1500adf", "transport": "tcp", "stream": 25, "initiator_ip": "192.168.1.216", "initiator_port": 49697, "responder_ip": "192.168.1.2", "responder_port": 389, "first_frame": 396, "last_frame": 594, "first_seen_epoch": "1641571452.070108", "last_seen_epoch": "1641571452.719623", "packets": 21, "bytes": 9069, "initiator_bytes": 3876, "responder_bytes": 5193 }, { "flow_id": "flow-9238d6a4886b5026ee7befa2", "transport": "tcp", "stream": 26, "initiator_ip": "192.168.1.216", "initiator_port": 49698, "responder_ip": "192.168.1.2", "responder_port": 88, "first_frame": 409, "last_frame": 420, "first_seen_epoch": "1641571452.356154", "last_seen_epoch": "1641571452.358499", "packets": 12, "bytes": 4265, "initiator_bytes": 2172, "responder_bytes": 2093 }, { "flow_id": "flow-6cff7157d917a25353f46295", "transport": "tcp", "stream": 27, "initiator_ip": "192.168.1.216", "initiator_port": 49699, "responder_ip": "192.168.1.2", "responder_port": 389, "first_frame": 423, "last_frame": 589, "first_seen_epoch": "1641571452.366538", "last_seen_epoch": "1641571452.658893", "packets": 16, "bytes": 3856, "initiator_bytes": 2950, "responder_bytes": 906 }, { "flow_id": "flow-fb796def608af7864e95d3ca", "transport": "tcp", "stream": 28, "initiator_ip": "192.168.1.216", "initiator_port": 49700, "responder_ip": "192.168.1.2", "responder_port": 88, "first_frame": 438, "last_frame": 449, "first_seen_epoch": "1641571452.57885", "last_seen_epoch": "1641571452.581087", "packets": 12, "bytes": 4351, "initiator_bytes": 2206, "responder_bytes": 2145 }, { "flow_id": "flow-1515183becbf568ad737cf60", "transport": "tcp", "stream": 29, "initiator_ip": "192.168.1.216", "initiator_port": 49701, "responder_ip": "192.168.1.2", "responder_port": 88, "first_frame": 450, "last_frame": 461, "first_seen_epoch": "1641571452.58128", "last_seen_epoch": "1641571452.5826", "packets": 12, "bytes": 3999, "initiator_bytes": 1985, "responder_bytes": 2014 }, { "flow_id": "flow-e412e827e7b07afdc639b5b8", "transport": "udp", "stream": 29, "initiator_ip": "192.168.1.216", "initiator_port": 55162, "responder_ip": "192.168.1.2", "responder_port": 53, "first_frame": 599, "last_frame": 600, "first_seen_epoch": "1641571454.426446", "last_seen_epoch": "1641571454.426813", "packets": 2, "bytes": 316, "initiator_bytes": 126, "responder_bytes": 190 }, { "flow_id": "flow-8d4b1081296f68162bc96c3b", "transport": "udp", "stream": 30, "initiator_ip": "192.168.1.216", "initiator_port": 55163, "responder_ip": "192.168.1.2", "responder_port": 389, "first_frame": 601, "last_frame": 602, "first_seen_epoch": "1641571454.427658", "last_seen_epoch": "1641571454.428233", "packets": 2, "bytes": 497, "initiator_bytes": 265, "responder_bytes": 232 }, { "flow_id": "flow-97848a44716845a253b867d3", "transport": "udp", "stream": 31, "initiator_ip": "192.168.1.216", "initiator_port": 137, "responder_ip": "192.168.1.255", "responder_port": 137, "first_frame": 603, "last_frame": 5794, "first_seen_epoch": "1641571454.466709", "last_seen_epoch": "1641572169.958331", "packets": 17, "bytes": 1852, "initiator_bytes": 1852, "responder_bytes": 0 }, { "flow_id": "flow-9554611f7f8c9c8d5b894e68", "transport": "tcp", "stream": 30, "initiator_ip": "192.168.1.216", "initiator_port": 49703, "responder_ip": "192.168.1.2", "responder_port": 135, "first_frame": 605, "last_frame": 674, "first_seen_epoch": "1641571454.546219", "last_seen_epoch": "1641571454.584258", "packets": 10, "bytes": 1512, "initiator_bytes": 832, "responder_bytes": 680 }, { "flow_id": "flow-340336b164484f71989ac4ae", "transport": "tcp", "stream": 31, "initiator_ip": "192.168.1.216", "initiator_port": 49704, "responder_ip": "192.168.1.2", "responder_port": 49667, "first_frame": 612, "last_frame": 675, "first_seen_epoch": "1641571454.550041", "last_seen_epoch": "1641571454.584481", "packets": 22, "bytes": 6735, "initiator_bytes": 4346, "responder_bytes": 2389 }, { "flow_id": "flow-76b709090d68626fd286ec6f", "transport": "tcp", "stream": 32, "initiator_ip": "192.168.1.216", "initiator_port": 49705, "responder_ip": "192.168.1.2", "responder_port": 389, "first_frame": 635, "last_frame": 673, "first_seen_epoch": "1641571454.563859", "last_seen_epoch": "1641571454.579012", "packets": 21, "bytes": 7530, "initiator_bytes": 3513, "responder_bytes": 4017 }, { "flow_id": "flow-6f5686e7c468168530904905", "transport": "tcp", "stream": 33, "initiator_ip": "192.168.1.216", "initiator_port": 49706, "responder_ip": "192.168.1.2", "responder_port": 389, "first_frame": 652, "last_frame": 669, "first_seen_epoch": "1641571454.572767", "last_seen_epoch": "1641571454.57826", "packets": 18, "bytes": 6948, "initiator_bytes": 2915, "responder_bytes": 4033 }, { "flow_id": "flow-e480355392594bcddf05806b", "transport": "udp", "stream": 32, "initiator_ip": "192.168.1.216", "initiator_port": 138, "responder_ip": "192.168.1.255", "responder_port": 138, "first_frame": 694, "last_frame": 5879, "first_seen_epoch": "1641571458.269061", "last_seen_epoch": "1641572199.99212", "packets": 9, "bytes": 2097, "initiator_bytes": 2097, "responder_bytes": 0 }, { "flow_id": "flow-9b791351de399bf554d930be", "transport": "udp", "stream": 33, "initiator_ip": "192.168.1.216", "initiator_port": 55165, "responder_ip": "192.168.1.2", "responder_port": 389, "first_frame": 696, "last_frame": 697, "first_seen_epoch": "1641571459.125053", "last_seen_epoch": "1641571459.125466", "packets": 2, "bytes": 497, "initiator_bytes": 265, "responder_bytes": 232 }, { "flow_id": "flow-d6f45ecbdf10e0fecb90738d", "transport": "udp", "stream": 34, "initiator_ip": "192.168.1.216", "initiator_port": 55167, "responder_ip": "192.168.1.2", "responder_port": 389, "first_frame": 699, "last_frame": 700, "first_seen_epoch": "1641571460.051931", "last_seen_epoch": "1641571460.052319", "packets": 2, "bytes": 497, "initiator_bytes": 265, "responder_bytes": 232 }, { "flow_id": "flow-a36f023a66750bc69b57b29b", "transport": "tcp", "stream": 34, "initiator_ip": "192.168.1.216", "initiator_port": 49707, "responder_ip": "192.168.1.2", "responder_port": 389, "first_frame": 701, "last_frame": 755, "first_seen_epoch": "1641571460.155469", "last_seen_epoch": "1641571460.177348", "packets": 25, "bytes": 8359, "initiator_bytes": 3989, "responder_bytes": 4370 }, { "flow_id": "flow-786c190ee152400544c3b9fb", "transport": "tcp", "stream": 35, "initiator_ip": "192.168.1.216", "initiator_port": 49708, "responder_ip": "192.168.1.2", "responder_port": 88, "first_frame": 722, "last_frame": 730, "first_seen_epoch": "1641571460.1693", "last_seen_epoch": "1641571460.170896", "packets": 8, "bytes": 942, "initiator_bytes": 473, "responder_bytes": 469 }, { "flow_id": "flow-9599cebb2408099b5a22a27b", "transport": "tcp", "stream": 36, "initiator_ip": "192.168.1.216", "initiator_port": 49709, "responder_ip": "192.168.1.2", "responder_port": 88, "first_frame": 729, "last_frame": 739, "first_seen_epoch": "1641571460.170807", "last_seen_epoch": "1641571460.172461", "packets": 10, "bytes": 2700, "initiator_bytes": 607, "responder_bytes": 2093 }, { "flow_id": "flow-6173fe1ad06b529c5b09b326", "transport": "tcp", "stream": 37, "initiator_ip": "192.168.1.216", "initiator_port": 49710, "responder_ip": "192.168.1.2", "responder_port": 88, "first_frame": 740, "last_frame": 751, "first_seen_epoch": "1641571460.17283", "last_seen_epoch": "1641571460.174944", "packets": 12, "bytes": 4203, "initiator_bytes": 2138, "responder_bytes": 2065 }, { "flow_id": "flow-acf81c075b73eb87807b145e", "transport": "udp", "stream": 35, "initiator_ip": "192.168.1.216", "initiator_port": 123, "responder_ip": "192.168.1.2", "responder_port": 123, "first_frame": 758, "last_frame": 759, "first_seen_epoch": "1641571460.751168", "last_seen_epoch": "1641571460.7524", "packets": 2, "bytes": 324, "initiator_bytes": 162, "responder_bytes": 162 }, { "flow_id": "flow-9ad8bfc9a586d80a4d9c5de2", "transport": "udp", "stream": 36, "initiator_ip": "192.168.1.216", "initiator_port": 65113, "responder_ip": "192.168.1.2", "responder_port": 53, "first_frame": 760, "last_frame": 761, "first_seen_epoch": "1641571461.683546", "last_seen_epoch": "1641571461.710748", "packets": 2, "bytes": 298, "initiator_bytes": 90, "responder_bytes": 208 }, { "flow_id": "flow-7d835737638bf05921a239a3", "transport": "tcp", "stream": 38, "initiator_ip": "192.168.1.216", "initiator_port": 49711, "responder_ip": "52.168.112.67", "responder_port": 443, "first_frame": 762, "last_frame": 1345, "first_seen_epoch": "1641571461.715656", "last_seen_epoch": "1641571571.648775", "packets": 41, "bytes": 18659, "initiator_bytes": 10445, "responder_bytes": 8214 }, { "flow_id": "flow-24fb26fc1a8719dffff8c13f", "transport": "udp", "stream": 37, "initiator_ip": "192.168.1.216", "initiator_port": 54741, "responder_ip": "192.168.1.2", "responder_port": 53, "first_frame": 804, "last_frame": 805, "first_seen_epoch": "1641571465.750273", "last_seen_epoch": "1641571465.750678", "packets": 2, "bytes": 233, "initiator_bytes": 79, "responder_bytes": 154 }, { "flow_id": "flow-e21ae1078290a2ba912d51e9", "transport": "udp", "stream": 38, "initiator_ip": "192.168.1.216", "initiator_port": 64826, "responder_ip": "192.168.1.2", "responder_port": 53, "first_frame": 806, "last_frame": 807, "first_seen_epoch": "1641571465.751109", "last_seen_epoch": "1641571465.751365", "packets": 2, "bytes": 227, "initiator_bytes": 76, "responder_bytes": 151 }, { "flow_id": "flow-060d59dc0e152259cc42bc3e", "transport": "udp", "stream": 39, "initiator_ip": "192.168.1.216", "initiator_port": 64827, "responder_ip": "192.168.1.2", "responder_port": 389, "first_frame": 824, "last_frame": 825, "first_seen_epoch": "1641571491.539111", "last_seen_epoch": "1641571491.539526", "packets": 2, "bytes": 497, "initiator_bytes": 265, "responder_bytes": 232 }, { "flow_id": "flow-bb3407d402eab25053548ca1", "transport": "tcp", "stream": 39, "initiator_ip": "192.168.1.216", "initiator_port": 49712, "responder_ip": "192.168.1.2", "responder_port": 88, "first_frame": 826, "last_frame": 833, "first_seen_epoch": "1641571491.641352", "last_seen_epoch": "1641571491.642871", "packets": 8, "bytes": 880, "initiator_bytes": 459, "responder_bytes": 421 }, { "flow_id": "flow-cd5a86179f079f06edf055ea", "transport": "tcp", "stream": 40, "initiator_ip": "192.168.1.216", "initiator_port": 49713, "responder_ip": "192.168.1.2", "responder_port": 88, "first_frame": 834, "last_frame": 843, "first_seen_epoch": "1641571491.649883", "last_seen_epoch": "1641571491.651679", "packets": 10, "bytes": 2605, "initiator_bytes": 593, "responder_bytes": 2012 }, { "flow_id": "flow-58ee34c1602b2f35c9ba7b26", "transport": "tcp", "stream": 41, "initiator_ip": "192.168.1.216", "initiator_port": 49714, "responder_ip": "192.168.1.2", "responder_port": 88, "first_frame": 844, "last_frame": 855, "first_seen_epoch": "1641571491.651959", "last_seen_epoch": "1641571491.654333", "packets": 12, "bytes": 3946, "initiator_bytes": 1977, "responder_bytes": 1969 }, { "flow_id": "flow-43ac587041549ae4259d72a8", "transport": "tcp", "stream": 42, "initiator_ip": "192.168.1.216", "initiator_port": 49715, "responder_ip": "192.168.1.2", "responder_port": 135, "first_frame": 856, "last_frame": 1142, "first_seen_epoch": "1641571491.722361", "last_seen_epoch": "1641571508.504562", "packets": 12, "bytes": 1292, "initiator_bytes": 730, "responder_bytes": 562 }, { "flow_id": "flow-5e891c0a14061134359df1fd", "transport": "udp", "stream": 40, "initiator_ip": "192.168.1.216", "initiator_port": 61981, "responder_ip": "192.168.1.2", "responder_port": 53, "first_frame": 863, "last_frame": 864, "first_seen_epoch": "1641571491.724441", "last_seen_epoch": "1641571491.72467", "packets": 2, "bytes": 164, "initiator_bytes": 74, "responder_bytes": 90 }, { "flow_id": "flow-e01f5b7ab8acf1982546d218", "transport": "tcp", "stream": 43, "initiator_ip": "192.168.1.216", "initiator_port": 49716, "responder_ip": "192.168.1.2", "responder_port": 445, "first_frame": 865, "last_frame": 1138, "first_seen_epoch": "1641571491.727854", "last_seen_epoch": "1641571504.817309", "packets": 64, "bytes": 14609, "initiator_bytes": 7187, "responder_bytes": 7422 }, { "flow_id": "flow-f36e2e9990d6af5905d0fe1e", "transport": "tcp", "stream": 44, "initiator_ip": "192.168.1.216", "initiator_port": 49717, "responder_ip": "192.168.1.2", "responder_port": 88, "first_frame": 874, "last_frame": 883, "first_seen_epoch": "1641571491.737505", "last_seen_epoch": "1641571491.738783", "packets": 10, "bytes": 2448, "initiator_bytes": 2064, "responder_bytes": 384 }, { "flow_id": "flow-87df7bd34a6a8fa812f8d598", "transport": "tcp", "stream": 45, "initiator_ip": "192.168.1.216", "initiator_port": 49718, "responder_ip": "192.168.1.2", "responder_port": 88, "first_frame": 884, "last_frame": 895, "first_seen_epoch": "1641571491.747541", "last_seen_epoch": "1641571491.749535", "packets": 12, "bytes": 4235, "initiator_bytes": 2148, "responder_bytes": 2087 }, { "flow_id": "flow-7d2849f467fb8832d5b4174a", "transport": "tcp", "stream": 46, "initiator_ip": "192.168.1.216", "initiator_port": 49719, "responder_ip": "192.168.1.2", "responder_port": 445, "first_frame": 964, "last_frame": 5816, "first_seen_epoch": "1641571491.972899", "last_seen_epoch": "1641572170.206847", "packets": 53, "bytes": 10157, "initiator_bytes": 7034, "responder_bytes": 3123 }, { "flow_id": "flow-821ba9008e7f0fb88d22c3f7", "transport": "tcp", "stream": 47, "initiator_ip": "192.168.1.216", "initiator_port": 49720, "responder_ip": "192.168.1.2", "responder_port": 88, "first_frame": 969, "last_frame": 980, "first_seen_epoch": "1641571491.975035", "last_seen_epoch": "1641571491.977161", "packets": 12, "bytes": 4158, "initiator_bytes": 2117, "responder_bytes": 2041 }, { "flow_id": "flow-a49807e1e1de0afd466cf391", "transport": "tcp", "stream": 48, "initiator_ip": "192.168.1.216", "initiator_port": 49721, "responder_ip": "192.168.1.2", "responder_port": 88, "first_frame": 981, "last_frame": 992, "first_seen_epoch": "1641571491.97723", "last_seen_epoch": "1641571491.978463", "packets": 12, "bytes": 3883, "initiator_bytes": 1927, "responder_bytes": 1956 }, { "flow_id": "flow-4f113212240e756d9a46463a", "transport": "tcp", "stream": 49, "initiator_ip": "192.168.1.216", "initiator_port": 49722, "responder_ip": "192.168.1.2", "responder_port": 389, "first_frame": 1003, "last_frame": 1034, "first_seen_epoch": "1641571492.070017", "last_seen_epoch": "1641571492.419128", "packets": 16, "bytes": 4477, "initiator_bytes": 3349, "responder_bytes": 1128 }, { "flow_id": "flow-f5d680f116f274bab25d87b2", "transport": "tcp", "stream": 50, "initiator_ip": "192.168.1.216", "initiator_port": 49723, "responder_ip": "192.168.1.2", "responder_port": 389, "first_frame": 1012, "last_frame": 1030, "first_seen_epoch": "1641571492.080921", "last_seen_epoch": "1641571492.411087", "packets": 16, "bytes": 3822, "initiator_bytes": 2916, "responder_bytes": 906 }, { "flow_id": "flow-f5879af5d902fe95c3ba2c4f", "transport": "udp", "stream": 41, "initiator_ip": "192.168.1.216", "initiator_port": 60388, "responder_ip": "192.168.1.2", "responder_port": 53, "first_frame": 1037, "last_frame": 1038, "first_seen_epoch": "1641571493.065847", "last_seen_epoch": "1641571493.096639", "packets": 2, "bytes": 310, "initiator_bytes": 89, "responder_bytes": 221 }, { "flow_id": "flow-2f8ac59991fa5304839b111a", "transport": "tcp", "stream": 51, "initiator_ip": "192.168.1.216", "initiator_port": 49724, "responder_ip": "20.50.80.210", "responder_port": 443, "first_frame": 1039, "last_frame": 1060, "first_seen_epoch": "1641571493.105998", "last_seen_epoch": "1641571494.000719", "packets": 22, "bytes": 7969, "initiator_bytes": 2403, "responder_bytes": 5566 }, { "flow_id": "flow-91e2273c9115d3d6819f66fe", "transport": "udp", "stream": 42, "initiator_ip": "192.168.1.216", "initiator_port": 57905, "responder_ip": "192.168.1.2", "responder_port": 53, "first_frame": 1061, "last_frame": 1062, "first_seen_epoch": "1641571494.108159", "last_seen_epoch": "1641571494.127684", "packets": 2, "bytes": 217, "initiator_bytes": 71, "responder_bytes": 146 }, { "flow_id": "flow-ab5a93178b8417ed6ac5c38a", "transport": "tcp", "stream": 52, "initiator_ip": "192.168.1.216", "initiator_port": 49725, "responder_ip": "204.79.197.203", "responder_port": 443, "first_frame": 1063, "last_frame": 1337, "first_seen_epoch": "1641571494.131381", "last_seen_epoch": "1641571562.584109", "packets": 23, "bytes": 10825, "initiator_bytes": 1591, "responder_bytes": 9234 }, { "flow_id": "flow-30e5f2479ac1d361d2bd4879", "transport": "udp", "stream": 43, "initiator_ip": "192.168.1.216", "initiator_port": 64104, "responder_ip": "192.168.1.2", "responder_port": 53, "first_frame": 1085, "last_frame": 1086, "first_seen_epoch": "1641571496.446316", "last_seen_epoch": "1641571496.507251", "packets": 2, "bytes": 292, "initiator_bytes": 72, "responder_bytes": 220 }, { "flow_id": "flow-39828fd068fa5a3359ca8bbc", "transport": "tcp", "stream": 53, "initiator_ip": "192.168.1.216", "initiator_port": 49726, "responder_ip": "204.79.197.200", "responder_port": 443, "first_frame": 1087, "last_frame": 1417, "first_seen_epoch": "1641571496.553567", "last_seen_epoch": "1641571622.177955", "packets": 38, "bytes": 12737, "initiator_bytes": 4105, "responder_bytes": 8632 }, { "flow_id": "flow-7e86e8cf9a84e84cf7a9633e", "transport": "udp", "stream": 44, "initiator_ip": "192.168.1.216", "initiator_port": 59352, "responder_ip": "192.168.1.2", "responder_port": 53, "first_frame": 1143, "last_frame": 1144, "first_seen_epoch": "1641571508.772862", "last_seen_epoch": "1641571508.830152", "packets": 2, "bytes": 245, "initiator_bytes": 91, "responder_bytes": 154 }, { "flow_id": "flow-bd2df5749db24c6babafed08", "transport": "tcp", "stream": 54, "initiator_ip": "192.168.1.216", "initiator_port": 49727, "responder_ip": "52.183.220.149", "responder_port": 443, "first_frame": 1145, "last_frame": 1213, "first_seen_epoch": "1641571508.836384", "last_seen_epoch": "1641571518.829548", "packets": 18, "bytes": 7701, "initiator_bytes": 1070, "responder_bytes": 6631 }, { "flow_id": "flow-b89072a51e1636fd32db944c", "transport": "tcp", "stream": 55, "initiator_ip": "192.168.1.216", "initiator_port": 49728, "responder_ip": "52.183.220.149", "responder_port": 443, "first_frame": 1162, "last_frame": 1416, "first_seen_epoch": "1641571509.038384", "last_seen_epoch": "1641571619.059967", "packets": 28, "bytes": 8414, "initiator_bytes": 1374, "responder_bytes": 7040 }, { "flow_id": "flow-5f578b8c3e8cd9fe843a9458", "transport": "tcp", "stream": 56, "initiator_ip": "192.168.1.216", "initiator_port": 49729, "responder_ip": "52.183.220.149", "responder_port": 443, "first_frame": 1186, "last_frame": 1212, "first_seen_epoch": "1641571509.846552", "last_seen_epoch": "1641571510.043955", "packets": 19, "bytes": 6243, "initiator_bytes": 1038, "responder_bytes": 5205 }, { "flow_id": "flow-472b8cbe0b7482ed5fff8e48", "transport": "udp", "stream": 45, "initiator_ip": "192.168.1.216", "initiator_port": 57427, "responder_ip": "192.168.1.2", "responder_port": 53, "first_frame": 1216, "last_frame": 1217, "first_seen_epoch": "1641571525.758283", "last_seen_epoch": "1641571525.758686", "packets": 2, "bytes": 233, "initiator_bytes": 79, "responder_bytes": 154 }, { "flow_id": "flow-e0a42468049427643b94c3ed", "transport": "udp", "stream": 46, "initiator_ip": "192.168.1.216", "initiator_port": 53925, "responder_ip": "192.168.1.2", "responder_port": 53, "first_frame": 1218, "last_frame": 1219, "first_seen_epoch": "1641571525.759254", "last_seen_epoch": "1641571525.759539", "packets": 2, "bytes": 227, "initiator_bytes": 76, "responder_bytes": 151 }, { "flow_id": "flow-7d4da6aeb19bab3b0a444c74", "transport": "udp", "stream": 47, "initiator_ip": "192.168.1.216", "initiator_port": 50784, "responder_ip": "192.168.1.2", "responder_port": 53, "first_frame": 1226, "last_frame": 1227, "first_seen_epoch": "1641571549.025125", "last_seen_epoch": "1641571549.058698", "packets": 2, "bytes": 292, "initiator_bytes": 72, "responder_bytes": 220 }, { "flow_id": "flow-52916a6f15c0c10cb80888cf", "transport": "tcp", "stream": 57, "initiator_ip": "192.168.1.216", "initiator_port": 49730, "responder_ip": "204.79.197.200", "responder_port": 443, "first_frame": 1228, "last_frame": 1410, "first_seen_epoch": "1641571549.060032", "last_seen_epoch": "1641571609.340698", "packets": 32, "bytes": 11342, "initiator_bytes": 3445, "responder_bytes": 7897 }, { "flow_id": "flow-2f169239038711d6446c1a3b", "transport": "udp", "stream": 48, "initiator_ip": "192.168.1.216", "initiator_port": 51601, "responder_ip": "192.168.1.2", "responder_port": 53, "first_frame": 1262, "last_frame": 1263, "first_seen_epoch": "1641571552.557004", "last_seen_epoch": "1641571552.557345", "packets": 2, "bytes": 316, "initiator_bytes": 126, "responder_bytes": 190 }, { "flow_id": "flow-2eb20c2a4f2d09c1e516ac05", "transport": "udp", "stream": 49, "initiator_ip": "192.168.1.216", "initiator_port": 51602, "responder_ip": "192.168.1.2", "responder_port": 389, "first_frame": 1264, "last_frame": 1265, "first_seen_epoch": "1641571552.558105", "last_seen_epoch": "1641571552.558466", "packets": 2, "bytes": 497, "initiator_bytes": 265, "responder_bytes": 232 }, { "flow_id": "flow-4bd80079fb4b69317b667126", "transport": "tcp", "stream": 58, "initiator_ip": "192.168.1.216", "initiator_port": 49731, "responder_ip": "192.168.1.2", "responder_port": 135, "first_frame": 1266, "last_frame": 1335, "first_seen_epoch": "1641571552.673463", "last_seen_epoch": "1641571552.703253", "packets": 10, "bytes": 1512, "initiator_bytes": 832, "responder_bytes": 680 }, { "flow_id": "flow-e5389d76d0097eeef96a43bf", "transport": "tcp", "stream": 59, "initiator_ip": "192.168.1.216", "initiator_port": 49732, "responder_ip": "192.168.1.2", "responder_port": 49667, "first_frame": 1273, "last_frame": 1336, "first_seen_epoch": "1641571552.678034", "last_seen_epoch": "1641571552.703363", "packets": 22, "bytes": 6735, "initiator_bytes": 4346, "responder_bytes": 2389 }, { "flow_id": "flow-6de5b58ad5111422780d9f72", "transport": "tcp", "stream": 60, "initiator_ip": "192.168.1.216", "initiator_port": 49733, "responder_ip": "192.168.1.2", "responder_port": 389, "first_frame": 1296, "last_frame": 1334, "first_seen_epoch": "1641571552.689182", "last_seen_epoch": "1641571552.700806", "packets": 21, "bytes": 7530, "initiator_bytes": 3513, "responder_bytes": 4017 }, { "flow_id": "flow-f9027fd305cc015ef8bd74cf", "transport": "tcp", "stream": 61, "initiator_ip": "192.168.1.216", "initiator_port": 49734, "responder_ip": "192.168.1.2", "responder_port": 389, "first_frame": 1313, "last_frame": 1331, "first_seen_epoch": "1641571552.696354", "last_seen_epoch": "1641571552.700552", "packets": 18, "bytes": 6948, "initiator_bytes": 2915, "responder_bytes": 4033 }, { "flow_id": "flow-00fc1a0e0f85069f73f5ec43", "transport": "udp", "stream": 50, "initiator_ip": "192.168.1.216", "initiator_port": 54830, "responder_ip": "192.168.1.2", "responder_port": 53, "first_frame": 1351, "last_frame": 1352, "first_seen_epoch": "1641571594.628885", "last_seen_epoch": "1641571594.651655", "packets": 2, "bytes": 305, "initiator_bytes": 89, "responder_bytes": 216 }, { "flow_id": "flow-787044a7bf3ef824af04a27b", "transport": "tcp", "stream": 62, "initiator_ip": "192.168.1.216", "initiator_port": 49735, "responder_ip": "20.189.173.1", "responder_port": 443, "first_frame": 1353, "last_frame": 1409, "first_seen_epoch": "1641571594.652673", "last_seen_epoch": "1641571595.730965", "packets": 57, "bytes": 27190, "initiator_bytes": 18970, "responder_bytes": 8220 }, { "flow_id": "flow-dd158d1e5a62e0384c9d7694", "transport": "udp", "stream": 51, "initiator_ip": "192.168.1.216", "initiator_port": 49637, "responder_ip": "192.168.1.2", "responder_port": 53, "first_frame": 1429, "last_frame": 1430, "first_seen_epoch": "1641571629.707631", "last_seen_epoch": "1641571629.756383", "packets": 2, "bytes": 223, "initiator_bytes": 82, "responder_bytes": 141 }, { "flow_id": "flow-0e8ed030b0649b0d5aead94f", "transport": "tcp", "stream": 63, "initiator_ip": "192.168.1.216", "initiator_port": 49736, "responder_ip": "40.83.240.146", "responder_port": 443, "first_frame": 1431, "last_frame": 1483, "first_seen_epoch": "1641571629.758888", "last_seen_epoch": "1641571630.226689", "packets": 27, "bytes": 8345, "initiator_bytes": 2909, "responder_bytes": 5436 }, { "flow_id": "flow-55ee3b1dca63e50f3380f2ef", "transport": "udp", "stream": 52, "initiator_ip": "192.168.1.216", "initiator_port": 50412, "responder_ip": "192.168.1.2", "responder_port": 53, "first_frame": 1432, "last_frame": 1437, "first_seen_epoch": "1641571629.810602", "last_seen_epoch": "1641571629.857438", "packets": 2, "bytes": 313, "initiator_bytes": 83, "responder_bytes": 230 }, { "flow_id": "flow-111e52289ef640705d291e80", "transport": "tcp", "stream": 64, "initiator_ip": "192.168.1.216", "initiator_port": 49737, "responder_ip": "104.212.67.47", "responder_port": 443, "first_frame": 1438, "last_frame": 1489, "first_seen_epoch": "1641571629.863062", "last_seen_epoch": "1641571630.517165", "packets": 30, "bytes": 10638, "initiator_bytes": 2866, "responder_bytes": 7772 }, { "flow_id": "flow-2da113d15b925eab56f1d7d7", "transport": "tcp", "stream": 65, "initiator_ip": "192.168.1.216", "initiator_port": 49738, "responder_ip": "2.56.57.108", "responder_port": 80, "first_frame": 1498, "last_frame": 4832, "first_seen_epoch": "1641571652.062756", "last_seen_epoch": "1641571657.145044", "packets": 3335, "bytes": 3598989, "initiator_bytes": 435174, "responder_bytes": 3163815 }, { "flow_id": "flow-1399ed05653df69df11d51ed", "transport": "tcp", "stream": 66, "initiator_ip": "192.168.1.216", "initiator_port": 49739, "responder_ip": "52.168.112.67", "responder_port": 443, "first_frame": 4848, "last_frame": 4890, "first_seen_epoch": "1641571782.294382", "last_seen_epoch": "1641571892.363718", "packets": 35, "bytes": 15638, "initiator_bytes": 7940, "responder_bytes": 7698 }, { "flow_id": "flow-3f57d7cc46c8b13daa3ec854", "transport": "udp", "stream": 53, "initiator_ip": "192.168.1.216", "initiator_port": 50418, "responder_ip": "192.168.1.2", "responder_port": 53, "first_frame": 4908, "last_frame": 4909, "first_seen_epoch": "1641572051.907753", "last_seen_epoch": "1641572051.961202", "packets": 2, "bytes": 245, "initiator_bytes": 91, "responder_bytes": 154 }, { "flow_id": "flow-c37c08ad72319fc18cbebbf1", "transport": "tcp", "stream": 67, "initiator_ip": "192.168.1.216", "initiator_port": 49740, "responder_ip": "52.183.220.149", "responder_port": 443, "first_frame": 4910, "last_frame": 4934, "first_seen_epoch": "1641572051.968627", "last_seen_epoch": "1641572052.212752", "packets": 25, "bytes": 6348, "initiator_bytes": 1605, "responder_bytes": 4743 }, { "flow_id": "flow-69e4ccdbf71fea69c49700b1", "transport": "udp", "stream": 54, "initiator_ip": "192.168.1.216", "initiator_port": 52991, "responder_ip": "192.168.1.2", "responder_port": 53, "first_frame": 4936, "last_frame": 4937, "first_seen_epoch": "1641572057.582136", "last_seen_epoch": "1641572057.607589", "packets": 2, "bytes": 306, "initiator_bytes": 86, "responder_bytes": 220 }, { "flow_id": "flow-c91e52662f2642659a67b6e2", "transport": "tcp", "stream": 68, "initiator_ip": "192.168.1.216", "initiator_port": 49741, "responder_ip": "52.249.36.204", "responder_port": 443, "first_frame": 4938, "last_frame": 5142, "first_seen_epoch": "1641572057.610119", "last_seen_epoch": "1641572058.844458", "packets": 140, "bytes": 92612, "initiator_bytes": 26444, "responder_bytes": 66168 }, { "flow_id": "flow-d908e5f49e7011dd37e4d853", "transport": "udp", "stream": 55, "initiator_ip": "192.168.1.216", "initiator_port": 57383, "responder_ip": "192.168.1.2", "responder_port": 53, "first_frame": 5042, "last_frame": 5043, "first_seen_epoch": "1641572058.185053", "last_seen_epoch": "1641572058.223585", "packets": 2, "bytes": 328, "initiator_bytes": 86, "responder_bytes": 242 }, { "flow_id": "flow-c4e5475153bbb2f4e4f43bba", "transport": "tcp", "stream": 69, "initiator_ip": "192.168.1.216", "initiator_port": 49742, "responder_ip": "23.38.189.225", "responder_port": 80, "first_frame": 5044, "last_frame": 5115, "first_seen_epoch": "1641572058.224318", "last_seen_epoch": "1641572058.531535", "packets": 43, "bytes": 29664, "initiator_bytes": 1677, "responder_bytes": 27987 }, { "flow_id": "flow-b177aefa09b0c9da82013ac9", "transport": "udp", "stream": 56, "initiator_ip": "192.168.1.216", "initiator_port": 56598, "responder_ip": "192.168.1.2", "responder_port": 53, "first_frame": 5083, "last_frame": 5084, "first_seen_epoch": "1641572058.338024", "last_seen_epoch": "1641572058.364212", "packets": 2, "bytes": 309, "initiator_bytes": 89, "responder_bytes": 220 }, { "flow_id": "flow-6232014a137d66fe6beefcac", "transport": "tcp", "stream": 70, "initiator_ip": "192.168.1.216", "initiator_port": 49743, "responder_ip": "52.178.17.2", "responder_port": 443, "first_frame": 5085, "last_frame": 5147, "first_seen_epoch": "1641572058.364959", "last_seen_epoch": "1641572059.336222", "packets": 23, "bytes": 8526, "initiator_bytes": 2959, "responder_bytes": 5567 }, { "flow_id": "flow-a002c0fa02a09e1134757033", "transport": "udp", "stream": 57, "initiator_ip": "192.168.1.216", "initiator_port": 51593, "responder_ip": "192.168.1.2", "responder_port": 53, "first_frame": 5148, "last_frame": 5149, "first_seen_epoch": "1641572059.38028", "last_seen_epoch": "1641572059.425017", "packets": 2, "bytes": 270, "initiator_bytes": 91, "responder_bytes": 179 }, { "flow_id": "flow-197e1019dd4302016fc808b4", "transport": "tcp", "stream": 71, "initiator_ip": "192.168.1.216", "initiator_port": 49744, "responder_ip": "20.54.89.15", "responder_port": 443, "first_frame": 5150, "last_frame": 5234, "first_seen_epoch": "1641572059.425608", "last_seen_epoch": "1641572061.606902", "packets": 57, "bytes": 23105, "initiator_bytes": 16574, "responder_bytes": 6531 }, { "flow_id": "flow-17cee670e52f8a5ca959599f", "transport": "tcp", "stream": 72, "initiator_ip": "192.168.1.216", "initiator_port": 49745, "responder_ip": "52.178.17.2", "responder_port": 443, "first_frame": 5179, "last_frame": 5230, "first_seen_epoch": "1641572060.431371", "last_seen_epoch": "1641572061.438377", "packets": 28, "bytes": 12237, "initiator_bytes": 6509, "responder_bytes": 5728 }, { "flow_id": "flow-f3a4fb6229d8219b0e084a78", "transport": "udp", "stream": 58, "initiator_ip": "192.168.1.216", "initiator_port": 63706, "responder_ip": "192.168.1.2", "responder_port": 53, "first_frame": 5235, "last_frame": 5236, "first_seen_epoch": "1641572061.6678", "last_seen_epoch": "1641572061.710826", "packets": 2, "bytes": 271, "initiator_bytes": 92, "responder_bytes": 179 }, { "flow_id": "flow-bfb09cadf2a160709479f266", "transport": "tcp", "stream": 73, "initiator_ip": "192.168.1.216", "initiator_port": 49746, "responder_ip": "52.179.216.235", "responder_port": 443, "first_frame": 5237, "last_frame": 5263, "first_seen_epoch": "1641572061.713827", "last_seen_epoch": "1641572062.095903", "packets": 24, "bytes": 5161, "initiator_bytes": 1286, "responder_bytes": 3875 }, { "flow_id": "flow-144910c47e437be640cbd2f6", "transport": "udp", "stream": 59, "initiator_ip": "192.168.1.216", "initiator_port": 64283, "responder_ip": "192.168.1.2", "responder_port": 53, "first_frame": 5259, "last_frame": 5260, "first_seen_epoch": "1641572062.028713", "last_seen_epoch": "1641572062.084821", "packets": 2, "bytes": 298, "initiator_bytes": 94, "responder_bytes": 204 }, { "flow_id": "flow-8db34c7af02aaae0745df06a", "transport": "tcp", "stream": 74, "initiator_ip": "192.168.1.216", "initiator_port": 49747, "responder_ip": "184.50.62.43", "responder_port": 443, "first_frame": 5261, "last_frame": 5763, "first_seen_epoch": "1641572062.085609", "last_seen_epoch": "1641572081.420959", "packets": 26, "bytes": 9304, "initiator_bytes": 1316, "responder_bytes": 7988 }, { "flow_id": "flow-bdbace23f876ae1c85299c08", "transport": "udp", "stream": 60, "initiator_ip": "192.168.1.216", "initiator_port": 53485, "responder_ip": "192.168.1.2", "responder_port": 53, "first_frame": 5282, "last_frame": 5283, "first_seen_epoch": "1641572062.288601", "last_seen_epoch": "1641572062.288922", "packets": 2, "bytes": 298, "initiator_bytes": 94, "responder_bytes": 204 }, { "flow_id": "flow-f16d9b57a1a827615ef84fdd", "transport": "tcp", "stream": 75, "initiator_ip": "192.168.1.216", "initiator_port": 49748, "responder_ip": "184.50.62.43", "responder_port": 443, "first_frame": 5284, "last_frame": 5746, "first_seen_epoch": "1641572062.289452", "last_seen_epoch": "1641572078.105548", "packets": 25, "bytes": 8731, "initiator_bytes": 1566, "responder_bytes": 7165 }, { "flow_id": "flow-06a72082027f282472909467", "transport": "udp", "stream": 61, "initiator_ip": "192.168.1.216", "initiator_port": 52801, "responder_ip": "192.168.1.2", "responder_port": 53, "first_frame": 5302, "last_frame": 5303, "first_seen_epoch": "1641572062.424316", "last_seen_epoch": "1641572062.424599", "packets": 2, "bytes": 334, "initiator_bytes": 89, "responder_bytes": 245 }, { "flow_id": "flow-2503946546e3b70d2de04a17", "transport": "tcp", "stream": 76, "initiator_ip": "192.168.1.216", "initiator_port": 49749, "responder_ip": "23.38.189.225", "responder_port": 80, "first_frame": 5304, "last_frame": 5771, "first_seen_epoch": "1641572062.438253", "last_seen_epoch": "1641572092.677261", "packets": 330, "bytes": 326933, "initiator_bytes": 6629, "responder_bytes": 320304 }, { "flow_id": "flow-783b8e61732327bd64cbb7f5", "transport": "tcp", "stream": 77, "initiator_ip": "192.168.1.216", "initiator_port": 49750, "responder_ip": "23.38.189.201", "responder_port": 80, "first_frame": 5305, "last_frame": 5769, "first_seen_epoch": "1641572062.438638", "last_seen_epoch": "1641572092.676286", "packets": 11, "bytes": 1336, "initiator_bytes": 672, "responder_bytes": 664 }, { "flow_id": "flow-2b352e43f5295c0108fa0c39", "transport": "udp", "stream": 62, "initiator_ip": "192.168.1.216", "initiator_port": 53041, "responder_ip": "192.168.1.2", "responder_port": 53, "first_frame": 5638, "last_frame": 5639, "first_seen_epoch": "1641572062.804566", "last_seen_epoch": "1641572062.83315", "packets": 2, "bytes": 309, "initiator_bytes": 89, "responder_bytes": 220 }, { "flow_id": "flow-41562a5941bd1407c1c4555b", "transport": "tcp", "stream": 78, "initiator_ip": "192.168.1.216", "initiator_port": 49751, "responder_ip": "52.178.17.2", "responder_port": 443, "first_frame": 5640, "last_frame": 5662, "first_seen_epoch": "1641572062.833783", "last_seen_epoch": "1641572063.895409", "packets": 23, "bytes": 8913, "initiator_bytes": 3346, "responder_bytes": 5567 }, { "flow_id": "flow-b27a78f3acbdae6292e1a91b", "transport": "tcp", "stream": 79, "initiator_ip": "192.168.1.216", "initiator_port": 49752, "responder_ip": "52.178.17.2", "responder_port": 443, "first_frame": 5663, "last_frame": 5687, "first_seen_epoch": "1641572063.94695", "last_seen_epoch": "1641572064.822136", "packets": 25, "bytes": 9437, "initiator_bytes": 3817, "responder_bytes": 5620 }, { "flow_id": "flow-2b77d8e9d03b7acfd534e39d", "transport": "udp", "stream": 63, "initiator_ip": "192.168.1.216", "initiator_port": 53043, "responder_ip": "239.255.255.250", "responder_port": 1900, "first_frame": 5688, "last_frame": 5715, "first_seen_epoch": "1641572065.601007", "last_seen_epoch": "1641572071.597874", "packets": 8, "bytes": 1432, "initiator_bytes": 1432, "responder_bytes": 0 }, { "flow_id": "flow-690e3c22aefb22a3f4c934a1", "transport": "tcp", "stream": 80, "initiator_ip": "192.168.1.216", "initiator_port": 49757, "responder_ip": "192.168.1.2", "responder_port": 135, "first_frame": 5694, "last_frame": 5755, "first_seen_epoch": "1641572069.777937", "last_seen_epoch": "1641572080.221875", "packets": 12, "bytes": 1292, "initiator_bytes": 730, "responder_bytes": 562 }, { "flow_id": "flow-3b69f59b3b07122e829d2f3c", "transport": "tcp", "stream": 81, "initiator_ip": "192.168.1.216", "initiator_port": 49758, "responder_ip": "192.168.1.2", "responder_port": 49667, "first_frame": 5701, "last_frame": 5756, "first_seen_epoch": "1641572069.77996", "last_seen_epoch": "1641572080.221901", "packets": 16, "bytes": 2400, "initiator_bytes": 1438, "responder_bytes": 962 }, { "flow_id": "flow-d5c053863afacdc11f2fa0a7", "transport": "udp", "stream": 64, "initiator_ip": "192.168.1.216", "initiator_port": 50116, "responder_ip": "192.168.1.2", "responder_port": 53, "first_frame": 5716, "last_frame": 5717, "first_seen_epoch": "1641572072.032616", "last_seen_epoch": "1641572072.033379", "packets": 2, "bytes": 309, "initiator_bytes": 89, "responder_bytes": 220 }, { "flow_id": "flow-35ab3ebf0c482b94f5641f6a", "transport": "tcp", "stream": 82, "initiator_ip": "192.168.1.216", "initiator_port": 49759, "responder_ip": "52.178.17.2", "responder_port": 443, "first_frame": 5718, "last_frame": 5740, "first_seen_epoch": "1641572072.034292", "last_seen_epoch": "1641572072.936913", "packets": 23, "bytes": 8876, "initiator_bytes": 3309, "responder_bytes": 5567 }, { "flow_id": "flow-38425d032a93d3a63921b461", "transport": "udp", "stream": 65, "initiator_ip": "192.168.1.216", "initiator_port": 64194, "responder_ip": "192.168.1.2", "responder_port": 53, "first_frame": 5774, "last_frame": 5775, "first_seen_epoch": "1641572117.846671", "last_seen_epoch": "1641572117.890524", "packets": 2, "bytes": 342, "initiator_bytes": 83, "responder_bytes": 259 }, { "flow_id": "flow-eab6d2104b6e17a9d1d1d60f", "transport": "tcp", "stream": 83, "initiator_ip": "192.168.1.216", "initiator_port": 49760, "responder_ip": "8.253.189.126", "responder_port": 80, "first_frame": 5776, "last_frame": 5854, "first_seen_epoch": "1641572117.893981", "last_seen_epoch": "1641572177.970807", "packets": 11, "bytes": 1231, "initiator_bytes": 623, "responder_bytes": 608 }, { "flow_id": "flow-7bb8848d420d35f375dc80a0", "transport": "udp", "stream": 66, "initiator_ip": "192.168.1.216", "initiator_port": 54574, "responder_ip": "192.168.1.2", "responder_port": 53, "first_frame": 5783, "last_frame": 5784, "first_seen_epoch": "1641572125.772644", "last_seen_epoch": "1641572125.773037", "packets": 2, "bytes": 233, "initiator_bytes": 79, "responder_bytes": 154 }, { "flow_id": "flow-9dd9b0c3eed6321a3e0b6bc0", "transport": "udp", "stream": 67, "initiator_ip": "192.168.1.216", "initiator_port": 63979, "responder_ip": "192.168.1.2", "responder_port": 53, "first_frame": 5785, "last_frame": 5786, "first_seen_epoch": "1641572125.773568", "last_seen_epoch": "1641572125.810645", "packets": 2, "bytes": 227, "initiator_bytes": 76, "responder_bytes": 151 }, { "flow_id": "flow-da2f5d2f73f2525d10b76a25", "transport": "udp", "stream": 68, "initiator_ip": "192.168.1.2", "initiator_port": 137, "responder_ip": "192.168.1.216", "responder_port": 137, "first_frame": 5795, "last_frame": 5795, "first_seen_epoch": "1641572169.958741", "last_seen_epoch": "1641572169.958741", "packets": 1, "bytes": 104, "initiator_bytes": 104, "responder_bytes": 0 }, { "flow_id": "flow-b15bdcd0473915f8baf543eb", "transport": "tcp", "stream": 84, "initiator_ip": "192.168.1.216", "initiator_port": 49761, "responder_ip": "192.168.1.2", "responder_port": 139, "first_frame": 5796, "last_frame": 5861, "first_seen_epoch": "1641572169.95914", "last_seen_epoch": "1641572181.507097", "packets": 24, "bytes": 3540, "initiator_bytes": 1727, "responder_bytes": 1813 }, { "flow_id": "flow-bf0d329edb15dfba5b17b842", "transport": "udp", "stream": 69, "initiator_ip": "192.168.1.216", "initiator_port": 61904, "responder_ip": "192.168.1.2", "responder_port": 53, "first_frame": 5820, "last_frame": 5821, "first_seen_epoch": "1641572170.859", "last_seen_epoch": "1641572170.913852", "packets": 2, "bytes": 292, "initiator_bytes": 72, "responder_bytes": 220 }, { "flow_id": "flow-cccd0e2b1059f1be03ee1364", "transport": "tcp", "stream": 85, "initiator_ip": "192.168.1.216", "initiator_port": 49762, "responder_ip": "204.79.197.200", "responder_port": 443, "first_frame": 5822, "last_frame": 5849, "first_seen_epoch": "1641572170.915415", "last_seen_epoch": "1641572171.064829", "packets": 28, "bytes": 11088, "initiator_bytes": 3282, "responder_bytes": 7806 }, { "flow_id": "flow-17b45daf1d441cc90f50b5d4", "transport": "tcp", "stream": 86, "initiator_ip": "192.168.1.216", "initiator_port": 49763, "responder_ip": "192.168.1.2", "responder_port": 139, "first_frame": 5862, "last_frame": 5880, "first_seen_epoch": "1641572199.977539", "last_seen_epoch": "1641572200.035978", "packets": 17, "bytes": 3010, "initiator_bytes": 1441, "responder_bytes": 1569 } ], "events": { "dns": [ { "event_id": "evt-92f8b324734a21681d6fe87e", "kind": "dns", "frame_number": 16, "timestamp_epoch": "1641571449.662793000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": 61726, "dst_port": 53, "tcp_stream": null, "udp_stream": 4, "fields": { "dns.flags.response": "False", "dns.qry.name": "_ldap._tcp.dc._msdcs.spoonwatch.net", "dns.qry.type": "33" } }, { "event_id": "evt-907b57f1630b0b9ec2524a16", "kind": "dns", "frame_number": 17, "timestamp_epoch": "1641571449.663053000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": 53, "dst_port": 61726, "tcp_stream": null, "udp_stream": 4, "fields": { "dns.a": "192.168.1.2", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "_ldap._tcp.dc._msdcs.spoonwatch.net", "dns.qry.type": "33" } }, { "event_id": "evt-efb9510b47b3ce08af970837", "kind": "dns", "frame_number": 18, "timestamp_epoch": "1641571449.667717000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": 65037, "dst_port": 53, "tcp_stream": null, "udp_stream": 5, "fields": { "dns.flags.response": "False", "dns.qry.name": "spoonwatch-dc.spoonwatch.net", "dns.qry.type": "1" } }, { "event_id": "evt-47b27c6a165484520bb613e2", "kind": "dns", "frame_number": 19, "timestamp_epoch": "1641571449.667971000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": 53, "dst_port": 65037, "tcp_stream": null, "udp_stream": 5, "fields": { "dns.a": "192.168.1.2", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "spoonwatch-dc.spoonwatch.net", "dns.qry.type": "1" } }, { "event_id": "evt-baf4ccc91e86522b21050b9d", "kind": "dns", "frame_number": 22, "timestamp_epoch": "1641571449.759391000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": 63494, "dst_port": 53, "tcp_stream": null, "udp_stream": 7, "fields": { "dns.flags.response": "False", "dns.qry.name": "_ldap._tcp.dc._msdcs.localdomain.spoonwatch.net", "dns.qry.type": "33" } }, { "event_id": "evt-da6154f4d48252c3138479a9", "kind": "dns", "frame_number": 23, "timestamp_epoch": "1641571449.759693000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": 53, "dst_port": 63494, "tcp_stream": null, "udp_stream": 7, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "_ldap._tcp.dc._msdcs.localdomain.spoonwatch.net", "dns.qry.type": "33" } }, { "event_id": "evt-a39accab7cbd7571c4e2acce", "kind": "dns", "frame_number": 31, "timestamp_epoch": "1641571449.767426000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": 65355, "dst_port": 53, "tcp_stream": null, "udp_stream": 8, "fields": { "dns.flags.response": "False", "dns.qry.name": "_ldap._tcp.dc._msdcs.localdomain.spoonwatch.net", "dns.qry.type": "33" } }, { "event_id": "evt-6fc25a259534b84629c49758", "kind": "dns", "frame_number": 32, "timestamp_epoch": "1641571449.767708000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": 53, "dst_port": 65355, "tcp_stream": null, "udp_stream": 8, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "_ldap._tcp.dc._msdcs.localdomain.spoonwatch.net", "dns.qry.type": "33" } }, { "event_id": "evt-99e87f72ec2253b24c01e2ce", "kind": "dns", "frame_number": 49, "timestamp_epoch": "1641571450.459752000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": 53268, "dst_port": 53, "tcp_stream": null, "udp_stream": 11, "fields": { "dns.flags.response": "False", "dns.qry.name": "dns.msftncsi.com", "dns.qry.type": "1" } }, { "event_id": "evt-a717ca73730b4481b7b21a54", "kind": "dns", "frame_number": 50, "timestamp_epoch": "1641571450.489184000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": 53, "dst_port": 53268, "tcp_stream": null, "udp_stream": 11, "fields": { "dns.a": "131.107.255.255", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "dns.msftncsi.com", "dns.qry.type": "1" } }, { "event_id": "evt-ef3e13868da79fa21fd13d70", "kind": "dns", "frame_number": 52, "timestamp_epoch": "1641571450.649768000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": 60964, "dst_port": 53, "tcp_stream": null, "udp_stream": 12, "fields": { "dns.flags.response": "False", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.spoonwatch.net", "dns.qry.type": "33" } }, { "event_id": "evt-da4ec72b73a857a913a2c587", "kind": "dns", "frame_number": 53, "timestamp_epoch": "1641571450.650111000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": 53, "dst_port": 60964, "tcp_stream": null, "udp_stream": 12, "fields": { "dns.a": "192.168.1.2", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.spoonwatch.net", "dns.qry.type": "33" } }, { "event_id": "evt-ba2f5bcd0c875e8b7221a20e", "kind": "dns", "frame_number": 54, "timestamp_epoch": "1641571450.659570000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": 55912, "dst_port": 53, "tcp_stream": null, "udp_stream": 13, "fields": { "dns.flags.response": "False", "dns.qry.name": "_kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.spoonwatch.net", "dns.qry.type": "33" } }, { "event_id": "evt-a22a5dd7036f90eabd8be77e", "kind": "dns", "frame_number": 55, "timestamp_epoch": "1641571450.659897000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": 53, "dst_port": 55912, "tcp_stream": null, "udp_stream": 13, "fields": { "dns.a": "192.168.1.2", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "_kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.spoonwatch.net", "dns.qry.type": "33" } }, { "event_id": "evt-5f0128675c9402ea9821f824", "kind": "dns", "frame_number": 56, "timestamp_epoch": "1641571450.735414000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": 63059, "dst_port": 53, "tcp_stream": null, "udp_stream": 14, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.spoonwatch.net", "dns.qry.type": "1" } }, { "event_id": "evt-2221c4b1f348b61b2803aa79", "kind": "dns", "frame_number": 57, "timestamp_epoch": "1641571450.735787000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": 53, "dst_port": 63059, "tcp_stream": null, "udp_stream": 14, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.spoonwatch.net", "dns.qry.type": "1" } }, { "event_id": "evt-92e436eb6281456d16bc3a66", "kind": "dns", "frame_number": 58, "timestamp_epoch": "1641571450.736957000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": 52741, "dst_port": 53, "tcp_stream": null, "udp_stream": 15, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.localdomain", "dns.qry.type": "1" } }, { "event_id": "evt-adcdebe5881d7931d853c930", "kind": "dns", "frame_number": 59, "timestamp_epoch": "1641571450.737214000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": 53, "dst_port": 52741, "tcp_stream": null, "udp_stream": 15, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.localdomain", "dns.qry.type": "1" } }, { "event_id": "evt-613b3fb7197315d614112334", "kind": "dns", "frame_number": 222, "timestamp_epoch": "1641571450.996084000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": 60456, "dst_port": 53, "tcp_stream": null, "udp_stream": 22, "fields": { "dns.flags.response": "False", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.ForestDnsZones.spoonwatch.net", "dns.qry.type": "33" } }, { "event_id": "evt-670ce9e9e324ed8732aa60ea", "kind": "dns", "frame_number": 223, "timestamp_epoch": "1641571450.996311000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": 53, "dst_port": 60456, "tcp_stream": null, "udp_stream": 22, "fields": { "dns.a": "192.168.1.2", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.ForestDnsZones.spoonwatch.net", "dns.qry.type": "33" } }, { "event_id": "evt-f1cfea9e46c126dbc49f34db", "kind": "dns", "frame_number": 342, "timestamp_epoch": "1641571451.139079000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": 57004, "dst_port": 53, "tcp_stream": null, "udp_stream": 24, "fields": { "dns.flags.response": "False", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.DomainDnsZones.spoonwatch.net", "dns.qry.type": "33" } }, { "event_id": "evt-9dbceff701c58b7b13617bde", "kind": "dns", "frame_number": 343, "timestamp_epoch": "1641571451.139418000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": 53, "dst_port": 57004, "tcp_stream": null, "udp_stream": 24, "fields": { "dns.a": "192.168.1.2", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.DomainDnsZones.spoonwatch.net", "dns.qry.type": "33" } }, { "event_id": "evt-a70fdbb11c4611fd246cf1b7", "kind": "dns", "frame_number": 358, "timestamp_epoch": "1641571451.297155000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": 53374, "dst_port": 53, "tcp_stream": null, "udp_stream": 26, "fields": { "dns.flags.response": "False", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.spoonwatch.net", "dns.qry.type": "33" } }, { "event_id": "evt-d7a321a30024d46fce7faada", "kind": "dns", "frame_number": 359, "timestamp_epoch": "1641571451.297339000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": 53, "dst_port": 53374, "tcp_stream": null, "udp_stream": 26, "fields": { "dns.a": "192.168.1.2", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.spoonwatch.net", "dns.qry.type": "33" } }, { "event_id": "evt-69c1791ec353e77dee1a7c48", "kind": "dns", "frame_number": 369, "timestamp_epoch": "1641571451.429178000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": 53645, "dst_port": 53, "tcp_stream": null, "udp_stream": 28, "fields": { "dns.flags.response": "False", "dns.qry.name": "SPOONWATCH-DC.spoonwatch.net", "dns.qry.type": "1" } }, { "event_id": "evt-8b1aed1e12f39ae70f72703b", "kind": "dns", "frame_number": 374, "timestamp_epoch": "1641571451.429803000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": 53, "dst_port": 53645, "tcp_stream": null, "udp_stream": 28, "fields": { "dns.a": "192.168.1.2", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "SPOONWATCH-DC.spoonwatch.net", "dns.qry.type": "1" } }, { "event_id": "evt-03c5bc9571dd4a02d2996409", "kind": "dns", "frame_number": 599, "timestamp_epoch": "1641571454.426446000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": 55162, "dst_port": 53, "tcp_stream": null, "udp_stream": 29, "fields": { "dns.flags.response": "False", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.spoonwatch.net", "dns.qry.type": "33" } }, { "event_id": "evt-06f8c15eac6c2e77a02b5869", "kind": "dns", "frame_number": 600, "timestamp_epoch": "1641571454.426813000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": 53, "dst_port": 55162, "tcp_stream": null, "udp_stream": 29, "fields": { "dns.a": "192.168.1.2", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.spoonwatch.net", "dns.qry.type": "33" } }, { "event_id": "evt-88548299155754f1a142a3de", "kind": "dns", "frame_number": 760, "timestamp_epoch": "1641571461.683546000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": 65113, "dst_port": 53, "tcp_stream": null, "udp_stream": 36, "fields": { "dns.flags.response": "False", "dns.qry.name": "self.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-372681af9971b7f8af7931ac", "kind": "dns", "frame_number": 761, "timestamp_epoch": "1641571461.710748000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": 53, "dst_port": 65113, "tcp_stream": null, "udp_stream": 36, "fields": { "dns.a": "52.168.112.67", "dns.cname": "self-events-data.trafficmanager.net,onedscolprdeus04.eastus.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "self.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-3d3903682f8cd9bc96131062", "kind": "dns", "frame_number": 804, "timestamp_epoch": "1641571465.750273000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": 54741, "dst_port": 53, "tcp_stream": null, "udp_stream": 37, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.spoonwatch.net", "dns.qry.type": "1" } }, { "event_id": "evt-722ef381c4b8e74c4c8481ee", "kind": "dns", "frame_number": 805, "timestamp_epoch": "1641571465.750678000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": 53, "dst_port": 54741, "tcp_stream": null, "udp_stream": 37, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.spoonwatch.net", "dns.qry.type": "1" } }, { "event_id": "evt-f504e96441786ece221d79a6", "kind": "dns", "frame_number": 806, "timestamp_epoch": "1641571465.751109000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": 64826, "dst_port": 53, "tcp_stream": null, "udp_stream": 38, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.localdomain", "dns.qry.type": "1" } }, { "event_id": "evt-06ca89a4269f0fbbcc845b02", "kind": "dns", "frame_number": 807, "timestamp_epoch": "1641571465.751365000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": 53, "dst_port": 64826, "tcp_stream": null, "udp_stream": 38, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.localdomain", "dns.qry.type": "1" } }, { "event_id": "evt-1e351979b7524a3a22d4f347", "kind": "dns", "frame_number": 863, "timestamp_epoch": "1641571491.724441000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": 61981, "dst_port": 53, "tcp_stream": null, "udp_stream": 40, "fields": { "dns.flags.response": "False", "dns.qry.name": "SPOONWATCH.NET", "dns.qry.type": "1" } }, { "event_id": "evt-b5ca7453eeade5f6764dfc89", "kind": "dns", "frame_number": 864, "timestamp_epoch": "1641571491.724670000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": 53, "dst_port": 61981, "tcp_stream": null, "udp_stream": 40, "fields": { "dns.a": "192.168.1.2", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "SPOONWATCH.NET", "dns.qry.type": "1" } }, { "event_id": "evt-f60b9ec86d448fb54f554c1a", "kind": "dns", "frame_number": 1037, "timestamp_epoch": "1641571493.065847000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": 60388, "dst_port": 53, "tcp_stream": null, "udp_stream": 41, "fields": { "dns.flags.response": "False", "dns.qry.name": "v20.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-7736fb45be4435449ccffbb2", "kind": "dns", "frame_number": 1038, "timestamp_epoch": "1641571493.096639000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": 53, "dst_port": 60388, "tcp_stream": null, "udp_stream": 41, "fields": { "dns.a": "20.50.80.210", "dns.cname": "global.asimov.events.data.trafficmanager.net,onedscolprdneu05.northeurope.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "v20.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-d923cdfe5e232f23325a8f2f", "kind": "dns", "frame_number": 1061, "timestamp_epoch": "1641571494.108159000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": 57905, "dst_port": 53, "tcp_stream": null, "udp_stream": 42, "fields": { "dns.flags.response": "False", "dns.qry.name": "api.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-e7ac54050deaee0fa111945b", "kind": "dns", "frame_number": 1062, "timestamp_epoch": "1641571494.127684000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": 53, "dst_port": 57905, "tcp_stream": null, "udp_stream": 42, "fields": { "dns.a": "204.79.197.203", "dns.cname": "api-msn-com.a-0003.a-msedge.net,a-0003.a-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "api.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-0c20711314a1e3d4af0fbf1a", "kind": "dns", "frame_number": 1085, "timestamp_epoch": "1641571496.446316000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": 64104, "dst_port": 53, "tcp_stream": null, "udp_stream": 43, "fields": { "dns.flags.response": "False", "dns.qry.name": "www.bing.com", "dns.qry.type": "1" } }, { "event_id": "evt-55de7a9a804d6bf7956eecf1", "kind": "dns", "frame_number": 1086, "timestamp_epoch": "1641571496.507251000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": 53, "dst_port": 64104, "tcp_stream": null, "udp_stream": 43, "fields": { "dns.a": "204.79.197.200,13.107.21.200", "dns.cname": "a-0001.a-afdentry.net.trafficmanager.net,www-bing-com.dual-a-0001.a-msedge.net,dual-a-0001.a-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "www.bing.com", "dns.qry.type": "1" } }, { "event_id": "evt-1772cd2fd6637e55ec0b8bd7", "kind": "dns", "frame_number": 1143, "timestamp_epoch": "1641571508.772862000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": 59352, "dst_port": 53, "tcp_stream": null, "udp_stream": 44, "fields": { "dns.flags.response": "False", "dns.qry.name": "settings-win.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-c7b489a622b98bb00f9da570", "kind": "dns", "frame_number": 1144, "timestamp_epoch": "1641571508.830152000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": 53, "dst_port": 59352, "tcp_stream": null, "udp_stream": 44, "fields": { "dns.a": "52.183.220.149", "dns.cname": "settingsfd-geo.trafficmanager.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "settings-win.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-63c76d3bf671021c39cc50cc", "kind": "dns", "frame_number": 1216, "timestamp_epoch": "1641571525.758283000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": 57427, "dst_port": 53, "tcp_stream": null, "udp_stream": 45, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.spoonwatch.net", "dns.qry.type": "1" } }, { "event_id": "evt-276281e4d151fa73c928c5a4", "kind": "dns", "frame_number": 1217, "timestamp_epoch": "1641571525.758686000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": 53, "dst_port": 57427, "tcp_stream": null, "udp_stream": 45, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.spoonwatch.net", "dns.qry.type": "1" } }, { "event_id": "evt-f7747d627c8bf29f9339486b", "kind": "dns", "frame_number": 1218, "timestamp_epoch": "1641571525.759254000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": 53925, "dst_port": 53, "tcp_stream": null, "udp_stream": 46, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.localdomain", "dns.qry.type": "1" } }, { "event_id": "evt-d424ca2632cb3eba512d5eb4", "kind": "dns", "frame_number": 1219, "timestamp_epoch": "1641571525.759539000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": 53, "dst_port": 53925, "tcp_stream": null, "udp_stream": 46, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.localdomain", "dns.qry.type": "1" } }, { "event_id": "evt-894dfd957a50b84cb38ae520", "kind": "dns", "frame_number": 1226, "timestamp_epoch": "1641571549.025125000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": 50784, "dst_port": 53, "tcp_stream": null, "udp_stream": 47, "fields": { "dns.flags.response": "False", "dns.qry.name": "www.bing.com", "dns.qry.type": "1" } }, { "event_id": "evt-cd3b7c15aaeafb47a523ae27", "kind": "dns", "frame_number": 1227, "timestamp_epoch": "1641571549.058698000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": 53, "dst_port": 50784, "tcp_stream": null, "udp_stream": 47, "fields": { "dns.a": "204.79.197.200,13.107.21.200", "dns.cname": "a-0001.a-afdentry.net.trafficmanager.net,www-bing-com.dual-a-0001.a-msedge.net,dual-a-0001.a-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "www.bing.com", "dns.qry.type": "1" } }, { "event_id": "evt-22c70bcb7d1d0216e47cc8a9", "kind": "dns", "frame_number": 1262, "timestamp_epoch": "1641571552.557004000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": 51601, "dst_port": 53, "tcp_stream": null, "udp_stream": 48, "fields": { "dns.flags.response": "False", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.spoonwatch.net", "dns.qry.type": "33" } }, { "event_id": "evt-11b15f0fa80530c42d162821", "kind": "dns", "frame_number": 1263, "timestamp_epoch": "1641571552.557345000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": 53, "dst_port": 51601, "tcp_stream": null, "udp_stream": 48, "fields": { "dns.a": "192.168.1.2", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.spoonwatch.net", "dns.qry.type": "33" } }, { "event_id": "evt-5a9b31899b4ad720b7e1da0a", "kind": "dns", "frame_number": 1351, "timestamp_epoch": "1641571594.628885000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": 54830, "dst_port": 53, "tcp_stream": null, "udp_stream": 50, "fields": { "dns.flags.response": "False", "dns.qry.name": "v10.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-8b5b33da76e85da21c293dd9", "kind": "dns", "frame_number": 1352, "timestamp_epoch": "1641571594.651655000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": 53, "dst_port": 54830, "tcp_stream": null, "udp_stream": 50, "fields": { "dns.a": "20.189.173.1", "dns.cname": "global.asimov.events.data.trafficmanager.net,onedscolprdwus00.westus.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "v10.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-6964fd749900c9dcdc7b77ea", "kind": "dns", "frame_number": 1429, "timestamp_epoch": "1641571629.707631000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": 49637, "dst_port": 53, "tcp_stream": null, "udp_stream": 51, "fields": { "dns.flags.response": "False", "dns.qry.name": "client.wns.windows.com", "dns.qry.type": "1" } }, { "event_id": "evt-66f8511199156c6db6d73c74", "kind": "dns", "frame_number": 1430, "timestamp_epoch": "1641571629.756383000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": 53, "dst_port": 49637, "tcp_stream": null, "udp_stream": 51, "fields": { "dns.a": "40.83.240.146", "dns.cname": "wns.notify.trafficmanager.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "client.wns.windows.com", "dns.qry.type": "1" } }, { "event_id": "evt-dace5f83694f97ca762431bc", "kind": "dns", "frame_number": 1432, "timestamp_epoch": "1641571629.810602000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": 50412, "dst_port": 53, "tcp_stream": null, "udp_stream": 52, "fields": { "dns.flags.response": "False", "dns.qry.name": "pti.store.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-e014f6dfd87ca058231d6809", "kind": "dns", "frame_number": 1437, "timestamp_epoch": "1641571629.857438000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": 53, "dst_port": 50412, "tcp_stream": null, "udp_stream": 52, "fields": { "dns.a": "104.212.67.47", "dns.cname": "sfd-production.azurefd.net,global-geo-afdthirdparty-unicast.trafficmanager.net,las01r3.msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "pti.store.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-b4d2202cf02be47d334d1e64", "kind": "dns", "frame_number": 4908, "timestamp_epoch": "1641572051.907753000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": 50418, "dst_port": 53, "tcp_stream": null, "udp_stream": 53, "fields": { "dns.flags.response": "False", "dns.qry.name": "settings-win.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-0d10ecc847f249df33d25ec5", "kind": "dns", "frame_number": 4909, "timestamp_epoch": "1641572051.961202000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": 53, "dst_port": 50418, "tcp_stream": null, "udp_stream": 53, "fields": { "dns.a": "52.183.220.149", "dns.cname": "settingsfd-geo.trafficmanager.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "settings-win.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-445bbd61a3cd5e8875f06e7e", "kind": "dns", "frame_number": 4936, "timestamp_epoch": "1641572057.582136000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": 52991, "dst_port": 53, "tcp_stream": null, "udp_stream": 54, "fields": { "dns.flags.response": "False", "dns.qry.name": "fe2cr.update.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-a7ae2e63c6c27b0a75949f88", "kind": "dns", "frame_number": 4937, "timestamp_epoch": "1641572057.607589000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": 53, "dst_port": 52991, "tcp_stream": null, "udp_stream": 54, "fields": { "dns.a": "52.249.36.204,52.238.248.1", "dns.cname": "fe2cr.update.microsoft.com.akadns.net,fe2cr.update.msft.com.trafficmanager.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "fe2cr.update.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-c0775ecad34929de53ee7e31", "kind": "dns", "frame_number": 5042, "timestamp_epoch": "1641572058.185053000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": 57383, "dst_port": 53, "tcp_stream": null, "udp_stream": 55, "fields": { "dns.flags.response": "False", "dns.qry.name": "download.windowsupdate.com", "dns.qry.type": "1" } }, { "event_id": "evt-bbcec4b68d384e82a1599b3a", "kind": "dns", "frame_number": 5043, "timestamp_epoch": "1641572058.223585000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": 53, "dst_port": 57383, "tcp_stream": null, "udp_stream": 55, "fields": { "dns.a": "23.38.189.225,23.38.189.201", "dns.cname": "wu-shim.trafficmanager.net,download.windowsupdate.com.edgesuite.net,a767.dspw65.akamai.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "download.windowsupdate.com", "dns.qry.type": "1" } }, { "event_id": "evt-9505af3d8ef2a07d2df39ffb", "kind": "dns", "frame_number": 5083, "timestamp_epoch": "1641572058.338024000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": 56598, "dst_port": 53, "tcp_stream": null, "udp_stream": 56, "fields": { "dns.flags.response": "False", "dns.qry.name": "v10.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-f2c1013f67538cebef9677f2", "kind": "dns", "frame_number": 5084, "timestamp_epoch": "1641572058.364212000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": 53, "dst_port": 56598, "tcp_stream": null, "udp_stream": 56, "fields": { "dns.a": "52.178.17.2", "dns.cname": "global.asimov.events.data.trafficmanager.net,onedscolprdweu02.westeurope.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "v10.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-71722d819a5de0630277ccc4", "kind": "dns", "frame_number": 5148, "timestamp_epoch": "1641572059.380280000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": 51593, "dst_port": 53, "tcp_stream": null, "udp_stream": 57, "fields": { "dns.flags.response": "False", "dns.qry.name": "fe3cr.delivery.mp.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-eca2c97b981788bb8059ede6", "kind": "dns", "frame_number": 5149, "timestamp_epoch": "1641572059.425017000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": 53, "dst_port": 51593, "tcp_stream": null, "udp_stream": 57, "fields": { "dns.a": "20.54.89.15", "dns.cname": "fe3.delivery.mp.microsoft.com,glb.cws.prod.dcat.dsp.trafficmanager.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "fe3cr.delivery.mp.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-b2bd19fe849665f0536dda06", "kind": "dns", "frame_number": 5235, "timestamp_epoch": "1641572061.667800000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": 63706, "dst_port": 53, "tcp_stream": null, "udp_stream": 58, "fields": { "dns.flags.response": "False", "dns.qry.name": "geo.prod.do.dsp.mp.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-f7a641c5043d13986c9ba88b", "kind": "dns", "frame_number": 5236, "timestamp_epoch": "1641572061.710826000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": 53, "dst_port": 63706, "tcp_stream": null, "udp_stream": 58, "fields": { "dns.a": "52.179.216.235", "dns.cname": "geo.prod.do.dsp.trafficmanager.net,array502.prod.do.dsp.mp.microsoft.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "geo.prod.do.dsp.mp.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-7b93f51fef4260c252171c57", "kind": "dns", "frame_number": 5259, "timestamp_epoch": "1641572062.028713000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": 64283, "dst_port": 53, "tcp_stream": null, "udp_stream": 59, "fields": { "dns.flags.response": "False", "dns.qry.name": "kv801.prod.do.dsp.mp.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-2a73f03b9ac952b8a7b7c2f1", "kind": "dns", "frame_number": 5260, "timestamp_epoch": "1641572062.084821000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": 53, "dst_port": 64283, "tcp_stream": null, "udp_stream": 59, "fields": { "dns.a": "184.50.62.43", "dns.cname": "kv801.prod.do.dsp.mp.microsoft.com.edgekey.net,e12437.g.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "kv801.prod.do.dsp.mp.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-2be39c9bea2f246fe1615dbf", "kind": "dns", "frame_number": 5282, "timestamp_epoch": "1641572062.288601000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": 53485, "dst_port": 53, "tcp_stream": null, "udp_stream": 60, "fields": { "dns.flags.response": "False", "dns.qry.name": "cp801.prod.do.dsp.mp.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-04e1fec6267b7aeecd3b6fd6", "kind": "dns", "frame_number": 5283, "timestamp_epoch": "1641572062.288922000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": 53, "dst_port": 53485, "tcp_stream": null, "udp_stream": 60, "fields": { "dns.a": "184.50.62.43", "dns.cname": "cp801.prod.do.dsp.mp.microsoft.com.edgekey.net,e12437.g.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "cp801.prod.do.dsp.mp.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-075c06ac87bd2536b3a171ab", "kind": "dns", "frame_number": 5302, "timestamp_epoch": "1641572062.424316000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": 52801, "dst_port": 53, "tcp_stream": null, "udp_stream": 61, "fields": { "dns.flags.response": "False", "dns.qry.name": "au.download.windowsupdate.com", "dns.qry.type": "1" } }, { "event_id": "evt-c533ce546f25f089c3f063a8", "kind": "dns", "frame_number": 5303, "timestamp_epoch": "1641572062.424599000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": 53, "dst_port": 52801, "tcp_stream": null, "udp_stream": 61, "fields": { "dns.a": "23.38.189.201,23.38.189.225", "dns.cname": "wu-shim.trafficmanager.net,download.windowsupdate.com.edgesuite.net,a767.dspw65.akamai.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "au.download.windowsupdate.com", "dns.qry.type": "1" } }, { "event_id": "evt-4cedc3165158ddb0b4228de8", "kind": "dns", "frame_number": 5638, "timestamp_epoch": "1641572062.804566000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": 53041, "dst_port": 53, "tcp_stream": null, "udp_stream": 62, "fields": { "dns.flags.response": "False", "dns.qry.name": "v10.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-538d35354a1ac66128f3615c", "kind": "dns", "frame_number": 5639, "timestamp_epoch": "1641572062.833150000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": 53, "dst_port": 53041, "tcp_stream": null, "udp_stream": 62, "fields": { "dns.a": "52.178.17.2", "dns.cname": "global.asimov.events.data.trafficmanager.net,onedscolprdweu02.westeurope.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "v10.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-6495ba4114186ab0b356c122", "kind": "dns", "frame_number": 5716, "timestamp_epoch": "1641572072.032616000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": 50116, "dst_port": 53, "tcp_stream": null, "udp_stream": 64, "fields": { "dns.flags.response": "False", "dns.qry.name": "v10.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-920a78eca3a725deb8ff6615", "kind": "dns", "frame_number": 5717, "timestamp_epoch": "1641572072.033379000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": 53, "dst_port": 50116, "tcp_stream": null, "udp_stream": 64, "fields": { "dns.a": "52.178.17.2", "dns.cname": "global.asimov.events.data.trafficmanager.net,onedscolprdweu02.westeurope.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "v10.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-85ccb7609c9a3296a7b9aff1", "kind": "dns", "frame_number": 5774, "timestamp_epoch": "1641572117.846671000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": 64194, "dst_port": 53, "tcp_stream": null, "udp_stream": 65, "fields": { "dns.flags.response": "False", "dns.qry.name": "ctldl.windowsupdate.com", "dns.qry.type": "1" } }, { "event_id": "evt-78ec1386852a858c6c62918f", "kind": "dns", "frame_number": 5775, "timestamp_epoch": "1641572117.890524000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": 53, "dst_port": 64194, "tcp_stream": null, "udp_stream": 65, "fields": { "dns.a": "8.253.189.126,67.27.123.126,8.249.7.254,8.240.136.254,8.249.3.254", "dns.cname": "wu-shim.trafficmanager.net,fg.download.windowsupdate.com.c.footprint.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "ctldl.windowsupdate.com", "dns.qry.type": "1" } }, { "event_id": "evt-a0bb9245c6767f4dbaf73e69", "kind": "dns", "frame_number": 5783, "timestamp_epoch": "1641572125.772644000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": 54574, "dst_port": 53, "tcp_stream": null, "udp_stream": 66, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.spoonwatch.net", "dns.qry.type": "1" } }, { "event_id": "evt-b4ec17864329b99c879ca03b", "kind": "dns", "frame_number": 5784, "timestamp_epoch": "1641572125.773037000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": 53, "dst_port": 54574, "tcp_stream": null, "udp_stream": 66, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.spoonwatch.net", "dns.qry.type": "1" } }, { "event_id": "evt-f8a858d5ee6d9c3b1c3106b4", "kind": "dns", "frame_number": 5785, "timestamp_epoch": "1641572125.773568000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": 63979, "dst_port": 53, "tcp_stream": null, "udp_stream": 67, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.localdomain", "dns.qry.type": "1" } }, { "event_id": "evt-e3be1a72e5277b7d3eb3d1cf", "kind": "dns", "frame_number": 5786, "timestamp_epoch": "1641572125.810645000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": 53, "dst_port": 63979, "tcp_stream": null, "udp_stream": 67, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.localdomain", "dns.qry.type": "1" } }, { "event_id": "evt-17c1f226d0a992a11e94c4e9", "kind": "dns", "frame_number": 5820, "timestamp_epoch": "1641572170.859000000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": 61904, "dst_port": 53, "tcp_stream": null, "udp_stream": 69, "fields": { "dns.flags.response": "False", "dns.qry.name": "www.bing.com", "dns.qry.type": "1" } }, { "event_id": "evt-ea3a2fbcc4d5a8e1def0e23d", "kind": "dns", "frame_number": 5821, "timestamp_epoch": "1641572170.913852000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": 53, "dst_port": 61904, "tcp_stream": null, "udp_stream": 69, "fields": { "dns.a": "204.79.197.200,13.107.21.200", "dns.cname": "a-0001.a-afdentry.net.trafficmanager.net,www-bing-com.dual-a-0001.a-msedge.net,dual-a-0001.a-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "www.bing.com", "dns.qry.type": "1" } } ], "http_request": [ { "event_id": "evt-7ee130da3abe57ef07a92959", "kind": "http_request", "frame_number": 1501, "timestamp_epoch": "1641571652.212441000", "src_ip": "192.168.1.216", "dst_ip": "2.56.57.108", "src_port": 49738, "dst_port": 80, "tcp_stream": 65, "udp_stream": null, "fields": { "http.content_length": "25", "http.host": "2.56.57.108", "http.request.full_uri": "http://2.56.57.108/osk//6.jpg", "http.request.method": "POST", "http.request.uri": "/osk//6.jpg", "http.response_in": "1639" } }, { "event_id": "evt-0cfdeae07f665ba79beaf54e", "kind": "http_request", "frame_number": 1641, "timestamp_epoch": "1641571652.751829000", "src_ip": "192.168.1.216", "dst_ip": "2.56.57.108", "src_port": 49738, "dst_port": 80, "tcp_stream": 65, "udp_stream": null, "fields": { "http.content_length": "25", "http.host": "2.56.57.108", "http.request.full_uri": "http://2.56.57.108/osk//1.jpg", "http.request.method": "POST", "http.request.uri": "/osk//1.jpg", "http.response_in": "2223" } }, { "event_id": "evt-b1762af2f462b84542ff5a8a", "kind": "http_request", "frame_number": 2225, "timestamp_epoch": "1641571653.452444000", "src_ip": "192.168.1.216", "dst_ip": "2.56.57.108", "src_port": 49738, "dst_port": 80, "tcp_stream": 65, "udp_stream": null, "fields": { "http.content_length": "25", "http.host": "2.56.57.108", "http.request.full_uri": "http://2.56.57.108/osk//2.jpg", "http.request.method": "POST", "http.request.uri": "/osk//2.jpg", "http.response_in": "2539" } }, { "event_id": "evt-2beb590f1393bca0e76a9b1d", "kind": "http_request", "frame_number": 2541, "timestamp_epoch": "1641571653.743431000", "src_ip": "192.168.1.216", "dst_ip": "2.56.57.108", "src_port": 49738, "dst_port": 80, "tcp_stream": 65, "udp_stream": null, "fields": { "http.content_length": "25", "http.host": "2.56.57.108", "http.request.full_uri": "http://2.56.57.108/osk//3.jpg", "http.request.method": "POST", "http.request.uri": "/osk//3.jpg", "http.response_in": "2689" } }, { "event_id": "evt-ae3ed8e0e93b47a4e154ba96", "kind": "http_request", "frame_number": 2691, "timestamp_epoch": "1641571653.942407000", "src_ip": "192.168.1.216", "dst_ip": "2.56.57.108", "src_port": 49738, "dst_port": 80, "tcp_stream": 65, "udp_stream": null, "fields": { "http.content_length": "25", "http.host": "2.56.57.108", "http.request.full_uri": "http://2.56.57.108/osk//4.jpg", "http.request.method": "POST", "http.request.uri": "/osk//4.jpg", "http.response_in": "3052" } }, { "event_id": "evt-c7cb523bd2b902e896a6a7bd", "kind": "http_request", "frame_number": 3054, "timestamp_epoch": "1641571654.219054000", "src_ip": "192.168.1.216", "dst_ip": "2.56.57.108", "src_port": 49738, "dst_port": 80, "tcp_stream": 65, "udp_stream": null, "fields": { "http.content_length": "25", "http.host": "2.56.57.108", "http.request.full_uri": "http://2.56.57.108/osk//5.jpg", "http.request.method": "POST", "http.request.uri": "/osk//5.jpg", "http.response_in": "4192" } }, { "event_id": "evt-5c1887143bf26405d21e20d2", "kind": "http_request", "frame_number": 4194, "timestamp_epoch": "1641571654.755050000", "src_ip": "192.168.1.216", "dst_ip": "2.56.57.108", "src_port": 49738, "dst_port": 80, "tcp_stream": 65, "udp_stream": null, "fields": { "http.content_length": "25", "http.host": "2.56.57.108", "http.request.full_uri": "http://2.56.57.108/osk//7.jpg", "http.request.method": "POST", "http.request.uri": "/osk//7.jpg", "http.response_in": "4273" } }, { "event_id": "evt-83f22d67c4b294066380887d", "kind": "http_request", "frame_number": 4275, "timestamp_epoch": "1641571655.625187000", "src_ip": "192.168.1.216", "dst_ip": "2.56.57.108", "src_port": 49738, "dst_port": 80, "tcp_stream": 65, "udp_stream": null, "fields": { "http.content_length": "25", "http.host": "2.56.57.108", "http.request.full_uri": "http://2.56.57.108/osk//main.php", "http.request.method": "POST", "http.request.uri": "/osk//main.php", "http.response_in": "4277" } }, { "event_id": "evt-4c19953569623cb275e20aed", "kind": "http_request", "frame_number": 4816, "timestamp_epoch": "1641571656.376674000", "src_ip": "192.168.1.216", "dst_ip": "2.56.57.108", "src_port": 49738, "dst_port": 80, "tcp_stream": 65, "udp_stream": null, "fields": { "http.content_length": "379629", "http.host": "2.56.57.108", "http.request.full_uri": "http://2.56.57.108/osk/", "http.request.method": "POST", "http.request.uri": "/osk/", "http.response_in": "4830" } }, { "event_id": "evt-f63d004cb6145121967f1d6a", "kind": "http_request", "frame_number": 5047, "timestamp_epoch": "1641572058.247368000", "src_ip": "192.168.1.216", "dst_ip": "23.38.189.225", "src_port": 49742, "dst_port": 80, "tcp_stream": 69, "udp_stream": null, "fields": { "http.host": "download.windowsupdate.com", "http.request.full_uri": "http://download.windowsupdate.com/c/msdownload/update/others/2022/01/35969516_5bcaf676a3e98426394e538836033ea5ce2bb8c3.cab", "http.request.method": "GET", "http.request.uri": "/c/msdownload/update/others/2022/01/35969516_5bcaf676a3e98426394e538836033ea5ce2bb8c3.cab", "http.response_in": "5055", "http.user_agent": "Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.32" } }, { "event_id": "evt-ee95fd102a3b73d0d2bddd9c", "kind": "http_request", "frame_number": 5058, "timestamp_epoch": "1641572058.269626000", "src_ip": "192.168.1.216", "dst_ip": "23.38.189.225", "src_port": 49742, "dst_port": 80, "tcp_stream": 69, "udp_stream": null, "fields": { "http.host": "download.windowsupdate.com", "http.request.full_uri": "http://download.windowsupdate.com/c/msdownload/update/others/2022/01/35969515_2975e5b79f9857b7a2d7aa07e0d43359735c8e80.cab", "http.request.method": "GET", "http.request.uri": "/c/msdownload/update/others/2022/01/35969515_2975e5b79f9857b7a2d7aa07e0d43359735c8e80.cab", "http.response_in": "5067", "http.user_agent": "Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.32" } }, { "event_id": "evt-b98af3fae1e4e79022a2ced0", "kind": "http_request", "frame_number": 5069, "timestamp_epoch": "1641572058.294727000", "src_ip": "192.168.1.216", "dst_ip": "23.38.189.225", "src_port": 49742, "dst_port": 80, "tcp_stream": 69, "udp_stream": null, "fields": { "http.host": "download.windowsupdate.com", "http.request.full_uri": "http://download.windowsupdate.com/c/msdownload/update/others/2022/01/35969632_c422aaaf8becdd90e50fb6936708c77c7f97631f.cab", "http.request.method": "GET", "http.request.uri": "/c/msdownload/update/others/2022/01/35969632_c422aaaf8becdd90e50fb6936708c77c7f97631f.cab", "http.response_in": "5081", "http.user_agent": "Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.32" } }, { "event_id": "evt-04a6404b8aa1bb302956e8c3", "kind": "http_request", "frame_number": 5309, "timestamp_epoch": "1641572062.462443000", "src_ip": "192.168.1.216", "dst_ip": "23.38.189.225", "src_port": 49749, "dst_port": 80, "tcp_stream": 76, "udp_stream": null, "fields": { "http.content_length": "0", "http.host": "au.download.windowsupdate.com", "http.request.full_uri": "http://au.download.windowsupdate.com/c/msdownload/update/software/defu/2022/01/am_delta_patch_1.355.1569.0_f5fe52e10a18f6ce4bc39541e4aae4a97c270c81.exe", "http.request.method": "GET", "http.request.uri": "/c/msdownload/update/software/defu/2022/01/am_delta_patch_1.355.1569.0_f5fe52e10a18f6ce4bc39541e4aae4a97c270c81.exe", "http.response_in": "5315", "http.user_agent": "Microsoft-Delivery-Optimization/10.0" } }, { "event_id": "evt-bdb30357e7c5816cf2c369d9", "kind": "http_request", "frame_number": 5313, "timestamp_epoch": "1641572062.465939000", "src_ip": "192.168.1.216", "dst_ip": "23.38.189.201", "src_port": 49750, "dst_port": 80, "tcp_stream": 77, "udp_stream": null, "fields": { "http.content_length": "0", "http.host": "au.download.windowsupdate.com", "http.request.full_uri": "http://au.download.windowsupdate.com/c/msdownload/update/software/defu/2022/01/am_delta_patch_1.355.1569.0_f5fe52e10a18f6ce4bc39541e4aae4a97c270c81.exe", "http.request.method": "GET", "http.request.uri": "/c/msdownload/update/software/defu/2022/01/am_delta_patch_1.355.1569.0_f5fe52e10a18f6ce4bc39541e4aae4a97c270c81.exe", "http.response_in": "5316", "http.user_agent": "Microsoft-Delivery-Optimization/10.0" } }, { "event_id": "evt-b776d74fc24a4b47cc1d6890", "kind": "http_request", "frame_number": 5317, "timestamp_epoch": "1641572062.491933000", "src_ip": "192.168.1.216", "dst_ip": "23.38.189.225", "src_port": 49749, "dst_port": 80, "tcp_stream": 76, "udp_stream": null, "fields": { "http.content_length": "0", "http.host": "au.download.windowsupdate.com", "http.request.full_uri": "http://au.download.windowsupdate.com/c/msdownload/update/software/defu/2022/01/am_delta_patch_1.355.1569.0_f5fe52e10a18f6ce4bc39541e4aae4a97c270c81.exe", "http.request.method": "GET", "http.request.uri": "/c/msdownload/update/software/defu/2022/01/am_delta_patch_1.355.1569.0_f5fe52e10a18f6ce4bc39541e4aae4a97c270c81.exe", "http.response_in": "5636", "http.user_agent": "Microsoft-Delivery-Optimization/10.0" } }, { "event_id": "evt-f808a2f3916eb489633c80d7", "kind": "http_request", "frame_number": 5688, "timestamp_epoch": "1641572065.601007000", "src_ip": "192.168.1.216", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*" } }, { "event_id": "evt-88e55e204e301acf3db353b6", "kind": "http_request", "frame_number": 5689, "timestamp_epoch": "1641572065.608030000", "src_ip": "192.168.1.216", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*" } }, { "event_id": "evt-14b68571684d5b1c40e3040f", "kind": "http_request", "frame_number": 5690, "timestamp_epoch": "1641572065.814742000", "src_ip": "192.168.1.216", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*" } }, { "event_id": "evt-34e0b7b55f35b91d7964ea6c", "kind": "http_request", "frame_number": 5691, "timestamp_epoch": "1641572068.596452000", "src_ip": "192.168.1.216", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*" } }, { "event_id": "evt-1c709846eff85782918a0de2", "kind": "http_request", "frame_number": 5692, "timestamp_epoch": "1641572068.596676000", "src_ip": "192.168.1.216", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*" } }, { "event_id": "evt-f982efe584cffdd855dbf1e7", "kind": "http_request", "frame_number": 5693, "timestamp_epoch": "1641572068.830367000", "src_ip": "192.168.1.216", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*" } }, { "event_id": "evt-46e41e3282f6ae1186fcf597", "kind": "http_request", "frame_number": 5714, "timestamp_epoch": "1641572071.597689000", "src_ip": "192.168.1.216", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*" } }, { "event_id": "evt-abf2548076961598a47040fa", "kind": "http_request", "frame_number": 5715, "timestamp_epoch": "1641572071.597874000", "src_ip": "192.168.1.216", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*" } }, { "event_id": "evt-a948f178b6ecc12366cb56ce", "kind": "http_request", "frame_number": 5779, "timestamp_epoch": "1641572117.914696000", "src_ip": "192.168.1.216", "dst_ip": "8.253.189.126", "src_port": 49760, "dst_port": 80, "tcp_stream": 83, "udp_stream": null, "fields": { "http.host": "ctldl.windowsupdate.com", "http.request.full_uri": "http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?f622d06ddf57408d", "http.request.method": "GET", "http.request.uri": "/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?f622d06ddf57408d", "http.response_in": "5781", "http.user_agent": "Microsoft-CryptoAPI/10.0" } } ], "http_response": [ { "event_id": "evt-308b6fcb34ec34c72cace0a3", "kind": "http_response", "frame_number": 1639, "timestamp_epoch": "1641571652.748901000", "src_ip": "2.56.57.108", "dst_ip": "192.168.1.216", "src_port": 80, "dst_port": 49738, "tcp_stream": 65, "udp_stream": null, "fields": { "http.content_length": "144848", "http.content_type": "image/jpeg", "http.request_in": "1501", "http.response.code": "200" } }, { "event_id": "evt-1608666cbb35a11ee3218ce0", "kind": "http_response", "frame_number": 2223, "timestamp_epoch": "1641571653.449077000", "src_ip": "2.56.57.108", "dst_ip": "192.168.1.216", "src_port": 80, "dst_port": 49738, "tcp_stream": 65, "udp_stream": null, "fields": { "http.content_length": "645592", "http.content_type": "image/jpeg", "http.request_in": "1641", "http.response.code": "200" } }, { "event_id": "evt-f25bed9e0673988b0c799881", "kind": "http_response", "frame_number": 2539, "timestamp_epoch": "1641571653.741660000", "src_ip": "2.56.57.108", "dst_ip": "192.168.1.216", "src_port": 80, "dst_port": 49738, "tcp_stream": 65, "udp_stream": null, "fields": { "http.content_length": "334288", "http.content_type": "image/jpeg", "http.request_in": "2225", "http.response.code": "200" } }, { "event_id": "evt-c64e80202c9fac82b2232f43", "kind": "http_response", "frame_number": 2689, "timestamp_epoch": "1641571653.939775000", "src_ip": "2.56.57.108", "dst_ip": "192.168.1.216", "src_port": 80, "dst_port": 49738, "tcp_stream": 65, "udp_stream": null, "fields": { "http.content_length": "137168", "http.content_type": "image/jpeg", "http.request_in": "2541", "http.response.code": "200" } }, { "event_id": "evt-d7412e3a288aa29a7360a362", "kind": "http_response", "frame_number": 3052, "timestamp_epoch": "1641571654.216481000", "src_ip": "2.56.57.108", "dst_ip": "192.168.1.216", "src_port": 80, "dst_port": 49738, "tcp_stream": 65, "udp_stream": null, "fields": { "http.content_length": "440120", "http.content_type": "image/jpeg", "http.request_in": "2691", "http.response.code": "200" } }, { "event_id": "evt-5a67fe5b5dea1ae19af4cac8", "kind": "http_response", "frame_number": 4192, "timestamp_epoch": "1641571654.753128000", "src_ip": "2.56.57.108", "dst_ip": "192.168.1.216", "src_port": 80, "dst_port": 49738, "tcp_stream": 65, "udp_stream": null, "fields": { "http.content_length": "1246160", "http.content_type": "image/jpeg", "http.request_in": "3054", "http.response.code": "200" } }, { "event_id": "evt-4cc85492c53bd17e42841942", "kind": "http_response", "frame_number": 4273, "timestamp_epoch": "1641571654.905339000", "src_ip": "2.56.57.108", "dst_ip": "192.168.1.216", "src_port": 80, "dst_port": 49738, "tcp_stream": 65, "udp_stream": null, "fields": { "http.content_length": "83784", "http.content_type": "image/jpeg", "http.request_in": "4194", "http.response.code": "200" } }, { "event_id": "evt-7cbf0da831339f1fd0d860a0", "kind": "http_response", "frame_number": 4277, "timestamp_epoch": "1641571655.790541000", "src_ip": "2.56.57.108", "dst_ip": "192.168.1.216", "src_port": 80, "dst_port": 49738, "tcp_stream": 65, "udp_stream": null, "fields": { "http.content_length": "0", "http.content_type": "text/html", "http.request_in": "4275", "http.response.code": "200" } }, { "event_id": "evt-96c06ea1241514b2fd1912f8", "kind": "http_response", "frame_number": 4830, "timestamp_epoch": "1641571656.867875000", "src_ip": "2.56.57.108", "dst_ip": "192.168.1.216", "src_port": 80, "dst_port": 49738, "tcp_stream": 65, "udp_stream": null, "fields": { "http.content_length": "0", "http.content_type": "text/html", "http.request_in": "4816", "http.response.code": "200" } }, { "event_id": "evt-b5f31d1155239cebdd800a54", "kind": "http_response", "frame_number": 5055, "timestamp_epoch": "1641572058.268891000", "src_ip": "23.38.189.225", "dst_ip": "192.168.1.216", "src_port": 80, "dst_port": 49742, "tcp_stream": 69, "udp_stream": null, "fields": { "http.content_length": "7317", "http.content_type": "application/vnd.ms-cab-compressed", "http.request_in": "5047", "http.response.code": "200" } }, { "event_id": "evt-b795e0d9f31c740a7d40350c", "kind": "http_response", "frame_number": 5067, "timestamp_epoch": "1641572058.294012000", "src_ip": "23.38.189.225", "dst_ip": "192.168.1.216", "src_port": 80, "dst_port": 49742, "tcp_stream": 69, "udp_stream": null, "fields": { "http.content_length": "7313", "http.content_type": "application/vnd.ms-cab-compressed", "http.request_in": "5058", "http.response.code": "200" } }, { "event_id": "evt-28c8e87cfd96bc4a1351785b", "kind": "http_response", "frame_number": 5081, "timestamp_epoch": "1641572058.319263000", "src_ip": "23.38.189.225", "dst_ip": "192.168.1.216", "src_port": 80, "dst_port": 49742, "tcp_stream": 69, "udp_stream": null, "fields": { "http.content_length": "10885", "http.content_type": "application/vnd.ms-cab-compressed", "http.request_in": "5069", "http.response.code": "200" } }, { "event_id": "evt-17666ee9f4228f1fe7b12efd", "kind": "http_response", "frame_number": 5315, "timestamp_epoch": "1641572062.488577000", "src_ip": "23.38.189.225", "dst_ip": "192.168.1.216", "src_port": 80, "dst_port": 49749, "tcp_stream": 76, "udp_stream": null, "fields": { "http.content_length": "2", "http.content_type": "application/octet-stream", "http.request_in": "5309", "http.response.code": "206" } }, { "event_id": "evt-2eb52d51a882ddccd49031ac", "kind": "http_response", "frame_number": 5316, "timestamp_epoch": "1641572062.488580000", "src_ip": "23.38.189.201", "dst_ip": "192.168.1.216", "src_port": 80, "dst_port": 49750, "tcp_stream": 77, "udp_stream": null, "fields": { "http.content_length": "2", "http.content_type": "application/octet-stream", "http.request_in": "5313", "http.response.code": "206" } }, { "event_id": "evt-14c931269790badbb44d85f0", "kind": "http_response", "frame_number": 5636, "timestamp_epoch": "1641572062.587068000", "src_ip": "23.38.189.225", "dst_ip": "192.168.1.216", "src_port": 80, "dst_port": 49749, "tcp_stream": 76, "udp_stream": null, "fields": { "http.content_length": "307632", "http.content_type": "application/octet-stream", "http.request_in": "5317", "http.response.code": "206" } }, { "event_id": "evt-35e0921f52f1fa8c66f15126", "kind": "http_response", "frame_number": 5781, "timestamp_epoch": "1641572117.945341000", "src_ip": "8.253.189.126", "dst_ip": "192.168.1.216", "src_port": 80, "dst_port": 49760, "tcp_stream": 83, "udp_stream": null, "fields": { "http.request_in": "5779", "http.response.code": "304" } } ], "tls_client_hello": [ { "event_id": "evt-023a1c4ed20e38285c683d3b", "kind": "tls_client_hello", "frame_number": 770, "timestamp_epoch": "1641571461.775438000", "src_ip": "192.168.1.216", "dst_ip": "52.168.112.67", "src_port": 49711, "dst_port": 443, "tcp_stream": 38, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "self.events.data.microsoft.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-492e6fc5a2ee57ad9d4a4156", "kind": "tls_client_hello", "frame_number": 1042, "timestamp_epoch": "1641571493.262910000", "src_ip": "192.168.1.216", "dst_ip": "20.50.80.210", "src_port": 49724, "dst_port": 443, "tcp_stream": 51, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "v20.events.data.microsoft.com", "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4" } }, { "event_id": "evt-dfc82c1b9f0e63b7d7dbe8b1", "kind": "tls_client_hello", "frame_number": 1066, "timestamp_epoch": "1641571494.191063000", "src_ip": "192.168.1.216", "dst_ip": "204.79.197.203", "src_port": 49725, "dst_port": 443, "tcp_stream": 52, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "api.msn.com", "tls.handshake.ja3": "37f463bf4616ecd445d4a1937da06e19" } }, { "event_id": "evt-53e3776d9f5deb769863918c", "kind": "tls_client_hello", "frame_number": 1090, "timestamp_epoch": "1641571496.575343000", "src_ip": "192.168.1.216", "dst_ip": "204.79.197.200", "src_port": 49726, "dst_port": 443, "tcp_stream": 53, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "www.bing.com", "tls.handshake.ja3": "6271f898ce5be7dd52b0fc260d0662b3" } }, { "event_id": "evt-008abbbf5c3f609ea9649ca0", "kind": "tls_client_hello", "frame_number": 1148, "timestamp_epoch": "1641571508.868078000", "src_ip": "192.168.1.216", "dst_ip": "52.183.220.149", "src_port": 49727, "dst_port": 443, "tcp_stream": 54, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "settings-win.data.microsoft.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-26f9708c276b9880a96785b9", "kind": "tls_client_hello", "frame_number": 1165, "timestamp_epoch": "1641571509.072635000", "src_ip": "192.168.1.216", "dst_ip": "52.183.220.149", "src_port": 49728, "dst_port": 443, "tcp_stream": 55, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "settings-win.data.microsoft.com", "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4" } }, { "event_id": "evt-4f15b8b0da924b8437ba5e2a", "kind": "tls_client_hello", "frame_number": 1189, "timestamp_epoch": "1641571509.881795000", "src_ip": "192.168.1.216", "dst_ip": "52.183.220.149", "src_port": 49729, "dst_port": 443, "tcp_stream": 56, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "settings-win.data.microsoft.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-f77fa424b980386f95cc9075", "kind": "tls_client_hello", "frame_number": 1232, "timestamp_epoch": "1641571549.090667000", "src_ip": "192.168.1.216", "dst_ip": "204.79.197.200", "src_port": 49730, "dst_port": 443, "tcp_stream": 57, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "www.bing.com", "tls.handshake.ja3": "6271f898ce5be7dd52b0fc260d0662b3" } }, { "event_id": "evt-fba636c5310e278d7bbe579d", "kind": "tls_client_hello", "frame_number": 1356, "timestamp_epoch": "1641571594.718926000", "src_ip": "192.168.1.216", "dst_ip": "20.189.173.1", "src_port": 49735, "dst_port": 443, "tcp_stream": 62, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "v10.events.data.microsoft.com", "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4" } }, { "event_id": "evt-54529ae1064a5a10d25f18ca", "kind": "tls_client_hello", "frame_number": 1435, "timestamp_epoch": "1641571629.829871000", "src_ip": "192.168.1.216", "dst_ip": "40.83.240.146", "src_port": 49736, "dst_port": 443, "tcp_stream": 63, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "client.wns.windows.com", "tls.handshake.ja3": "3b5074b1b5d032e5620f69f9f700ff0e" } }, { "event_id": "evt-d8801fef51ecb1e309c87329", "kind": "tls_client_hello", "frame_number": 1447, "timestamp_epoch": "1641571629.959009000", "src_ip": "192.168.1.216", "dst_ip": "104.212.67.47", "src_port": 49737, "dst_port": 443, "tcp_stream": 64, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "pti.store.microsoft.com", "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4" } }, { "event_id": "evt-93bc5bf29242e12c9455e8ae", "kind": "tls_client_hello", "frame_number": 4851, "timestamp_epoch": "1641571782.361469000", "src_ip": "192.168.1.216", "dst_ip": "52.168.112.67", "src_port": 49739, "dst_port": 443, "tcp_stream": 66, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "self.events.data.microsoft.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-2d6a4ca30db3503cae1025e3", "kind": "tls_client_hello", "frame_number": 4913, "timestamp_epoch": "1641572052.001142000", "src_ip": "192.168.1.216", "dst_ip": "52.183.220.149", "src_port": 49740, "dst_port": 443, "tcp_stream": 67, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "settings-win.data.microsoft.com", "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4" } }, { "event_id": "evt-a394f21397b00960669e0899", "kind": "tls_client_hello", "frame_number": 4941, "timestamp_epoch": "1641572057.634152000", "src_ip": "192.168.1.216", "dst_ip": "52.249.36.204", "src_port": 49741, "dst_port": 443, "tcp_stream": 68, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "fe2cr.update.microsoft.com", "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4" } }, { "event_id": "evt-00f8741247a09acc873c892e", "kind": "tls_client_hello", "frame_number": 5112, "timestamp_epoch": "1641572058.513465000", "src_ip": "192.168.1.216", "dst_ip": "52.178.17.2", "src_port": 49743, "dst_port": 443, "tcp_stream": 70, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "v10.events.data.microsoft.com", "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4" } }, { "event_id": "evt-bfbd2239d6831932fdf5c54f", "kind": "tls_client_hello", "frame_number": 5153, "timestamp_epoch": "1641572059.551713000", "src_ip": "192.168.1.216", "dst_ip": "20.54.89.15", "src_port": 49744, "dst_port": 443, "tcp_stream": 71, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "fe3cr.delivery.mp.microsoft.com", "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4" } }, { "event_id": "evt-425445da891bf3d91d89f94f", "kind": "tls_client_hello", "frame_number": 5182, "timestamp_epoch": "1641572060.594492000", "src_ip": "192.168.1.216", "dst_ip": "52.178.17.2", "src_port": 49745, "dst_port": 443, "tcp_stream": 72, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "v10.events.data.microsoft.com", "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4" } }, { "event_id": "evt-f8626f84b9d823a74cff5274", "kind": "tls_client_hello", "frame_number": 5240, "timestamp_epoch": "1641572061.764439000", "src_ip": "192.168.1.216", "dst_ip": "52.179.216.235", "src_port": 49746, "dst_port": 443, "tcp_stream": 73, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "geo.prod.do.dsp.mp.microsoft.com", "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4" } }, { "event_id": "evt-1be5dc345a828c982a4e8c5c", "kind": "tls_client_hello", "frame_number": 5266, "timestamp_epoch": "1641572062.119414000", "src_ip": "192.168.1.216", "dst_ip": "184.50.62.43", "src_port": 49747, "dst_port": 443, "tcp_stream": 74, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "kv801.prod.do.dsp.mp.microsoft.com", "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4" } }, { "event_id": "evt-33d745d3f1c9c535c5bd89d0", "kind": "tls_client_hello", "frame_number": 5287, "timestamp_epoch": "1641572062.313505000", "src_ip": "192.168.1.216", "dst_ip": "184.50.62.43", "src_port": 49748, "dst_port": 443, "tcp_stream": 75, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "cp801.prod.do.dsp.mp.microsoft.com", "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4" } }, { "event_id": "evt-c96179768e685ce8b36435fe", "kind": "tls_client_hello", "frame_number": 5643, "timestamp_epoch": "1641572062.974471000", "src_ip": "192.168.1.216", "dst_ip": "52.178.17.2", "src_port": 49751, "dst_port": 443, "tcp_stream": 78, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "v10.events.data.microsoft.com", "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4" } }, { "event_id": "evt-f7fb567f553968feb0f1901c", "kind": "tls_client_hello", "frame_number": 5666, "timestamp_epoch": "1641572064.091820000", "src_ip": "192.168.1.216", "dst_ip": "52.178.17.2", "src_port": 49752, "dst_port": 443, "tcp_stream": 79, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "v10.events.data.microsoft.com", "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4" } }, { "event_id": "evt-f436c59af5ffadaa34adb62c", "kind": "tls_client_hello", "frame_number": 5721, "timestamp_epoch": "1641572072.174376000", "src_ip": "192.168.1.216", "dst_ip": "52.178.17.2", "src_port": 49759, "dst_port": 443, "tcp_stream": 82, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "v10.events.data.microsoft.com", "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4" } }, { "event_id": "evt-75facd3b76cc55718c81e3dd", "kind": "tls_client_hello", "frame_number": 5825, "timestamp_epoch": "1641572170.943202000", "src_ip": "192.168.1.216", "dst_ip": "204.79.197.200", "src_port": 49762, "dst_port": 443, "tcp_stream": 85, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "www.bing.com", "tls.handshake.ja3": "6271f898ce5be7dd52b0fc260d0662b3" } } ], "dhcp": [ { "event_id": "evt-74c27c0819b279dfb1fe9399", "kind": "dhcp", "frame_number": 1, "timestamp_epoch": "1641571449.195191000", "src_ip": "0.0.0.0", "dst_ip": "255.255.255.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 0, "fields": { "dhcp.hw.mac_addr": "9c:5c:8e:32:58:f9,9c:5c:8e:32:58:f9", "dhcp.ip.your": "0.0.0.0", "dhcp.option.dhcp": "3", "dhcp.option.hostname": "DESKTOP-GXMYNO2", "dhcp.option.requested_ip_address": "192.168.1.216", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-2225f36f1753913e35f5644b", "kind": "dhcp", "frame_number": 2, "timestamp_epoch": "1641571449.195531000", "src_ip": "192.168.1.1", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 1, "fields": { "dhcp.hw.mac_addr": "9c:5c:8e:32:58:f9", "dhcp.ip.your": "192.168.1.216", "dhcp.option.dhcp": "5", "eth.src": "1c:17:d3:f6:df:0a" } } ], "identity": [ { "event_id": "evt-978651a1e8a8a38692252c4b", "kind": "identity", "frame_number": 9, "timestamp_epoch": "1641571449.337155000", "src_ip": "192.168.1.216", "dst_ip": "224.0.0.251", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 2, "fields": { "dns.qry.name": "DESKTOP-GXMYNO2.local", "eth.dst": "01:00:5e:00:00:fb", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-75d5fff28078d878826a687e", "kind": "identity", "frame_number": 10, "timestamp_epoch": "1641571449.337975000", "src_ip": "192.168.1.216", "dst_ip": "224.0.0.251", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 2, "fields": { "eth.dst": "01:00:5e:00:00:fb", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-de7f2e7bc54d9e0183d26a57", "kind": "identity", "frame_number": 11, "timestamp_epoch": "1641571449.346570000", "src_ip": "192.168.1.216", "dst_ip": "224.0.0.252", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 3, "fields": { "dns.qry.name": "DESKTOP-GXMYNO2", "eth.dst": "01:00:5e:00:00:fc", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-2a2a4ba89ff1a9db86e3f4ef", "kind": "identity", "frame_number": 34, "timestamp_epoch": "1641571449.914575000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.1", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 9, "fields": { "eth.dst": "1c:17:d3:f6:df:0a", "eth.src": "9c:5c:8e:32:58:f9", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "SPOONWATCH<00>,SPOONWATCH<00> (Workstation/Redirector)", "nbns.nb_flags.group": "True" } }, { "event_id": "evt-1cdcab90130d6b79873c3d8f", "kind": "identity", "frame_number": 35, "timestamp_epoch": "1641571449.914853000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.1", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 9, "fields": { "eth.dst": "1c:17:d3:f6:df:0a", "eth.src": "9c:5c:8e:32:58:f9", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "DESKTOP-GXNYNO2<00>,DESKTOP-GXNYNO2<00> (Workstation/Redirector)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-1f17024cbf7851074c277ca0", "kind": "identity", "frame_number": 44, "timestamp_epoch": "1641571450.192488000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-d4d4a6d01fd61b2bc5efbdd7", "kind": "identity", "frame_number": 45, "timestamp_epoch": "1641571450.192648000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-624aec2f74c78927612559a3", "kind": "identity", "frame_number": 46, "timestamp_epoch": "1641571450.192978000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-55a04df5c1319c3518a11ac9", "kind": "identity", "frame_number": 51, "timestamp_epoch": "1641571450.508277000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.1", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 9, "fields": { "eth.dst": "1c:17:d3:f6:df:0a", "eth.src": "9c:5c:8e:32:58:f9", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "DESKTOP-GXNYNO2<20>,DESKTOP-GXNYNO2<20> (Server service)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-c4bd4b9ef5791280205831b5", "kind": "identity", "frame_number": 75, "timestamp_epoch": "1641571450.952502000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 2, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9", "kerberos.CNameString": "desktop-gxmyno2$", "kerberos.msg_type": "10" } }, { "event_id": "evt-16730dbb9a2655921f932add", "kind": "identity", "frame_number": 76, "timestamp_epoch": "1641571450.953033000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 2, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26", "kerberos.msg_type": "30" } }, { "event_id": "evt-8f46564e2bc1ed7e46cd4098", "kind": "identity", "frame_number": 108, "timestamp_epoch": "1641571450.966124000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 7, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9", "kerberos.CNameString": "desktop-gxmyno2$", "kerberos.msg_type": "10" } }, { "event_id": "evt-dc7eb36d99821a3b2ea5906c", "kind": "identity", "frame_number": 109, "timestamp_epoch": "1641571450.966608000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 7, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26", "kerberos.msg_type": "30" } }, { "event_id": "evt-bf7f45987c127e14b350ec7d", "kind": "identity", "frame_number": 126, "timestamp_epoch": "1641571450.978225000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 9, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9", "kerberos.CNameString": "desktop-gxmyno2$", "kerberos.msg_type": "10" } }, { "event_id": "evt-e75a33af8a6f80cdf4c7ae4d", "kind": "identity", "frame_number": 127, "timestamp_epoch": "1641571450.978271000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 8, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9", "kerberos.CNameString": "desktop-gxmyno2$", "kerberos.msg_type": "10" } }, { "event_id": "evt-811be9a9e3bcb009f1bb849a", "kind": "identity", "frame_number": 129, "timestamp_epoch": "1641571450.978973000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 8, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26", "kerberos.CNameString": "DESKTOP-GXMYNO2$", "kerberos.msg_type": "11" } }, { "event_id": "evt-73c57a8a34cc1ccee99a7e8b", "kind": "identity", "frame_number": 131, "timestamp_epoch": "1641571450.979011000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 9, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26", "kerberos.CNameString": "DESKTOP-GXMYNO2$", "kerberos.msg_type": "11" } }, { "event_id": "evt-630d0a2f83e9e87db9e0ee21", "kind": "identity", "frame_number": 147, "timestamp_epoch": "1641571450.983292000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 11, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9", "kerberos.CNameString": "desktop-gxmyno2$", "kerberos.msg_type": "10" } }, { "event_id": "evt-6d145ec5d8d00b5ca627d65d", "kind": "identity", "frame_number": 148, "timestamp_epoch": "1641571450.983819000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 11, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26", "kerberos.msg_type": "30" } }, { "event_id": "evt-3ec7058f19d295f72ca7e17e", "kind": "identity", "frame_number": 155, "timestamp_epoch": "1641571450.984540000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9", "kerberos.CNameString": "desktop-gxmyno2$", "kerberos.msg_type": "10" } }, { "event_id": "evt-08b133423416e59d4b72df9a", "kind": "identity", "frame_number": 157, "timestamp_epoch": "1641571450.985092000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26", "kerberos.CNameString": "DESKTOP-GXMYNO2$", "kerberos.msg_type": "11" } }, { "event_id": "evt-1e2d7eb4410fec003f827239", "kind": "identity", "frame_number": 169, "timestamp_epoch": "1641571450.986143000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 13, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9", "kerberos.msg_type": "12,14" } }, { "event_id": "evt-31c2ee07fb73dec3c372f49e", "kind": "identity", "frame_number": 172, "timestamp_epoch": "1641571450.986270000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 14, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9", "kerberos.msg_type": "12,14" } }, { "event_id": "evt-6c3a789e1d87b5a5dd31b566", "kind": "identity", "frame_number": 175, "timestamp_epoch": "1641571450.987159000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 13, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26", "kerberos.CNameString": "DESKTOP-GXMYNO2$", "kerberos.msg_type": "13" } }, { "event_id": "evt-480b1f3fbaa4418a69e8ff84", "kind": "identity", "frame_number": 177, "timestamp_epoch": "1641571450.987278000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 14, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26", "kerberos.CNameString": "DESKTOP-GXMYNO2$", "kerberos.msg_type": "13" } }, { "event_id": "evt-9158bdc949df1bfa88c2a2ca", "kind": "identity", "frame_number": 197, "timestamp_epoch": "1641571450.990891000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 16, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9", "kerberos.msg_type": "12,14" } }, { "event_id": "evt-f082c70731f93efff31d8e9b", "kind": "identity", "frame_number": 200, "timestamp_epoch": "1641571450.991397000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 16, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26", "kerberos.CNameString": "DESKTOP-GXMYNO2$", "kerberos.msg_type": "13" } }, { "event_id": "evt-32453e49447c34026dd1b480", "kind": "identity", "frame_number": 207, "timestamp_epoch": "1641571450.992133000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9", "kerberos.msg_type": "14" } }, { "event_id": "evt-90631cd5866c61df4d4c293f", "kind": "identity", "frame_number": 210, "timestamp_epoch": "1641571450.992655000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 15, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9", "kerberos.msg_type": "14" } }, { "event_id": "evt-e25e390caedac59a6dafa2c6", "kind": "identity", "frame_number": 212, "timestamp_epoch": "1641571450.993284000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26", "kerberos.msg_type": "15" } }, { "event_id": "evt-35a1d0a93b34d8019c151681", "kind": "identity", "frame_number": 213, "timestamp_epoch": "1641571450.993333000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 15, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26", "kerberos.msg_type": "15" } }, { "event_id": "evt-113571d096447a2ad58e6878", "kind": "identity", "frame_number": 214, "timestamp_epoch": "1641571450.993782000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-3a7c579d9a43da53600a9a85", "kind": "identity", "frame_number": 215, "timestamp_epoch": "1641571450.993982000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-f89da177248489973eca89a3", "kind": "identity", "frame_number": 216, "timestamp_epoch": "1641571450.994144000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-b384e5bbdd256cbae632bba6", "kind": "identity", "frame_number": 217, "timestamp_epoch": "1641571450.994291000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-d7a86e8b68ec02549d85d038", "kind": "identity", "frame_number": 225, "timestamp_epoch": "1641571451.000907000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 6, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9", "kerberos.msg_type": "14" } }, { "event_id": "evt-3eb101b05ae3bfc6b76dcad0", "kind": "identity", "frame_number": 228, "timestamp_epoch": "1641571451.001857000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 6, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26", "kerberos.msg_type": "15" } }, { "event_id": "evt-fdda27ae86daf1e1aac08377", "kind": "identity", "frame_number": 231, "timestamp_epoch": "1641571451.002171000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9", "kerberos.msg_type": "14" } }, { "event_id": "evt-65937d2bafe4a082ac82a8cd", "kind": "identity", "frame_number": 235, "timestamp_epoch": "1641571451.002388000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 17, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9", "kerberos.msg_type": "12,14" } }, { "event_id": "evt-3b0d80d7d3dc12f47df6b53c", "kind": "identity", "frame_number": 237, "timestamp_epoch": "1641571451.002557000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 6, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9", "kerberos.msg_type": "15" } }, { "event_id": "evt-5c29d41c2cfe6cd9e6cee4b4", "kind": "identity", "frame_number": 240, "timestamp_epoch": "1641571451.003379000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26", "kerberos.msg_type": "15" } }, { "event_id": "evt-965329c2b193645eba400408", "kind": "identity", "frame_number": 243, "timestamp_epoch": "1641571451.003567000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 17, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26", "kerberos.CNameString": "DESKTOP-GXMYNO2$", "kerberos.msg_type": "13" } }, { "event_id": "evt-63f60f7183efb9dd66278629", "kind": "identity", "frame_number": 245, "timestamp_epoch": "1641571451.003694000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9", "kerberos.msg_type": "15" } }, { "event_id": "evt-ff3ce23a24916df969a37548", "kind": "identity", "frame_number": 259, "timestamp_epoch": "1641571451.005120000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 0, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9", "kerberos.msg_type": "14" } }, { "event_id": "evt-62bac191e12f45ac98f16564", "kind": "identity", "frame_number": 266, "timestamp_epoch": "1641571451.006109000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 0, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26", "kerberos.msg_type": "15" } }, { "event_id": "evt-6817eb61ca3313c24ca2a76f", "kind": "identity", "frame_number": 270, "timestamp_epoch": "1641571451.006983000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 6, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9", "kerberos.msg_type": "14" } }, { "event_id": "evt-e22b25abae3d04acc749cac1", "kind": "identity", "frame_number": 272, "timestamp_epoch": "1641571451.007562000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 6, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26", "kerberos.msg_type": "15" } }, { "event_id": "evt-0880255651e8f9f3d7e3257d", "kind": "identity", "frame_number": 273, "timestamp_epoch": "1641571451.007802000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 6, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9", "kerberos.msg_type": "15" } }, { "event_id": "evt-ea24ed6d977c5a131506a277", "kind": "identity", "frame_number": 289, "timestamp_epoch": "1641571451.025512000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-6e56677e0f1891b0d2d2dde8", "kind": "identity", "frame_number": 290, "timestamp_epoch": "1641571451.025892000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-d6fd149dd55490b7612eea72", "kind": "identity", "frame_number": 293, "timestamp_epoch": "1641571451.038992000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-dda83b431e5a09195dafb7a0", "kind": "identity", "frame_number": 294, "timestamp_epoch": "1641571451.039398000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-5c5c1c8aac4470a2f3a237b8", "kind": "identity", "frame_number": 314, "timestamp_epoch": "1641571451.123538000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 20, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9", "kerberos.msg_type": "12,14" } }, { "event_id": "evt-4e14ba039779f85ed79e33f8", "kind": "identity", "frame_number": 318, "timestamp_epoch": "1641571451.124781000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 20, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26", "kerberos.CNameString": "DESKTOP-GXMYNO2$", "kerberos.msg_type": "13" } }, { "event_id": "evt-1b1a7ad619c7bb076e750295", "kind": "identity", "frame_number": 324, "timestamp_epoch": "1641571451.125468000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9", "kerberos.msg_type": "14" } }, { "event_id": "evt-5617591425e52afa3a4b3561", "kind": "identity", "frame_number": 326, "timestamp_epoch": "1641571451.126177000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26", "kerberos.msg_type": "15" } }, { "event_id": "evt-bebe9cb98c2ede8c3bf8f594", "kind": "identity", "frame_number": 327, "timestamp_epoch": "1641571451.126794000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9", "kerberos.msg_type": "15" } }, { "event_id": "evt-6fb1a361580484eb9f0d4c0f", "kind": "identity", "frame_number": 366, "timestamp_epoch": "1641571451.419583000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.1", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 9, "fields": { "eth.dst": "1c:17:d3:f6:df:0a", "eth.src": "9c:5c:8e:32:58:f9", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "SPOONWATCH<00>,SPOONWATCH<00> (Workstation/Redirector)", "nbns.nb_flags.group": "True" } }, { "event_id": "evt-507be4b66aa6b534d8291bea", "kind": "identity", "frame_number": 367, "timestamp_epoch": "1641571451.419654000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.1", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 9, "fields": { "eth.dst": "1c:17:d3:f6:df:0a", "eth.src": "9c:5c:8e:32:58:f9", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "DESKTOP-GXNYNO2<00>,DESKTOP-GXNYNO2<00> (Workstation/Redirector)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-7ed65878f2e96aa8a0e271e5", "kind": "identity", "frame_number": 395, "timestamp_epoch": "1641571452.013737000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.1", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 9, "fields": { "eth.dst": "1c:17:d3:f6:df:0a", "eth.src": "9c:5c:8e:32:58:f9", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "DESKTOP-GXNYNO2<20>,DESKTOP-GXNYNO2<20> (Server service)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-41e2ca2f40358f48e1ad9e53", "kind": "identity", "frame_number": 404, "timestamp_epoch": "1641571452.073024000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 25, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9", "kerberos.msg_type": "14" } }, { "event_id": "evt-489da8ecf3aaee2d7d7d078f", "kind": "identity", "frame_number": 406, "timestamp_epoch": "1641571452.073968000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 25, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26", "kerberos.msg_type": "15" } }, { "event_id": "evt-28a41aa7073297286de7c757", "kind": "identity", "frame_number": 413, "timestamp_epoch": "1641571452.356801000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 26, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9", "kerberos.msg_type": "12,14" } }, { "event_id": "evt-153f7a800d2e882d3560d61c", "kind": "identity", "frame_number": 416, "timestamp_epoch": "1641571452.357882000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 26, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26", "kerberos.CNameString": "DESKTOP-GXMYNO2$", "kerberos.msg_type": "13" } }, { "event_id": "evt-15970443e673bb0e03544ef5", "kind": "identity", "frame_number": 427, "timestamp_epoch": "1641571452.367990000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 27, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9", "kerberos.msg_type": "14" } }, { "event_id": "evt-5d780c6105aa7a6a95a04b10", "kind": "identity", "frame_number": 429, "timestamp_epoch": "1641571452.369088000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 27, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26", "kerberos.msg_type": "15" } }, { "event_id": "evt-bd123ce3693dc957ce5278a4", "kind": "identity", "frame_number": 442, "timestamp_epoch": "1641571452.579350000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 28, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9", "kerberos.msg_type": "12,14" } }, { "event_id": "evt-af94475a448184b21c640d7e", "kind": "identity", "frame_number": 445, "timestamp_epoch": "1641571452.580512000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 28, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26", "kerberos.CNameString": "DESKTOP-GXMYNO2$", "kerberos.msg_type": "13" } }, { "event_id": "evt-bbc27879acc13b94eda670c1", "kind": "identity", "frame_number": 454, "timestamp_epoch": "1641571452.581573000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 29, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9", "kerberos.msg_type": "12,14" } }, { "event_id": "evt-7d2e56fd181510a7b1644011", "kind": "identity", "frame_number": 457, "timestamp_epoch": "1641571452.582126000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 29, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26", "kerberos.CNameString": "DESKTOP-GXMYNO2$", "kerberos.msg_type": "13" } }, { "event_id": "evt-0058b00312f06119d776be37", "kind": "identity", "frame_number": 464, "timestamp_epoch": "1641571452.582805000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9", "kerberos.msg_type": "14" } }, { "event_id": "evt-f0e3e6fb57443e7676ba2ae6", "kind": "identity", "frame_number": 466, "timestamp_epoch": "1641571452.583835000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26", "kerberos.msg_type": "15" } }, { "event_id": "evt-89b8de1d25e490928d247c79", "kind": "identity", "frame_number": 467, "timestamp_epoch": "1641571452.584198000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-c17d9702fdf97416a63b56be", "kind": "identity", "frame_number": 468, "timestamp_epoch": "1641571452.584441000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-f46315620cc47adc26b9a38a", "kind": "identity", "frame_number": 469, "timestamp_epoch": "1641571452.594675000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-de8e93ea512162c488a902ed", "kind": "identity", "frame_number": 470, "timestamp_epoch": "1641571452.595151000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-c71262ed90b5fa97fee75baf", "kind": "identity", "frame_number": 471, "timestamp_epoch": "1641571452.595899000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-8cf8a46b257dbe67cb41bace", "kind": "identity", "frame_number": 472, "timestamp_epoch": "1641571452.596082000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-efea38bca45c9bd5c885fdcc", "kind": "identity", "frame_number": 473, "timestamp_epoch": "1641571452.596315000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-e03d5800bfc8169b3559a32c", "kind": "identity", "frame_number": 474, "timestamp_epoch": "1641571452.596532000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-64f372b16fd5715ec72420ab", "kind": "identity", "frame_number": 475, "timestamp_epoch": "1641571452.596924000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-253a2f2ccd8d598598a35ecc", "kind": "identity", "frame_number": 476, "timestamp_epoch": "1641571452.597104000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-4d72ff9f3990eeefdc0dc74b", "kind": "identity", "frame_number": 477, "timestamp_epoch": "1641571452.602706000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-74d1688c21e32e76fb55e0a0", "kind": "identity", "frame_number": 478, "timestamp_epoch": "1641571452.603182000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-d06aa89b333e666e9a6b5823", "kind": "identity", "frame_number": 479, "timestamp_epoch": "1641571452.603525000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-3bceda2c1c09ac386d736b50", "kind": "identity", "frame_number": 480, "timestamp_epoch": "1641571452.603726000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-942dd9459b71b4f860d5db82", "kind": "identity", "frame_number": 481, "timestamp_epoch": "1641571452.603931000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-a483579689302caaef546a03", "kind": "identity", "frame_number": 482, "timestamp_epoch": "1641571452.604468000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-87b2df725e800d60548f4fd8", "kind": "identity", "frame_number": 483, "timestamp_epoch": "1641571452.605314000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-231fe7dd7f08026e02837c20", "kind": "identity", "frame_number": 484, "timestamp_epoch": "1641571452.605620000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-9c53b265ddacd55361b392d1", "kind": "identity", "frame_number": 485, "timestamp_epoch": "1641571452.605910000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-6ab4140a83698a640658414e", "kind": "identity", "frame_number": 486, "timestamp_epoch": "1641571452.606296000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-e87fbf32ae84253be4cd4cc2", "kind": "identity", "frame_number": 487, "timestamp_epoch": "1641571452.606581000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-088b0f81cac756b025dbf7de", "kind": "identity", "frame_number": 488, "timestamp_epoch": "1641571452.607066000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-94f3dc5570b77baf19e125d7", "kind": "identity", "frame_number": 489, "timestamp_epoch": "1641571452.607867000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-c52a1a4ab6634387d6fa073d", "kind": "identity", "frame_number": 490, "timestamp_epoch": "1641571452.608370000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-2e7fd6c2acb1f3e084ebd9ea", "kind": "identity", "frame_number": 491, "timestamp_epoch": "1641571452.608699000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-0c9975d8526b6bd8a714e2c0", "kind": "identity", "frame_number": 492, "timestamp_epoch": "1641571452.608958000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-bfd0b38c105fe5b9bfbe3dbc", "kind": "identity", "frame_number": 493, "timestamp_epoch": "1641571452.609185000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-3f078d41eba593b325fff760", "kind": "identity", "frame_number": 494, "timestamp_epoch": "1641571452.609621000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-93589841c7ab111462055b75", "kind": "identity", "frame_number": 495, "timestamp_epoch": "1641571452.610647000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-21972f310d2a464d735e3dc9", "kind": "identity", "frame_number": 496, "timestamp_epoch": "1641571452.611144000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-4ccf04ea0cc044c436eae42b", "kind": "identity", "frame_number": 497, "timestamp_epoch": "1641571452.611411000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-9688ad30fc706cb0961ef6ce", "kind": "identity", "frame_number": 498, "timestamp_epoch": "1641571452.611600000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-2eeae6b39fbb5008c801ad62", "kind": "identity", "frame_number": 499, "timestamp_epoch": "1641571452.611817000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-b7dd5f94e1bfe2a686edaaa2", "kind": "identity", "frame_number": 500, "timestamp_epoch": "1641571452.612238000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-3b2e7940d50da7a5d8163e85", "kind": "identity", "frame_number": 501, "timestamp_epoch": "1641571452.612603000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-268fb37883fa38094dd2204f", "kind": "identity", "frame_number": 502, "timestamp_epoch": "1641571452.612871000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-944f253c2253db24cf96586f", "kind": "identity", "frame_number": 503, "timestamp_epoch": "1641571452.613086000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-7dd794d4bd5f3b4efb87c77d", "kind": "identity", "frame_number": 504, "timestamp_epoch": "1641571452.613249000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-3af2f1e76576e83f05a12776", "kind": "identity", "frame_number": 505, "timestamp_epoch": "1641571452.613453000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-0b977ee7418c00375d978b67", "kind": "identity", "frame_number": 506, "timestamp_epoch": "1641571452.613638000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-dc7a3e29e9d0111fbea5c496", "kind": "identity", "frame_number": 507, "timestamp_epoch": "1641571452.613865000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-1d01d7230b43d266b5fa1515", "kind": "identity", "frame_number": 508, "timestamp_epoch": "1641571452.614017000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-6654a09fe9eb1c25b9fd3801", "kind": "identity", "frame_number": 509, "timestamp_epoch": "1641571452.614313000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-85c1b44d6bcc3cf0d4ef7432", "kind": "identity", "frame_number": 510, "timestamp_epoch": "1641571452.614645000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-e4157c10f4c1e77bc658074f", "kind": "identity", "frame_number": 511, "timestamp_epoch": "1641571452.614881000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-517a111c88ea836f1353129e", "kind": "identity", "frame_number": 512, "timestamp_epoch": "1641571452.615038000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-20189f1baabf2b6d0d05249c", "kind": "identity", "frame_number": 513, "timestamp_epoch": "1641571452.615215000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-1ffa500c745a672af628f42b", "kind": "identity", "frame_number": 514, "timestamp_epoch": "1641571452.615401000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-97a3978c8d057e37b90493fb", "kind": "identity", "frame_number": 515, "timestamp_epoch": "1641571452.615607000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-47c4444759a7e9526b2e3116", "kind": "identity", "frame_number": 516, "timestamp_epoch": "1641571452.615767000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-5d0718f8256e84d82719994a", "kind": "identity", "frame_number": 517, "timestamp_epoch": "1641571452.615949000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-83dd109a5aac4f2c420f498a", "kind": "identity", "frame_number": 518, "timestamp_epoch": "1641571452.616138000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-d00aab3898a63e6880295ec7", "kind": "identity", "frame_number": 519, "timestamp_epoch": "1641571452.616333000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-5772333f67b291d18a393838", "kind": "identity", "frame_number": 520, "timestamp_epoch": "1641571452.616515000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-004cd93c020aa36e75cc997c", "kind": "identity", "frame_number": 521, "timestamp_epoch": "1641571452.617143000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-af98c8e7a62398d713b41a09", "kind": "identity", "frame_number": 522, "timestamp_epoch": "1641571452.617360000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-e22f121ab6a0cc3cb2fc0e1e", "kind": "identity", "frame_number": 523, "timestamp_epoch": "1641571452.618013000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-1cdd1fb3e88ca18d92c7936a", "kind": "identity", "frame_number": 524, "timestamp_epoch": "1641571452.618230000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-d4b3a012a2eda65c693835a5", "kind": "identity", "frame_number": 525, "timestamp_epoch": "1641571452.618549000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-b45245de3a9d006def40de12", "kind": "identity", "frame_number": 526, "timestamp_epoch": "1641571452.618817000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-6fd77498ac3c6ffde0c7d429", "kind": "identity", "frame_number": 527, "timestamp_epoch": "1641571452.619201000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-ee9341e7b4b9b3fe619a42e0", "kind": "identity", "frame_number": 528, "timestamp_epoch": "1641571452.619406000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-086ee9cdb1eb0108ff6c560b", "kind": "identity", "frame_number": 529, "timestamp_epoch": "1641571452.619756000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-c9ab10739109bf6f3773f0c0", "kind": "identity", "frame_number": 530, "timestamp_epoch": "1641571452.620098000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-36e4fc26b8f1cd918fd5ca0f", "kind": "identity", "frame_number": 531, "timestamp_epoch": "1641571452.620322000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-bb5f66f1dc20a5f6443d0e7f", "kind": "identity", "frame_number": 532, "timestamp_epoch": "1641571452.620502000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-dc33832974fc745d7748433c", "kind": "identity", "frame_number": 533, "timestamp_epoch": "1641571452.620696000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-dcbc9118668488352e6ce20d", "kind": "identity", "frame_number": 534, "timestamp_epoch": "1641571452.620872000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-d82a0003fc44516039df6931", "kind": "identity", "frame_number": 535, "timestamp_epoch": "1641571452.621018000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-1ebc09fc5839ba17ba078ede", "kind": "identity", "frame_number": 536, "timestamp_epoch": "1641571452.621219000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-3a787788bfd8ff2b460e2d17", "kind": "identity", "frame_number": 537, "timestamp_epoch": "1641571452.621370000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-de84483412c3a4a118a9e9d4", "kind": "identity", "frame_number": 538, "timestamp_epoch": "1641571452.621576000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-02f7cbad0e3bfd4cf3b4f5c4", "kind": "identity", "frame_number": 539, "timestamp_epoch": "1641571452.621754000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-cb86ed74d167221bb711b2f8", "kind": "identity", "frame_number": 540, "timestamp_epoch": "1641571452.621893000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-5f558fe078e538cfb2e4efba", "kind": "identity", "frame_number": 541, "timestamp_epoch": "1641571452.622070000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-42a6aa3d187a905a70526a70", "kind": "identity", "frame_number": 542, "timestamp_epoch": "1641571452.622215000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-566f169caedd6e9cc08c177f", "kind": "identity", "frame_number": 543, "timestamp_epoch": "1641571452.622449000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-2fc596a5a20076f986f94b9f", "kind": "identity", "frame_number": 544, "timestamp_epoch": "1641571452.622621000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-71e8d1250f32cdd31cf8fc7c", "kind": "identity", "frame_number": 545, "timestamp_epoch": "1641571452.622778000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-34f4a55fa8d5214a18f6b77b", "kind": "identity", "frame_number": 546, "timestamp_epoch": "1641571452.622941000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-3475807dd917d8496a1de4d8", "kind": "identity", "frame_number": 547, "timestamp_epoch": "1641571452.623074000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-237dc06d6df90ba620470bc8", "kind": "identity", "frame_number": 548, "timestamp_epoch": "1641571452.623248000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-d262b83338e80d27ecd52c8f", "kind": "identity", "frame_number": 549, "timestamp_epoch": "1641571452.623972000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-4b0dd31b653ff8e82cbade2e", "kind": "identity", "frame_number": 550, "timestamp_epoch": "1641571452.624108000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-d183dd2591886d02e92d6a75", "kind": "identity", "frame_number": 551, "timestamp_epoch": "1641571452.624318000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-ed7325bdd974049043be52a7", "kind": "identity", "frame_number": 553, "timestamp_epoch": "1641571452.624694000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-e9d540d917a8ea6db1e25a23", "kind": "identity", "frame_number": 555, "timestamp_epoch": "1641571452.625096000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-2877d0d7b3dd33aa2cf7fed5", "kind": "identity", "frame_number": 556, "timestamp_epoch": "1641571452.625311000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-d7fa83f2c12d18b0101e63c1", "kind": "identity", "frame_number": 557, "timestamp_epoch": "1641571452.625588000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-278b526df06e77d59661354a", "kind": "identity", "frame_number": 558, "timestamp_epoch": "1641571452.625871000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-80cbc238bee327c42401c3bf", "kind": "identity", "frame_number": 559, "timestamp_epoch": "1641571452.626097000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-a07c6f1f498ce1dcdb71cd35", "kind": "identity", "frame_number": 560, "timestamp_epoch": "1641571452.626290000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-2e30cedbd49331dbda086a9b", "kind": "identity", "frame_number": 561, "timestamp_epoch": "1641571452.626453000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-1ce3f3b2ea0003c64e42d2c8", "kind": "identity", "frame_number": 562, "timestamp_epoch": "1641571452.626675000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-dbc4cb5353fac1f2c0e3902e", "kind": "identity", "frame_number": 563, "timestamp_epoch": "1641571452.626910000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-affe6084c67e0067b7a63546", "kind": "identity", "frame_number": 564, "timestamp_epoch": "1641571452.627093000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-306aeaaaf917ddc343ab4e79", "kind": "identity", "frame_number": 565, "timestamp_epoch": "1641571452.627266000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-b7cd8ff99fd46cde5c994055", "kind": "identity", "frame_number": 566, "timestamp_epoch": "1641571452.627451000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-d44e8c763a4082a347d923b7", "kind": "identity", "frame_number": 567, "timestamp_epoch": "1641571452.627661000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-fd6ca89b5a9f9adf21d9c1cd", "kind": "identity", "frame_number": 568, "timestamp_epoch": "1641571452.627849000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-8848f54f3d2b8fef067ec43c", "kind": "identity", "frame_number": 569, "timestamp_epoch": "1641571452.628045000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-7dcaf958d9089b29b862fe5a", "kind": "identity", "frame_number": 570, "timestamp_epoch": "1641571452.628185000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-33423a10ce3ff237bbfebdd0", "kind": "identity", "frame_number": 571, "timestamp_epoch": "1641571452.628302000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-ed6b4560328a435187c4d76d", "kind": "identity", "frame_number": 572, "timestamp_epoch": "1641571452.628415000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-836ed7dc5bc6759ffe622dee", "kind": "identity", "frame_number": 573, "timestamp_epoch": "1641571452.628545000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-f803fa724d2908cdd0c09dcc", "kind": "identity", "frame_number": 574, "timestamp_epoch": "1641571452.628663000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-a442d4b926227ad0bce48233", "kind": "identity", "frame_number": 575, "timestamp_epoch": "1641571452.628811000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-7fe172436281ea2fc5603f38", "kind": "identity", "frame_number": 576, "timestamp_epoch": "1641571452.628923000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-2e35853531573af14c167d82", "kind": "identity", "frame_number": 577, "timestamp_epoch": "1641571452.629045000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-4e91c13dbbb47b5c87b66d4a", "kind": "identity", "frame_number": 578, "timestamp_epoch": "1641571452.629177000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-1d88ebc64295b579020995a3", "kind": "identity", "frame_number": 579, "timestamp_epoch": "1641571452.629541000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-94b823620599a26abe039025", "kind": "identity", "frame_number": 580, "timestamp_epoch": "1641571452.629675000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-ee64eb38d460afc7a90f40c5", "kind": "identity", "frame_number": 581, "timestamp_epoch": "1641571452.634484000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.1", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 9, "fields": { "eth.dst": "1c:17:d3:f6:df:0a", "eth.src": "9c:5c:8e:32:58:f9", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "SPOONWATCH<1e>,SPOONWATCH<1e> (Browser Election Service)", "nbns.nb_flags.group": "True" } }, { "event_id": "evt-99bb129a28a74329b70e7983", "kind": "identity", "frame_number": 582, "timestamp_epoch": "1641571452.653259000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-799ac9b8afd3f06656f6375e", "kind": "identity", "frame_number": 583, "timestamp_epoch": "1641571452.653723000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-131e6c3c02ca26081d9c25de", "kind": "identity", "frame_number": 584, "timestamp_epoch": "1641571452.654470000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-8b35b92f59c0f651405fde26", "kind": "identity", "frame_number": 585, "timestamp_epoch": "1641571452.654986000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-56a509c3a8abf7f87b99fa5e", "kind": "identity", "frame_number": 595, "timestamp_epoch": "1641571452.919844000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.1", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 9, "fields": { "eth.dst": "1c:17:d3:f6:df:0a", "eth.src": "9c:5c:8e:32:58:f9", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "DESKTOP-GXNYNO2<00>,DESKTOP-GXNYNO2<00> (Workstation/Redirector)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-e20893b9bd26bdc5f244edd8", "kind": "identity", "frame_number": 596, "timestamp_epoch": "1641571452.919945000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.1", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 9, "fields": { "eth.dst": "1c:17:d3:f6:df:0a", "eth.src": "9c:5c:8e:32:58:f9", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "SPOONWATCH<00>,SPOONWATCH<00> (Workstation/Redirector)", "nbns.nb_flags.group": "True" } }, { "event_id": "evt-713ece546cceefc79310b751", "kind": "identity", "frame_number": 597, "timestamp_epoch": "1641571453.529149000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.1", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 9, "fields": { "eth.dst": "1c:17:d3:f6:df:0a", "eth.src": "9c:5c:8e:32:58:f9", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "DESKTOP-GXNYNO2<20>,DESKTOP-GXNYNO2<20> (Server service)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-857eac0364c6a391b5e34c4e", "kind": "identity", "frame_number": 598, "timestamp_epoch": "1641571454.122849000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.1", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 9, "fields": { "eth.dst": "1c:17:d3:f6:df:0a", "eth.src": "9c:5c:8e:32:58:f9", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "SPOONWATCH<1e>,SPOONWATCH<1e> (Browser Election Service)", "nbns.nb_flags.group": "True" } }, { "event_id": "evt-cef075e5cd49882532c63a98", "kind": "identity", "frame_number": 603, "timestamp_epoch": "1641571454.466709000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 31, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "9c:5c:8e:32:58:f9", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "SPOONWATCH<00>,SPOONWATCH<00> (Workstation/Redirector)", "nbns.nb_flags.group": "True" } }, { "event_id": "evt-d8f2376b0817ee54c547d594", "kind": "identity", "frame_number": 604, "timestamp_epoch": "1641571454.466774000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 31, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "9c:5c:8e:32:58:f9", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "DESKTOP-GXNYNO2<00>,DESKTOP-GXNYNO2<00> (Workstation/Redirector)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-e94de8f95ab6a212d56eb528", "kind": "identity", "frame_number": 616, "timestamp_epoch": "1641571454.551040000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 31, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9", "kerberos.msg_type": "14" } }, { "event_id": "evt-fe6d2714942169cbf6aecc09", "kind": "identity", "frame_number": 618, "timestamp_epoch": "1641571454.551932000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 31, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26", "kerberos.msg_type": "15" } }, { "event_id": "evt-b25e76ee0ab67d98a816f84f", "kind": "identity", "frame_number": 619, "timestamp_epoch": "1641571454.552308000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 31, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9", "kerberos.msg_type": "15" } }, { "event_id": "evt-fe53ddd41624b3c5a07e8289", "kind": "identity", "frame_number": 643, "timestamp_epoch": "1641571454.566408000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 32, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9", "kerberos.msg_type": "14" } }, { "event_id": "evt-0c5d123742b2609f8a8270dc", "kind": "identity", "frame_number": 645, "timestamp_epoch": "1641571454.567281000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 32, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26", "kerberos.msg_type": "15" } }, { "event_id": "evt-0c0c33de5782b74569da1999", "kind": "identity", "frame_number": 656, "timestamp_epoch": "1641571454.574377000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 33, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9", "kerberos.msg_type": "14" } }, { "event_id": "evt-12149f9349fae35c8b43b37d", "kind": "identity", "frame_number": 658, "timestamp_epoch": "1641571454.575321000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 33, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26", "kerberos.msg_type": "15" } }, { "event_id": "evt-d7d32e900a939ba9d4773a77", "kind": "identity", "frame_number": 676, "timestamp_epoch": "1641571455.091589000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 31, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "9c:5c:8e:32:58:f9", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "DESKTOP-GXNYNO2<20>,DESKTOP-GXNYNO2<20> (Server service)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-b9c020c514e796ad41c6a7b2", "kind": "identity", "frame_number": 677, "timestamp_epoch": "1641571455.216798000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 31, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "9c:5c:8e:32:58:f9", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "DESKTOP-GXNYNO2<00>,DESKTOP-GXNYNO2<00> (Workstation/Redirector)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-6937d046ed677acd212c5c6f", "kind": "identity", "frame_number": 678, "timestamp_epoch": "1641571455.217047000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 31, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "9c:5c:8e:32:58:f9", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "SPOONWATCH<00>,SPOONWATCH<00> (Workstation/Redirector)", "nbns.nb_flags.group": "True" } }, { "event_id": "evt-f6ca2ee147466669c03905f1", "kind": "identity", "frame_number": 684, "timestamp_epoch": "1641571455.669911000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.1", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 9, "fields": { "eth.dst": "1c:17:d3:f6:df:0a", "eth.src": "9c:5c:8e:32:58:f9", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "SPOONWATCH<1e>,SPOONWATCH<1e> (Browser Election Service)", "nbns.nb_flags.group": "True" } }, { "event_id": "evt-4676a0f7b3c45af8b6d021d6", "kind": "identity", "frame_number": 685, "timestamp_epoch": "1641571455.858375000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 31, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "9c:5c:8e:32:58:f9", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "DESKTOP-GXNYNO2<20>,DESKTOP-GXNYNO2<20> (Server service)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-11bcb47f5b8f20ed56362e7e", "kind": "identity", "frame_number": 686, "timestamp_epoch": "1641571455.967670000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 31, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "9c:5c:8e:32:58:f9", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "SPOONWATCH<00>,SPOONWATCH<00> (Workstation/Redirector)", "nbns.nb_flags.group": "True" } }, { "event_id": "evt-7d9848edb23b1c38c92540ab", "kind": "identity", "frame_number": 687, "timestamp_epoch": "1641571455.967816000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 31, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "9c:5c:8e:32:58:f9", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "DESKTOP-GXNYNO2<00>,DESKTOP-GXNYNO2<00> (Workstation/Redirector)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-269450e699a5dfb4cca93207", "kind": "identity", "frame_number": 688, "timestamp_epoch": "1641571456.655208000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 31, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "9c:5c:8e:32:58:f9", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "DESKTOP-GXNYNO2<20>,DESKTOP-GXNYNO2<20> (Server service)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-053c11c4a5f993fe65b175d2", "kind": "identity", "frame_number": 689, "timestamp_epoch": "1641571456.732270000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 31, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "9c:5c:8e:32:58:f9", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "DESKTOP-GXNYNO2<00>,DESKTOP-GXNYNO2<00> (Workstation/Redirector)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-7bec61478233c46d4919761e", "kind": "identity", "frame_number": 690, "timestamp_epoch": "1641571456.732412000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 31, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "9c:5c:8e:32:58:f9", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "SPOONWATCH<00>,SPOONWATCH<00> (Workstation/Redirector)", "nbns.nb_flags.group": "True" } }, { "event_id": "evt-028e28bc004e862efd096398", "kind": "identity", "frame_number": 691, "timestamp_epoch": "1641571457.280575000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 31, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "9c:5c:8e:32:58:f9", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "SPOONWATCH<1e>,SPOONWATCH<1e> (Browser Election Service)", "nbns.nb_flags.group": "True" } }, { "event_id": "evt-49d559c7f7e143f0981011dc", "kind": "identity", "frame_number": 692, "timestamp_epoch": "1641571457.421213000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 31, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "9c:5c:8e:32:58:f9", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "DESKTOP-GXNYNO2<20>,DESKTOP-GXNYNO2<20> (Server service)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-5ca4d0f997041d6f2de16214", "kind": "identity", "frame_number": 693, "timestamp_epoch": "1641571458.061405000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 31, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "9c:5c:8e:32:58:f9", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "SPOONWATCH<1e>,SPOONWATCH<1e> (Browser Election Service)", "nbns.nb_flags.group": "True" } }, { "event_id": "evt-ca751281f2532d7e997bb328", "kind": "identity", "frame_number": 694, "timestamp_epoch": "1641571458.269061000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 32, "fields": { "browser.server": "DESKTOP-GXMYNO2", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-ff6a006a6f18a5f20292cad8", "kind": "identity", "frame_number": 695, "timestamp_epoch": "1641571458.842505000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 31, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "9c:5c:8e:32:58:f9", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "SPOONWATCH<1e>,SPOONWATCH<1e> (Browser Election Service)", "nbns.nb_flags.group": "True" } }, { "event_id": "evt-67cca92ba3c8c8c0065298e3", "kind": "identity", "frame_number": 698, "timestamp_epoch": "1641571459.639695000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 31, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "9c:5c:8e:32:58:f9", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "SPOONWATCH<1e>,SPOONWATCH<1e> (Browser Election Service)", "nbns.nb_flags.group": "True" } }, { "event_id": "evt-6ab8ce9c09e720fa17462480", "kind": "identity", "frame_number": 709, "timestamp_epoch": "1641571460.158393000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 34, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9", "kerberos.msg_type": "14" } }, { "event_id": "evt-18155beea5874599ebcbdde5", "kind": "identity", "frame_number": 711, "timestamp_epoch": "1641571460.159345000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 34, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26", "kerberos.msg_type": "15" } }, { "event_id": "evt-0ac8b4fa5320394947db154d", "kind": "identity", "frame_number": 725, "timestamp_epoch": "1641571460.169844000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 35, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9", "kerberos.CNameString": "DESKTOP-GXMYNO2$", "kerberos.msg_type": "10" } }, { "event_id": "evt-e4105a11830334e7f7937b65", "kind": "identity", "frame_number": 726, "timestamp_epoch": "1641571460.170364000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 35, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26", "kerberos.msg_type": "30" } }, { "event_id": "evt-9654bd9452f296721bf90173", "kind": "identity", "frame_number": 733, "timestamp_epoch": "1641571460.171188000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 36, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9", "kerberos.CNameString": "DESKTOP-GXMYNO2$", "kerberos.msg_type": "10" } }, { "event_id": "evt-f1098d2582814a081d6f4227", "kind": "identity", "frame_number": 735, "timestamp_epoch": "1641571460.171965000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 36, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26", "kerberos.CNameString": "DESKTOP-GXMYNO2$", "kerberos.msg_type": "11" } }, { "event_id": "evt-6933c640c8e5cc48bd0fc1cb", "kind": "identity", "frame_number": 744, "timestamp_epoch": "1641571460.173204000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 37, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9", "kerberos.msg_type": "12,14" } }, { "event_id": "evt-c689a4a9783e73a6190d910a", "kind": "identity", "frame_number": 747, "timestamp_epoch": "1641571460.174418000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 37, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26", "kerberos.CNameString": "DESKTOP-GXMYNO2$", "kerberos.msg_type": "13" } }, { "event_id": "evt-9ae5890eadb8a00c89006809", "kind": "identity", "frame_number": 756, "timestamp_epoch": "1641571460.439069000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 32, "fields": { "browser.response_computer_name": "DESKTOP-GXMYNO2", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-1d5ecce6b13eb36d5eda9d2f", "kind": "identity", "frame_number": 757, "timestamp_epoch": "1641571460.447405000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 32, "fields": { "browser.server": "DESKTOP-GXMYNO2", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-133c8d184845406830f1b795", "kind": "identity", "frame_number": 763, "timestamp_epoch": "1641571461.717064000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-9e89d0c9bcd63eddc2a984e4", "kind": "identity", "frame_number": 764, "timestamp_epoch": "1641571461.717450000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-63c2c89061333591f9edb766", "kind": "identity", "frame_number": 765, "timestamp_epoch": "1641571461.717718000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-3c420327d4d3954336f92159", "kind": "identity", "frame_number": 766, "timestamp_epoch": "1641571461.718019000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-670af7f109c667afcf8e4c56", "kind": "identity", "frame_number": 829, "timestamp_epoch": "1641571491.641944000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9", "kerberos.CNameString": "steve.smith", "kerberos.msg_type": "10" } }, { "event_id": "evt-4feabfff8cb0ab593b310b16", "kind": "identity", "frame_number": 830, "timestamp_epoch": "1641571491.642454000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26", "kerberos.msg_type": "30" } }, { "event_id": "evt-e65f325ef2c083609cb71886", "kind": "identity", "frame_number": 837, "timestamp_epoch": "1641571491.650430000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 40, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9", "kerberos.CNameString": "steve.smith", "kerberos.msg_type": "10" } }, { "event_id": "evt-f189e87e0d1f4090ff8c41c8", "kind": "identity", "frame_number": 839, "timestamp_epoch": "1641571491.651134000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 40, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26", "kerberos.CNameString": "steve.smith", "kerberos.msg_type": "11" } }, { "event_id": "evt-c46cec1c6be08aaeecde88a7", "kind": "identity", "frame_number": 848, "timestamp_epoch": "1641571491.652844000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 41, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9", "kerberos.msg_type": "12,14" } }, { "event_id": "evt-b6d8c6adadc3d24ed5b2a2dd", "kind": "identity", "frame_number": 851, "timestamp_epoch": "1641571491.653884000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 41, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26", "kerberos.CNameString": "steve.smith", "kerberos.msg_type": "13" } }, { "event_id": "evt-093ac46d4e745312c20c95cf", "kind": "identity", "frame_number": 869, "timestamp_epoch": "1641571491.730492000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-15fba27096306b199fe2f2a8", "kind": "identity", "frame_number": 870, "timestamp_epoch": "1641571491.730681000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-e088c9cda10973b013a03117", "kind": "identity", "frame_number": 871, "timestamp_epoch": "1641571491.730966000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-81e4cfb0c874e6c71ce582bd", "kind": "identity", "frame_number": 878, "timestamp_epoch": "1641571491.737910000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 44, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9", "kerberos.msg_type": "12,14" } }, { "event_id": "evt-14b2328004be09c6356cca8b", "kind": "identity", "frame_number": 880, "timestamp_epoch": "1641571491.738436000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 44, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26", "kerberos.msg_type": "30" } }, { "event_id": "evt-0f1f759d76e67777a62846a8", "kind": "identity", "frame_number": 888, "timestamp_epoch": "1641571491.748015000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 45, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9", "kerberos.msg_type": "12,14" } }, { "event_id": "evt-a639334d13cea19d6adc915a", "kind": "identity", "frame_number": 891, "timestamp_epoch": "1641571491.749061000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 45, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26", "kerberos.CNameString": "steve.smith", "kerberos.msg_type": "13" } }, { "event_id": "evt-efa8a1c8b84ebb64720c1de7", "kind": "identity", "frame_number": 897, "timestamp_epoch": "1641571491.749667000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9", "kerberos.msg_type": "14" } }, { "event_id": "evt-d0b24a5399967b7fb06314fc", "kind": "identity", "frame_number": 899, "timestamp_epoch": "1641571491.750292000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26", "kerberos.msg_type": "15" } }, { "event_id": "evt-659fa32b776ac5765dd73358", "kind": "identity", "frame_number": 900, "timestamp_epoch": "1641571491.750536000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9", "kerberos.msg_type": "15" } }, { "event_id": "evt-274581e3e6654c77373bf534", "kind": "identity", "frame_number": 912, "timestamp_epoch": "1641571491.756669000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-706df4c3a1cfef1bed017b4f", "kind": "identity", "frame_number": 913, "timestamp_epoch": "1641571491.757182000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-89b1259347f9aa32e0567423", "kind": "identity", "frame_number": 914, "timestamp_epoch": "1641571491.757908000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9", "ntlmssp.auth.domain": "SPOONWATCH", "ntlmssp.auth.hostname": "DESKTOP-GXMYNO2", "ntlmssp.auth.username": "steve.smith" } }, { "event_id": "evt-87e85bb31274989a057d3b8b", "kind": "identity", "frame_number": 915, "timestamp_epoch": "1641571491.759066000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-4810eaab388e842f2a82c225", "kind": "identity", "frame_number": 916, "timestamp_epoch": "1641571491.759780000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-ea8dab624f90c52614f2ff99", "kind": "identity", "frame_number": 917, "timestamp_epoch": "1641571491.760030000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-3e5cb03398144f8c25da56a3", "kind": "identity", "frame_number": 918, "timestamp_epoch": "1641571491.760273000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-5def01454c1de2fddc24a169", "kind": "identity", "frame_number": 919, "timestamp_epoch": "1641571491.760368000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-d03fa01bd2b5ece1f6660a70", "kind": "identity", "frame_number": 921, "timestamp_epoch": "1641571491.760561000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-d4e3300a9762bfd79e80ea52", "kind": "identity", "frame_number": 922, "timestamp_epoch": "1641571491.760768000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-6c3be071abab1fc62d0a054a", "kind": "identity", "frame_number": 924, "timestamp_epoch": "1641571491.760944000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-55986ec03e3867b416b12221", "kind": "identity", "frame_number": 925, "timestamp_epoch": "1641571491.761136000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-9adba54b4127931da40539bc", "kind": "identity", "frame_number": 926, "timestamp_epoch": "1641571491.761504000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-7efdeae98159c487f164e1bd", "kind": "identity", "frame_number": 927, "timestamp_epoch": "1641571491.761728000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-9158831fcd75928dce9f6812", "kind": "identity", "frame_number": 928, "timestamp_epoch": "1641571491.762044000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-93478e0c1464688a6fa3e6ec", "kind": "identity", "frame_number": 929, "timestamp_epoch": "1641571491.762218000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-d7863098276fda76b4149bdc", "kind": "identity", "frame_number": 930, "timestamp_epoch": "1641571491.762466000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-81159e91c02c96451fb008e2", "kind": "identity", "frame_number": 931, "timestamp_epoch": "1641571491.762873000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-4399d8971292ff65f15a9646", "kind": "identity", "frame_number": 932, "timestamp_epoch": "1641571491.763188000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-9ee27d7b3cb05fc7a7c5ea75", "kind": "identity", "frame_number": 933, "timestamp_epoch": "1641571491.763490000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-b523788d6cb4446fe7e37a7c", "kind": "identity", "frame_number": 934, "timestamp_epoch": "1641571491.763726000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-da2aac12233ea41d62d94bcc", "kind": "identity", "frame_number": 935, "timestamp_epoch": "1641571491.764023000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-74fa1aae9e4cf036c77036b0", "kind": "identity", "frame_number": 936, "timestamp_epoch": "1641571491.764652000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-5d36903c0859d5d10c459899", "kind": "identity", "frame_number": 937, "timestamp_epoch": "1641571491.765022000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-b8240e3dce977bea6786533d", "kind": "identity", "frame_number": 938, "timestamp_epoch": "1641571491.765254000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-76d71b9903b458a1e7cfd7a3", "kind": "identity", "frame_number": 939, "timestamp_epoch": "1641571491.765641000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-80554f8d95ac66e2dbdee8e8", "kind": "identity", "frame_number": 940, "timestamp_epoch": "1641571491.765851000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-10beee3774767a0964571bdb", "kind": "identity", "frame_number": 941, "timestamp_epoch": "1641571491.766298000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-aa3079bb8fcdd7fceb76ded0", "kind": "identity", "frame_number": 942, "timestamp_epoch": "1641571491.766518000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-6a815507019757232c0d4015", "kind": "identity", "frame_number": 943, "timestamp_epoch": "1641571491.766964000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-ba41da519ed520749f048f0a", "kind": "identity", "frame_number": 944, "timestamp_epoch": "1641571491.767254000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-ce23c50ee185be56703d0493", "kind": "identity", "frame_number": 945, "timestamp_epoch": "1641571491.767646000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26", "samr.samr_UserInfo21.account_name": "steve.smith", "samr.samr_UserInfo21.full_name": "Steve Smith" } }, { "event_id": "evt-a1a166a23d6a4b15bf367c77", "kind": "identity", "frame_number": 946, "timestamp_epoch": "1641571491.767888000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-97951cfee640a01868a83226", "kind": "identity", "frame_number": 947, "timestamp_epoch": "1641571491.768351000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-60cc8c8e332b6acb57e61144", "kind": "identity", "frame_number": 948, "timestamp_epoch": "1641571491.768616000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-f11d268a19179e3632789119", "kind": "identity", "frame_number": 949, "timestamp_epoch": "1641571491.769000000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-dd2ea24e029a3d9dccd3e04d", "kind": "identity", "frame_number": 950, "timestamp_epoch": "1641571491.769247000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-beb0695abd98ec7fe33eca9c", "kind": "identity", "frame_number": 951, "timestamp_epoch": "1641571491.769604000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-653b2408a1e3c32519a18de5", "kind": "identity", "frame_number": 952, "timestamp_epoch": "1641571491.769906000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-22c1b4a7cf1dcbf46d4aab20", "kind": "identity", "frame_number": 953, "timestamp_epoch": "1641571491.770231000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-bcd2a88c4560b8e3c2813a91", "kind": "identity", "frame_number": 954, "timestamp_epoch": "1641571491.770452000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-8a5a6c3af74a4def2883701b", "kind": "identity", "frame_number": 955, "timestamp_epoch": "1641571491.770746000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-87f9b170d0560dd3c1ce3997", "kind": "identity", "frame_number": 956, "timestamp_epoch": "1641571491.770996000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-b47edf1f1c838a25755d5e74", "kind": "identity", "frame_number": 957, "timestamp_epoch": "1641571491.771295000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-9c02739198db5573182d468b", "kind": "identity", "frame_number": 958, "timestamp_epoch": "1641571491.771531000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-4b335f1c48e2ca194b2f0160", "kind": "identity", "frame_number": 959, "timestamp_epoch": "1641571491.771855000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-6086d33c07af4fb5b2774919", "kind": "identity", "frame_number": 960, "timestamp_epoch": "1641571491.772102000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-884c7dc7f3775ef9c40ba48e", "kind": "identity", "frame_number": 961, "timestamp_epoch": "1641571491.772320000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-65a5d2a625ad02fd851478a8", "kind": "identity", "frame_number": 967, "timestamp_epoch": "1641571491.973729000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 46, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-e4b9d417099085d789ea6f9f", "kind": "identity", "frame_number": 968, "timestamp_epoch": "1641571491.974173000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 46, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-ddfa5ae16032be98e63a2d91", "kind": "identity", "frame_number": 973, "timestamp_epoch": "1641571491.975698000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 47, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9", "kerberos.msg_type": "12,14" } }, { "event_id": "evt-3b3d867acd336bd292e21036", "kind": "identity", "frame_number": 976, "timestamp_epoch": "1641571491.976783000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 47, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26", "kerberos.CNameString": "steve.smith", "kerberos.msg_type": "13" } }, { "event_id": "evt-950acff6c0bdc3b3ef43e71a", "kind": "identity", "frame_number": 985, "timestamp_epoch": "1641571491.977574000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 48, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9", "kerberos.msg_type": "12,14" } }, { "event_id": "evt-8b48563960712c2afabea8d6", "kind": "identity", "frame_number": 988, "timestamp_epoch": "1641571491.978061000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 48, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26", "kerberos.CNameString": "steve.smith", "kerberos.msg_type": "13" } }, { "event_id": "evt-64d03f7515b256a1baf0e9eb", "kind": "identity", "frame_number": 995, "timestamp_epoch": "1641571491.978670000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 46, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9", "kerberos.msg_type": "14" } }, { "event_id": "evt-6c7d6bf03635dbbc13d8b1bf", "kind": "identity", "frame_number": 997, "timestamp_epoch": "1641571491.979630000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 46, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26", "kerberos.msg_type": "15" } }, { "event_id": "evt-9fbc7436c41cffe2f42185fe", "kind": "identity", "frame_number": 998, "timestamp_epoch": "1641571491.980035000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 46, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-35a10425d60aae659282c250", "kind": "identity", "frame_number": 999, "timestamp_epoch": "1641571491.980246000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 46, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-467f590e1c46bdbb426aa6e2", "kind": "identity", "frame_number": 1000, "timestamp_epoch": "1641571491.980438000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 46, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-6268bcfa9ad9ca2feb7e4137", "kind": "identity", "frame_number": 1001, "timestamp_epoch": "1641571491.980638000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 46, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-614a5ea9af598fc1fa837c85", "kind": "identity", "frame_number": 1007, "timestamp_epoch": "1641571492.071286000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 49, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9", "kerberos.msg_type": "14" } }, { "event_id": "evt-edbedb6aeb19152b989eb64a", "kind": "identity", "frame_number": 1009, "timestamp_epoch": "1641571492.072146000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 49, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26", "kerberos.msg_type": "15" } }, { "event_id": "evt-14d64674514012a7f5727661", "kind": "identity", "frame_number": 1016, "timestamp_epoch": "1641571492.087887000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 50, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9", "kerberos.msg_type": "14" } }, { "event_id": "evt-ee10fce8b636e028134ae7c5", "kind": "identity", "frame_number": 1018, "timestamp_epoch": "1641571492.088787000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 50, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26", "kerberos.msg_type": "15" } }, { "event_id": "evt-e39a9bd1bbeae80d7ec0971b", "kind": "identity", "frame_number": 1124, "timestamp_epoch": "1641571503.382040000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 46, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-592a7ff61cdf7445c9562599", "kind": "identity", "frame_number": 1125, "timestamp_epoch": "1641571503.382454000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 46, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-ddc31d459115a6368daaae46", "kind": "identity", "frame_number": 1126, "timestamp_epoch": "1641571503.384610000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 46, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-ed0741ffc4a6cc4fc81ba534", "kind": "identity", "frame_number": 1127, "timestamp_epoch": "1641571503.384977000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 46, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-e029a020534ec99cf9c05b62", "kind": "identity", "frame_number": 1129, "timestamp_epoch": "1641571503.880514000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 46, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-3553e57ef85ecf10fe2da616", "kind": "identity", "frame_number": 1130, "timestamp_epoch": "1641571503.880843000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 46, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-84e3001c5b491f69881e5ee9", "kind": "identity", "frame_number": 1131, "timestamp_epoch": "1641571503.881190000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 46, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-d02eda03618282444c3c5bfa", "kind": "identity", "frame_number": 1132, "timestamp_epoch": "1641571503.881378000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 46, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-e46d99e3b55727ffeb13e089", "kind": "identity", "frame_number": 1134, "timestamp_epoch": "1641571504.816487000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-37138c06cd87779c8797a1ed", "kind": "identity", "frame_number": 1135, "timestamp_epoch": "1641571504.816704000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-b54dc2ea8737bfb7fad61b4b", "kind": "identity", "frame_number": 1136, "timestamp_epoch": "1641571504.816900000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-29e71832ea5cef507d6f790c", "kind": "identity", "frame_number": 1137, "timestamp_epoch": "1641571504.817074000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-19df9d04109f6a017db76916", "kind": "identity", "frame_number": 1277, "timestamp_epoch": "1641571552.678965000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 59, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9", "kerberos.msg_type": "14" } }, { "event_id": "evt-992d3340f12c62fccbf17dc7", "kind": "identity", "frame_number": 1279, "timestamp_epoch": "1641571552.679938000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 59, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26", "kerberos.msg_type": "15" } }, { "event_id": "evt-039d2b82fb50d35c675de94e", "kind": "identity", "frame_number": 1280, "timestamp_epoch": "1641571552.680438000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 59, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9", "kerberos.msg_type": "15" } }, { "event_id": "evt-195da331e46740841f3e1f76", "kind": "identity", "frame_number": 1304, "timestamp_epoch": "1641571552.691378000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 60, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9", "kerberos.msg_type": "14" } }, { "event_id": "evt-6bb847ecd8f242c9dadcfc3b", "kind": "identity", "frame_number": 1306, "timestamp_epoch": "1641571552.692352000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 60, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26", "kerberos.msg_type": "15" } }, { "event_id": "evt-f2d201182e1b96ed77865967", "kind": "identity", "frame_number": 1317, "timestamp_epoch": "1641571552.697751000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 61, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9", "kerberos.msg_type": "14" } }, { "event_id": "evt-e3dbcfe42f0c544d00bbaac1", "kind": "identity", "frame_number": 1319, "timestamp_epoch": "1641571552.698593000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 61, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26", "kerberos.msg_type": "15" } }, { "event_id": "evt-fcf7e9678088ec486ee0fb39", "kind": "identity", "frame_number": 1340, "timestamp_epoch": "1641571569.193326000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.1", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 9, "fields": { "eth.dst": "1c:17:d3:f6:df:0a", "eth.src": "9c:5c:8e:32:58:f9", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.name": "DESKTOP-GXNYNO2<20>,DESKTOP-GXNYNO2<20> (Server service)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-f18f1a013cca0939f323b671", "kind": "identity", "frame_number": 1341, "timestamp_epoch": "1641571570.709379000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.1", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 9, "fields": { "eth.dst": "1c:17:d3:f6:df:0a", "eth.src": "9c:5c:8e:32:58:f9", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.name": "DESKTOP-GXNYNO2<20>,DESKTOP-GXNYNO2<20> (Server service)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-89268163f7f363ab13a16898", "kind": "identity", "frame_number": 1346, "timestamp_epoch": "1641571572.239888000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.1", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 9, "fields": { "eth.dst": "1c:17:d3:f6:df:0a", "eth.src": "9c:5c:8e:32:58:f9", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.name": "DESKTOP-GXNYNO2<20>,DESKTOP-GXNYNO2<20> (Server service)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-3d9017f989fa4848893f55b5", "kind": "identity", "frame_number": 1420, "timestamp_epoch": "1641571624.460651000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-77706f47d66ee2b6568e48f2", "kind": "identity", "frame_number": 1421, "timestamp_epoch": "1641571624.461268000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-4ee87e59bd7c53bc6e5fa677", "kind": "identity", "frame_number": 1422, "timestamp_epoch": "1641571624.461665000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-ee58f9c35b32c6d18f4ca5cf", "kind": "identity", "frame_number": 1423, "timestamp_epoch": "1641571624.462087000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-b5e115155901fa1f1a880859", "kind": "identity", "frame_number": 1424, "timestamp_epoch": "1641571624.462465000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-9f8e09b276278c4719bfb339", "kind": "identity", "frame_number": 1425, "timestamp_epoch": "1641571624.462821000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-b32eb3dd0b34130b016d7543", "kind": "identity", "frame_number": 1426, "timestamp_epoch": "1641571624.463197000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-d0d70ef979110ba972758898", "kind": "identity", "frame_number": 1427, "timestamp_epoch": "1641571624.463652000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-e6b1f9a7bdd55ed22076e599", "kind": "identity", "frame_number": 1490, "timestamp_epoch": "1641571635.304061000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-394ccf6961d6b220f8cd60da", "kind": "identity", "frame_number": 1491, "timestamp_epoch": "1641571635.304293000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-2fbf660bee4c1e43b1e66bf5", "kind": "identity", "frame_number": 1492, "timestamp_epoch": "1641571635.304542000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-82cd437eb6cb29d215677b1a", "kind": "identity", "frame_number": 1493, "timestamp_epoch": "1641571635.304713000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-3880eb6edc1a66ebc14199d6", "kind": "identity", "frame_number": 1495, "timestamp_epoch": "1641571650.431040000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 46, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-4369b243d06290cf938a5914", "kind": "identity", "frame_number": 1496, "timestamp_epoch": "1641571650.431400000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 46, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-1e56ee9747284f86f4f2d503", "kind": "identity", "frame_number": 4835, "timestamp_epoch": "1641571689.196902000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.1", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 9, "fields": { "eth.dst": "1c:17:d3:f6:df:0a", "eth.src": "9c:5c:8e:32:58:f9", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.name": "DESKTOP-GXNYNO2<20>,DESKTOP-GXNYNO2<20> (Server service)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-6eaf52d54ad297856c918fec", "kind": "identity", "frame_number": 4836, "timestamp_epoch": "1641571690.711673000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.1", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 9, "fields": { "eth.dst": "1c:17:d3:f6:df:0a", "eth.src": "9c:5c:8e:32:58:f9", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.name": "DESKTOP-GXNYNO2<20>,DESKTOP-GXNYNO2<20> (Server service)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-029199e52d7ce712ca3eac66", "kind": "identity", "frame_number": 4837, "timestamp_epoch": "1641571692.212273000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.1", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 9, "fields": { "eth.dst": "1c:17:d3:f6:df:0a", "eth.src": "9c:5c:8e:32:58:f9", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.name": "DESKTOP-GXNYNO2<20>,DESKTOP-GXNYNO2<20> (Server service)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-b4b9f28fcd9399057999a257", "kind": "identity", "frame_number": 4879, "timestamp_epoch": "1641571809.215268000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.1", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 9, "fields": { "eth.dst": "1c:17:d3:f6:df:0a", "eth.src": "9c:5c:8e:32:58:f9", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.name": "DESKTOP-GXNYNO2<20>,DESKTOP-GXNYNO2<20> (Server service)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-64735514205e9d475959b290", "kind": "identity", "frame_number": 4880, "timestamp_epoch": "1641571810.715658000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.1", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 9, "fields": { "eth.dst": "1c:17:d3:f6:df:0a", "eth.src": "9c:5c:8e:32:58:f9", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.name": "DESKTOP-GXNYNO2<20>,DESKTOP-GXNYNO2<20> (Server service)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-879edd611ccf65cafa869e3d", "kind": "identity", "frame_number": 4881, "timestamp_epoch": "1641571812.277158000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.1", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 9, "fields": { "eth.dst": "1c:17:d3:f6:df:0a", "eth.src": "9c:5c:8e:32:58:f9", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.name": "DESKTOP-GXNYNO2<20>,DESKTOP-GXNYNO2<20> (Server service)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-9ba205a37f8bb7a0f203d085", "kind": "identity", "frame_number": 4893, "timestamp_epoch": "1641571929.233802000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.1", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 9, "fields": { "eth.dst": "1c:17:d3:f6:df:0a", "eth.src": "9c:5c:8e:32:58:f9", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.name": "DESKTOP-GXNYNO2<20>,DESKTOP-GXNYNO2<20> (Server service)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-e098209bb6f3176d453d3265", "kind": "identity", "frame_number": 4894, "timestamp_epoch": "1641571930.749279000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.1", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 9, "fields": { "eth.dst": "1c:17:d3:f6:df:0a", "eth.src": "9c:5c:8e:32:58:f9", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.name": "DESKTOP-GXNYNO2<20>,DESKTOP-GXNYNO2<20> (Server service)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-ee88567b51f6a8a39374edd1", "kind": "identity", "frame_number": 4895, "timestamp_epoch": "1641571932.312303000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.1", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 9, "fields": { "eth.dst": "1c:17:d3:f6:df:0a", "eth.src": "9c:5c:8e:32:58:f9", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.name": "DESKTOP-GXNYNO2<20>,DESKTOP-GXNYNO2<20> (Server service)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-b0cd178c682160310893e67c", "kind": "identity", "frame_number": 4898, "timestamp_epoch": "1641571941.773819000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 32, "fields": { "browser.server": "DESKTOP-GXMYNO2", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-cb7ceae0f5b0db8679cbe1e7", "kind": "identity", "frame_number": 4903, "timestamp_epoch": "1641572049.236933000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.1", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 9, "fields": { "eth.dst": "1c:17:d3:f6:df:0a", "eth.src": "9c:5c:8e:32:58:f9", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.name": "DESKTOP-GXNYNO2<20>,DESKTOP-GXNYNO2<20> (Server service)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-cd3276c85fe46e943fd72344", "kind": "identity", "frame_number": 4904, "timestamp_epoch": "1641572050.158508000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 46, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-bc87f8a9c0c89a83d16e1841", "kind": "identity", "frame_number": 4905, "timestamp_epoch": "1641572050.158960000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 46, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-081b2b393575d7bf0bb4ff60", "kind": "identity", "frame_number": 4907, "timestamp_epoch": "1641572050.751618000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.1", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 9, "fields": { "eth.dst": "1c:17:d3:f6:df:0a", "eth.src": "9c:5c:8e:32:58:f9", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.name": "DESKTOP-GXNYNO2<20>,DESKTOP-GXNYNO2<20> (Server service)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-35e46d38482b28809b677a76", "kind": "identity", "frame_number": 4935, "timestamp_epoch": "1641572052.251683000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.1", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 9, "fields": { "eth.dst": "1c:17:d3:f6:df:0a", "eth.src": "9c:5c:8e:32:58:f9", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.name": "DESKTOP-GXNYNO2<20>,DESKTOP-GXNYNO2<20> (Server service)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-351b8972da00e6a0c0593679", "kind": "identity", "frame_number": 5789, "timestamp_epoch": "1641572165.411535000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 32, "fields": { "browser.response_computer_name": "DESKTOP-GXMYNO2", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-e842aede88336adf27bcc1c0", "kind": "identity", "frame_number": 5790, "timestamp_epoch": "1641572165.421509000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.1", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 9, "fields": { "eth.dst": "1c:17:d3:f6:df:0a", "eth.src": "9c:5c:8e:32:58:f9", "nbns.flags.opcode": "0", "nbns.flags.response": "False", "nbns.name": "SPOONWATCH-DC<20>" } }, { "event_id": "evt-4b708891dc7a5a258e5b5b66", "kind": "identity", "frame_number": 5791, "timestamp_epoch": "1641572166.911092000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.1", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 9, "fields": { "eth.dst": "1c:17:d3:f6:df:0a", "eth.src": "9c:5c:8e:32:58:f9", "nbns.flags.opcode": "0", "nbns.flags.response": "False", "nbns.name": "SPOONWATCH-DC<20>" } }, { "event_id": "evt-61ea0072ff2ee986a9bafa57", "kind": "identity", "frame_number": 5792, "timestamp_epoch": "1641572168.411669000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.1", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 9, "fields": { "eth.dst": "1c:17:d3:f6:df:0a", "eth.src": "9c:5c:8e:32:58:f9", "nbns.flags.opcode": "0", "nbns.flags.response": "False", "nbns.name": "SPOONWATCH-DC<20>" } }, { "event_id": "evt-2a2674b70b81de8b13df5b31", "kind": "identity", "frame_number": 5793, "timestamp_epoch": "1641572169.254634000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.1", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 9, "fields": { "eth.dst": "1c:17:d3:f6:df:0a", "eth.src": "9c:5c:8e:32:58:f9", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.name": "DESKTOP-GXNYNO2<20>,DESKTOP-GXNYNO2<20> (Server service)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-1ec048020a7b845c05e3ea65", "kind": "identity", "frame_number": 5794, "timestamp_epoch": "1641572169.958331000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 31, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "9c:5c:8e:32:58:f9", "nbns.flags.opcode": "0", "nbns.flags.response": "False", "nbns.name": "SPOONWATCH-DC<20>" } }, { "event_id": "evt-4d43138f1a6d852334542cc7", "kind": "identity", "frame_number": 5795, "timestamp_epoch": "1641572169.958741000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 68, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26", "nbns.flags.opcode": "0", "nbns.flags.response": "True", "nbns.name": "SPOONWATCH-DC<20> (Server service)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-7fe1a361d6a8bf5da69e209c", "kind": "identity", "frame_number": 5802, "timestamp_epoch": "1641572169.962018000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 84, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-e6aca420872a37908c4fcf12", "kind": "identity", "frame_number": 5803, "timestamp_epoch": "1641572169.962611000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 84, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-a5c5cda4a4ac336d2b1d65b6", "kind": "identity", "frame_number": 5804, "timestamp_epoch": "1641572169.963306000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 84, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9", "ntlmssp.auth.domain": "NULL", "ntlmssp.auth.hostname": "DESKTOP-GXMYNO2", "ntlmssp.auth.username": "NULL" } }, { "event_id": "evt-8453c651c8b84a2f6482ed84", "kind": "identity", "frame_number": 5810, "timestamp_epoch": "1641572169.966188000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 32, "fields": { "browser.response_computer_name": "DESKTOP-GXMYNO2", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-06648f718ea4e3d3044512bd", "kind": "identity", "frame_number": 5813, "timestamp_epoch": "1641572169.974570000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 32, "fields": { "browser.response_computer_name": "DESKTOP-GXMYNO2", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-3893d6074b920c67995480c4", "kind": "identity", "frame_number": 5819, "timestamp_epoch": "1641572170.770277000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.1", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 9, "fields": { "eth.dst": "1c:17:d3:f6:df:0a", "eth.src": "9c:5c:8e:32:58:f9", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.name": "DESKTOP-GXNYNO2<20>,DESKTOP-GXNYNO2<20> (Server service)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-b22e3a2d052858b22c56f36a", "kind": "identity", "frame_number": 5850, "timestamp_epoch": "1641572172.271420000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.1", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 9, "fields": { "eth.dst": "1c:17:d3:f6:df:0a", "eth.src": "9c:5c:8e:32:58:f9", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.name": "DESKTOP-GXNYNO2<20>,DESKTOP-GXNYNO2<20> (Server service)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-79b8f4735c3fe000fb7b9771", "kind": "identity", "frame_number": 5868, "timestamp_epoch": "1641572199.979554000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 86, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-37a7502602dc32154c04b40a", "kind": "identity", "frame_number": 5869, "timestamp_epoch": "1641572199.980083000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 86, "udp_stream": null, "fields": { "eth.dst": "9c:5c:8e:32:58:f9", "eth.src": "20:47:47:62:ae:26" } }, { "event_id": "evt-392efd09b8aa70c3d76f8993", "kind": "identity", "frame_number": 5870, "timestamp_epoch": "1641572199.980643000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 86, "udp_stream": null, "fields": { "eth.dst": "20:47:47:62:ae:26", "eth.src": "9c:5c:8e:32:58:f9", "ntlmssp.auth.domain": "NULL", "ntlmssp.auth.hostname": "DESKTOP-GXMYNO2", "ntlmssp.auth.username": "NULL" } }, { "event_id": "evt-f789e6cc051df26624829fe2", "kind": "identity", "frame_number": 5876, "timestamp_epoch": "1641572199.983522000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 32, "fields": { "browser.response_computer_name": "DESKTOP-GXMYNO2", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "9c:5c:8e:32:58:f9" } }, { "event_id": "evt-47c1792ba94a62a353c974ee", "kind": "identity", "frame_number": 5879, "timestamp_epoch": "1641572199.992120000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 32, "fields": { "browser.response_computer_name": "DESKTOP-GXMYNO2", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "9c:5c:8e:32:58:f9" } } ], "directory_service": [ { "event_id": "evt-9c98f2ec441d43638f94c7ec", "kind": "directory_service", "frame_number": 27, "timestamp_epoch": "1641571449.760632000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 0, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-037cc7e4b42e94824b1a82a3", "kind": "directory_service", "frame_number": 29, "timestamp_epoch": "1641571449.760917000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 0, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-b2609fa6b065ca8c40d8c209", "kind": "directory_service", "frame_number": 189, "timestamp_epoch": "1641571450.989411000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 15, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-20f1e3ee2c6f3e2ff81e3063", "kind": "directory_service", "frame_number": 191, "timestamp_epoch": "1641571450.989667000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 15, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-96ad98f4e0333b1a6c381b83", "kind": "directory_service", "frame_number": 210, "timestamp_epoch": "1641571450.992655000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 15, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-3f34bae8b55bb2c98832d0bb", "kind": "directory_service", "frame_number": 213, "timestamp_epoch": "1641571450.993333000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 15, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-e65914d4cfc6f20bfefe0e67", "kind": "directory_service", "frame_number": 218, "timestamp_epoch": "1641571450.994306000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 15, "udp_stream": null, "fields": {} }, { "event_id": "evt-26712cc15fcc8ba0f655adc7", "kind": "directory_service", "frame_number": 219, "timestamp_epoch": "1641571450.994494000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 15, "udp_stream": null, "fields": {} }, { "event_id": "evt-843733ebc24b09f05551693a", "kind": "directory_service", "frame_number": 220, "timestamp_epoch": "1641571450.995080000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 15, "udp_stream": null, "fields": {} }, { "event_id": "evt-d3d64cb2a4a66fe8bdd485d2", "kind": "directory_service", "frame_number": 221, "timestamp_epoch": "1641571450.995376000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 15, "udp_stream": null, "fields": {} }, { "event_id": "evt-234af896122baed5918d47b9", "kind": "directory_service", "frame_number": 241, "timestamp_epoch": "1641571451.003468000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 6, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-0928ef6f28e53593683cbb9e", "kind": "directory_service", "frame_number": 246, "timestamp_epoch": "1641571451.003845000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 6, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-da6bb9b3a212fbeb93f34805", "kind": "directory_service", "frame_number": 251, "timestamp_epoch": "1641571451.004195000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 6, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-0d0b14c6d6a02ef568379183", "kind": "directory_service", "frame_number": 252, "timestamp_epoch": "1641571451.004462000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-56426d7262cd370324620f70", "kind": "directory_service", "frame_number": 253, "timestamp_epoch": "1641571451.004569000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 6, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-6407ca15e4445fa1ac36b14f", "kind": "directory_service", "frame_number": 254, "timestamp_epoch": "1641571451.004734000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-820c35e5ed65a3b2505f2c31", "kind": "directory_service", "frame_number": 255, "timestamp_epoch": "1641571451.004759000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 6, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-c8689e2981f89b4096baeb48", "kind": "directory_service", "frame_number": 256, "timestamp_epoch": "1641571451.005062000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-565b80b8e17af0960ff51f7c", "kind": "directory_service", "frame_number": 257, "timestamp_epoch": "1641571451.005072000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 6, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-71afcdf9739b083d6cec5f7e", "kind": "directory_service", "frame_number": 259, "timestamp_epoch": "1641571451.005120000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 0, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-226e6b09a1a425384684d12b", "kind": "directory_service", "frame_number": 261, "timestamp_epoch": "1641571451.005293000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 6, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-8dcf531479d614850d9de95f", "kind": "directory_service", "frame_number": 262, "timestamp_epoch": "1641571451.005520000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 6, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-5d7e401eac32c32f9ebdf443", "kind": "directory_service", "frame_number": 263, "timestamp_epoch": "1641571451.005596000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-74e8244323e0a8708ecb744c", "kind": "directory_service", "frame_number": 264, "timestamp_epoch": "1641571451.005796000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-066e717906b7cbf0166e4001", "kind": "directory_service", "frame_number": 265, "timestamp_epoch": "1641571451.005981000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-8ae27f4a9cc1c0db4ee77ad8", "kind": "directory_service", "frame_number": 266, "timestamp_epoch": "1641571451.006109000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 0, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-67062a00df26298105ba6973", "kind": "directory_service", "frame_number": 274, "timestamp_epoch": "1641571451.007930000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 0, "udp_stream": null, "fields": { "ldap.protocolOp": "2" } }, { "event_id": "evt-a1f8f2620dafa0426e70fb4e", "kind": "directory_service", "frame_number": 279, "timestamp_epoch": "1641571451.008528000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 6, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-0c21fdedaf8ff43bd0b0add8", "kind": "directory_service", "frame_number": 280, "timestamp_epoch": "1641571451.008749000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 6, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-1026ddb63cfd368c10546e62", "kind": "directory_service", "frame_number": 283, "timestamp_epoch": "1641571451.011418000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 6, "udp_stream": null, "fields": { "drsuapi.opnum": "30" } }, { "event_id": "evt-a9e17789589a9b7c732d0ddf", "kind": "directory_service", "frame_number": 284, "timestamp_epoch": "1641571451.011706000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 6, "udp_stream": null, "fields": { "drsuapi.opnum": "30" } }, { "event_id": "evt-1fb141c10e2de4ef9205a3a0", "kind": "directory_service", "frame_number": 285, "timestamp_epoch": "1641571451.013823000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 6, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-441db70fb074d891d29f826d", "kind": "directory_service", "frame_number": 286, "timestamp_epoch": "1641571451.014021000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 6, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-8823a4677abb01f0c559920a", "kind": "directory_service", "frame_number": 329, "timestamp_epoch": "1641571451.128651000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-416c81cccfa8b18660519979", "kind": "directory_service", "frame_number": 330, "timestamp_epoch": "1641571451.128893000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-e5a026130d858f9c22eb5308", "kind": "directory_service", "frame_number": 331, "timestamp_epoch": "1641571451.129114000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "drsuapi.opnum": "13" } }, { "event_id": "evt-7e1779c3a2c03b45e4740b82", "kind": "directory_service", "frame_number": 333, "timestamp_epoch": "1641571451.129551000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 15, "udp_stream": null, "fields": {} }, { "event_id": "evt-244905905640902e9e3a8c2a", "kind": "directory_service", "frame_number": 336, "timestamp_epoch": "1641571451.129832000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 15, "udp_stream": null, "fields": {} }, { "event_id": "evt-6f2a956a7f32dbec63ced32b", "kind": "directory_service", "frame_number": 337, "timestamp_epoch": "1641571451.129893000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "drsuapi.opnum": "13" } }, { "event_id": "evt-95499f27ad9a94ea004840d5", "kind": "directory_service", "frame_number": 338, "timestamp_epoch": "1641571451.130065000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "drsuapi.opnum": "13" } }, { "event_id": "evt-4b9fa163f7f2ef78617cc0b5", "kind": "directory_service", "frame_number": 339, "timestamp_epoch": "1641571451.130453000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "drsuapi.opnum": "13" } }, { "event_id": "evt-366d13531246f485104c75c7", "kind": "directory_service", "frame_number": 340, "timestamp_epoch": "1641571451.130682000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-2c9f850f18ed2b87271568cd", "kind": "directory_service", "frame_number": 341, "timestamp_epoch": "1641571451.130833000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-83ab893da6b8301c0e5d0617", "kind": "directory_service", "frame_number": 354, "timestamp_epoch": "1641571451.296482000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 15, "udp_stream": null, "fields": {} }, { "event_id": "evt-190acd95457446f55c0c7050", "kind": "directory_service", "frame_number": 357, "timestamp_epoch": "1641571451.296908000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 15, "udp_stream": null, "fields": {} }, { "event_id": "evt-69b793110164786a11888a39", "kind": "directory_service", "frame_number": 370, "timestamp_epoch": "1641571451.429300000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 15, "udp_stream": null, "fields": {} }, { "event_id": "evt-682b093928322980626bc252", "kind": "directory_service", "frame_number": 373, "timestamp_epoch": "1641571451.429677000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 15, "udp_stream": null, "fields": {} }, { "event_id": "evt-eae0d983c574a9881cab938e", "kind": "directory_service", "frame_number": 379, "timestamp_epoch": "1641571451.460400000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 15, "udp_stream": null, "fields": {} }, { "event_id": "evt-0d00107728c1a23745a89699", "kind": "directory_service", "frame_number": 382, "timestamp_epoch": "1641571451.460801000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 15, "udp_stream": null, "fields": {} }, { "event_id": "evt-63344a2115ec98835498fc72", "kind": "directory_service", "frame_number": 383, "timestamp_epoch": "1641571451.461512000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 15, "udp_stream": null, "fields": {} }, { "event_id": "evt-4eae908059a1067566459fbf", "kind": "directory_service", "frame_number": 384, "timestamp_epoch": "1641571451.461821000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 15, "udp_stream": null, "fields": {} }, { "event_id": "evt-c72d233d2561bbe27d0258b3", "kind": "directory_service", "frame_number": 385, "timestamp_epoch": "1641571451.462109000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 15, "udp_stream": null, "fields": {} }, { "event_id": "evt-043e7caae825616b03065f4d", "kind": "directory_service", "frame_number": 399, "timestamp_epoch": "1641571452.071100000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 25, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-a96c6eec4ff97a308ea45d13", "kind": "directory_service", "frame_number": 401, "timestamp_epoch": "1641571452.071453000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 25, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-220a368799269198774fc9fe", "kind": "directory_service", "frame_number": 404, "timestamp_epoch": "1641571452.073024000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 25, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-c0b2df792612c004a4a37270", "kind": "directory_service", "frame_number": 406, "timestamp_epoch": "1641571452.073968000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 25, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-fd0e685736dfbc47543a59ee", "kind": "directory_service", "frame_number": 421, "timestamp_epoch": "1641571452.364742000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 25, "udp_stream": null, "fields": { "ldap.baseObject": "DC=spoonwatch,DC=net", "ldap.filter": "1", "ldap.protocolOp": "3" } }, { "event_id": "evt-08c1ae2b79988d304c49fead", "kind": "directory_service", "frame_number": 422, "timestamp_epoch": "1641571452.365154000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 25, "udp_stream": null, "fields": { "ldap.protocolOp": "4,19,19,19,5" } }, { "event_id": "evt-eda9a0e01eced0d4c7c44662", "kind": "directory_service", "frame_number": 427, "timestamp_epoch": "1641571452.367990000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 27, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-073927b557a211bd4cb59d1c", "kind": "directory_service", "frame_number": 429, "timestamp_epoch": "1641571452.369088000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 27, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-972b5ac330c03fdc78ac8572", "kind": "directory_service", "frame_number": 430, "timestamp_epoch": "1641571452.369578000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 27, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-724adeb105e18030f5da4a7c", "kind": "directory_service", "frame_number": 431, "timestamp_epoch": "1641571452.369795000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 27, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-9da25768e1737d3772cff8e6", "kind": "directory_service", "frame_number": 432, "timestamp_epoch": "1641571452.370081000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 27, "udp_stream": null, "fields": { "ldap.baseObject": "CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=spoonwatch,DC=net", "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-c8f61fa2ec0cd5a7b1d1eb41", "kind": "directory_service", "frame_number": 433, "timestamp_epoch": "1641571452.370428000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 27, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-81811bc9b4665c04c6a8fe1f", "kind": "directory_service", "frame_number": 434, "timestamp_epoch": "1641571452.371397000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 25, "udp_stream": null, "fields": { "ldap.baseObject": "cn=policies,cn=system,DC=spoonwatch,DC=net", "ldap.filter": "0", "ldap.protocolOp": "3" } }, { "event_id": "evt-eec1ff28a883b3bd62b3460f", "kind": "directory_service", "frame_number": 435, "timestamp_epoch": "1641571452.371863000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 25, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-71c70c722810fa2ba75b483d", "kind": "directory_service", "frame_number": 586, "timestamp_epoch": "1641571452.658399000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 27, "udp_stream": null, "fields": { "ldap.protocolOp": "2" } }, { "event_id": "evt-1f0c8529ad06d762c3748830", "kind": "directory_service", "frame_number": 591, "timestamp_epoch": "1641571452.719218000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 25, "udp_stream": null, "fields": { "ldap.protocolOp": "2" } }, { "event_id": "evt-abf1f3cc582d978731617fb4", "kind": "directory_service", "frame_number": 621, "timestamp_epoch": "1641571454.554962000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 31, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-bc76787309bb862531a38c23", "kind": "directory_service", "frame_number": 622, "timestamp_epoch": "1641571454.555556000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 31, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-fa6259ac3ac780199cbe39a7", "kind": "directory_service", "frame_number": 623, "timestamp_epoch": "1641571454.556207000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 31, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-877221b05d3d663d546ae22c", "kind": "directory_service", "frame_number": 624, "timestamp_epoch": "1641571454.556869000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 31, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-8e8bd6723bab5495a0d80703", "kind": "directory_service", "frame_number": 625, "timestamp_epoch": "1641571454.557228000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 31, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-fd3f6437fda5836b7d256ea6", "kind": "directory_service", "frame_number": 626, "timestamp_epoch": "1641571454.557533000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 31, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-cff7af82c7cc31b6eaf1e242", "kind": "directory_service", "frame_number": 629, "timestamp_epoch": "1641571454.559129000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 31, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-f1252838925a9da76e6d03c0", "kind": "directory_service", "frame_number": 630, "timestamp_epoch": "1641571454.559408000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 31, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-12b8979ad3e1639d17d5ee42", "kind": "directory_service", "frame_number": 631, "timestamp_epoch": "1641571454.559666000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 31, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-ed12f79f255f2a265306045e", "kind": "directory_service", "frame_number": 632, "timestamp_epoch": "1641571454.559994000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 31, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-4c942c80749128381bb527bc", "kind": "directory_service", "frame_number": 633, "timestamp_epoch": "1641571454.560505000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 31, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-987d20095b86019b77ef60f9", "kind": "directory_service", "frame_number": 634, "timestamp_epoch": "1641571454.560773000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 31, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-c4476c7a02600ba10ea82bc7", "kind": "directory_service", "frame_number": 638, "timestamp_epoch": "1641571454.564967000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 32, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-27e432f6fc91c1baf489713a", "kind": "directory_service", "frame_number": 640, "timestamp_epoch": "1641571454.565359000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 32, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-79d83d4c62b9fcef05d6e634", "kind": "directory_service", "frame_number": 643, "timestamp_epoch": "1641571454.566408000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 32, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-c7e281f5b89ebf5748991783", "kind": "directory_service", "frame_number": 645, "timestamp_epoch": "1641571454.567281000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 32, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-91878f400affa9b436294b66", "kind": "directory_service", "frame_number": 646, "timestamp_epoch": "1641571454.567691000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 32, "udp_stream": null, "fields": { "ldap.baseObject": "CN=DESKTOP-GXMYNO2,CN=Computers,DC=spoonwatch,DC=net", "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-d53da90f473dbc26de4fc663", "kind": "directory_service", "frame_number": 647, "timestamp_epoch": "1641571454.568025000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 32, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-1dc9f24321bc894e069421c6", "kind": "directory_service", "frame_number": 648, "timestamp_epoch": "1641571454.568306000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 32, "udp_stream": null, "fields": { "ldap.baseObject": "CN=DESKTOP-GXMYNO2,CN=Computers,DC=spoonwatch,DC=net", "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-76ac4410ee7ac138fca97f10", "kind": "directory_service", "frame_number": 649, "timestamp_epoch": "1641571454.568648000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 32, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-bbdc99ecc59dce2c76b3634a", "kind": "directory_service", "frame_number": 650, "timestamp_epoch": "1641571454.568981000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 32, "udp_stream": null, "fields": { "ldap.baseObject": "CN=DESKTOP-GXMYNO2,CN=Computers,DC=spoonwatch,DC=net", "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-306fa47c19aef1584a46b303", "kind": "directory_service", "frame_number": 651, "timestamp_epoch": "1641571454.569313000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 32, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-add7f67c3d2185d6e3cc049b", "kind": "directory_service", "frame_number": 656, "timestamp_epoch": "1641571454.574377000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 33, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-cefebf2c0e1c53984e60413e", "kind": "directory_service", "frame_number": 658, "timestamp_epoch": "1641571454.575321000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 33, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-106bab2380da8ec06952949d", "kind": "directory_service", "frame_number": 659, "timestamp_epoch": "1641571454.576382000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 33, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-4b7c733e1310f1aa075f563f", "kind": "directory_service", "frame_number": 662, "timestamp_epoch": "1641571454.576692000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 33, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-26d0039ae7c4a21389e909de", "kind": "directory_service", "frame_number": 664, "timestamp_epoch": "1641571454.577162000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 33, "udp_stream": null, "fields": { "ldap.baseObject": "CN=62a0ff2e-97b9-4513-943f-0d221bd30080,CN=Device Registration Configuration,CN=services,CN=Configuration,DC=spoonwatch,DC=net", "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-1d69bb23ed7a7ad62a3a92d9", "kind": "directory_service", "frame_number": 665, "timestamp_epoch": "1641571454.577451000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 33, "udp_stream": null, "fields": { "ldap.protocolOp": "5" } }, { "event_id": "evt-4f93cafbbd615915206d5eb5", "kind": "directory_service", "frame_number": 666, "timestamp_epoch": "1641571454.577816000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 33, "udp_stream": null, "fields": { "ldap.protocolOp": "2" } }, { "event_id": "evt-b70aba28de9e08e77800bb0c", "kind": "directory_service", "frame_number": 670, "timestamp_epoch": "1641571454.578524000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 32, "udp_stream": null, "fields": { "ldap.protocolOp": "2" } }, { "event_id": "evt-c090cdbeb9e201a4817d6a3c", "kind": "directory_service", "frame_number": 704, "timestamp_epoch": "1641571460.156613000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 34, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-c6557f114b8115f910fb39f7", "kind": "directory_service", "frame_number": 706, "timestamp_epoch": "1641571460.157120000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 34, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-a3a47f5c0f2f90cd0e041d27", "kind": "directory_service", "frame_number": 709, "timestamp_epoch": "1641571460.158393000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 34, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-a8bbc7e249348fdac9a9eaaf", "kind": "directory_service", "frame_number": 711, "timestamp_epoch": "1641571460.159345000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 34, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-a98ef54346ed2dd2c7f7ab74", "kind": "directory_service", "frame_number": 712, "timestamp_epoch": "1641571460.161773000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 34, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-eea625bd0651edde431d708b", "kind": "directory_service", "frame_number": 713, "timestamp_epoch": "1641571460.162077000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 34, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-eef816374f1d16c8e2b9565b", "kind": "directory_service", "frame_number": 714, "timestamp_epoch": "1641571460.162404000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 34, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-46be2b53ff4787f0222da5be", "kind": "directory_service", "frame_number": 715, "timestamp_epoch": "1641571460.162667000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 34, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-0bf34f42344dbbcd8e9ccc1b", "kind": "directory_service", "frame_number": 716, "timestamp_epoch": "1641571460.162900000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 34, "udp_stream": null, "fields": { "ldap.baseObject": "CN=NTDS Settings,CN=SPOONWATCH-DC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=spoonwatch,DC=net", "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-bd0a371742a8235d93b1ca2b", "kind": "directory_service", "frame_number": 717, "timestamp_epoch": "1641571460.163177000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 34, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-f1c67ecebc2b4b942198bac4", "kind": "directory_service", "frame_number": 718, "timestamp_epoch": "1641571460.163374000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 34, "udp_stream": null, "fields": { "ldap.baseObject": "CN=Public Key Services,CN=Services,CN=Configuration,DC=spoonwatch,DC=net", "ldap.filter": "3", "ldap.protocolOp": "3" } }, { "event_id": "evt-e567e30a72ec6c67a75f898b", "kind": "directory_service", "frame_number": 719, "timestamp_epoch": "1641571460.163665000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 34, "udp_stream": null, "fields": { "ldap.protocolOp": "5" } }, { "event_id": "evt-709aa11febe41f82eba300ab", "kind": "directory_service", "frame_number": 720, "timestamp_epoch": "1641571460.163945000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 34, "udp_stream": null, "fields": { "ldap.baseObject": "CN=OID,CN=Public Key Services,CN=Services,CN=Configuration,DC=spoonwatch,DC=net", "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-29ac610165b8fa527f0a6f11", "kind": "directory_service", "frame_number": 721, "timestamp_epoch": "1641571460.164190000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 34, "udp_stream": null, "fields": { "ldap.protocolOp": "5" } }, { "event_id": "evt-b427f1d8f02700b67fa520f7", "kind": "directory_service", "frame_number": 752, "timestamp_epoch": "1641571460.176928000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 34, "udp_stream": null, "fields": { "ldap.protocolOp": "2" } }, { "event_id": "evt-5be6652ad7e9d4a03a369f78", "kind": "directory_service", "frame_number": 902, "timestamp_epoch": "1641571491.751061000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-6ea468c8f5d6543af7447ed9", "kind": "directory_service", "frame_number": 903, "timestamp_epoch": "1641571491.751288000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-0eeebeb94e68eb7f0fcaf96a", "kind": "directory_service", "frame_number": 904, "timestamp_epoch": "1641571491.751508000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-b00128f5b1d9439291d5d9c2", "kind": "directory_service", "frame_number": 905, "timestamp_epoch": "1641571491.751833000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-21351bb8c525cd6f469d6db0", "kind": "directory_service", "frame_number": 906, "timestamp_epoch": "1641571491.752019000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-e9bda434421935225b5f3ae6", "kind": "directory_service", "frame_number": 907, "timestamp_epoch": "1641571491.752292000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-eacfd5acdd235e6c2035b4a4", "kind": "directory_service", "frame_number": 908, "timestamp_epoch": "1641571491.752465000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-6fc3339e17f8873cc2ee2913", "kind": "directory_service", "frame_number": 910, "timestamp_epoch": "1641571491.752713000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-ca4f171f9e021464a12d626c", "kind": "directory_service", "frame_number": 930, "timestamp_epoch": "1641571491.762466000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "samr.opnum": "64" } }, { "event_id": "evt-e8c3deccc57ed3409e235ba8", "kind": "directory_service", "frame_number": 931, "timestamp_epoch": "1641571491.762873000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "samr.opnum": "64" } }, { "event_id": "evt-54998f24c415e3a1d529d499", "kind": "directory_service", "frame_number": 932, "timestamp_epoch": "1641571491.763188000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "samr.opnum": "6" } }, { "event_id": "evt-2d366bcb1acce38c040e6d5c", "kind": "directory_service", "frame_number": 933, "timestamp_epoch": "1641571491.763490000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "samr.opnum": "6" } }, { "event_id": "evt-02d3d6d286e558893f6cb506", "kind": "directory_service", "frame_number": 934, "timestamp_epoch": "1641571491.763726000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "samr.opnum": "5" } }, { "event_id": "evt-a6c61a14014ff109a3ec8a91", "kind": "directory_service", "frame_number": 935, "timestamp_epoch": "1641571491.764023000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "samr.opnum": "5" } }, { "event_id": "evt-391d2a285c3754e5310d24f0", "kind": "directory_service", "frame_number": 936, "timestamp_epoch": "1641571491.764652000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "samr.opnum": "7" } }, { "event_id": "evt-13d094d09de134c117e2fab2", "kind": "directory_service", "frame_number": 937, "timestamp_epoch": "1641571491.765022000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "samr.opnum": "7" } }, { "event_id": "evt-ab14b5d5ce80531dd0d6cf54", "kind": "directory_service", "frame_number": 938, "timestamp_epoch": "1641571491.765254000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "samr.opnum": "7" } }, { "event_id": "evt-4c96f2db0b78ad6722b5c0fd", "kind": "directory_service", "frame_number": 939, "timestamp_epoch": "1641571491.765641000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "samr.opnum": "7" } }, { "event_id": "evt-97198777a4b5ae542d9cd0a7", "kind": "directory_service", "frame_number": 940, "timestamp_epoch": "1641571491.765851000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "samr.opnum": "17" } }, { "event_id": "evt-e96c2e2d60f3d6c8a80b187d", "kind": "directory_service", "frame_number": 941, "timestamp_epoch": "1641571491.766298000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "samr.opnum": "17" } }, { "event_id": "evt-8b7f89c1c3812830920d8f08", "kind": "directory_service", "frame_number": 942, "timestamp_epoch": "1641571491.766518000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "samr.opnum": "34" } }, { "event_id": "evt-24701501964191b35a33ebfc", "kind": "directory_service", "frame_number": 943, "timestamp_epoch": "1641571491.766964000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "samr.opnum": "34" } }, { "event_id": "evt-cf65ba6f5b22b81fa18c3b93", "kind": "directory_service", "frame_number": 944, "timestamp_epoch": "1641571491.767254000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "samr.opnum": "36" } }, { "event_id": "evt-01df182d14e66a168aefa205", "kind": "directory_service", "frame_number": 945, "timestamp_epoch": "1641571491.767646000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "samr.opnum": "36", "samr.samr_UserInfo21.account_name": "steve.smith", "samr.samr_UserInfo21.full_name": "Steve Smith" } }, { "event_id": "evt-6aab6c03c97a17fbfca42565", "kind": "directory_service", "frame_number": 946, "timestamp_epoch": "1641571491.767888000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "samr.opnum": "3" } }, { "event_id": "evt-7a5d593593e09ff796ff4580", "kind": "directory_service", "frame_number": 947, "timestamp_epoch": "1641571491.768351000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "samr.opnum": "3" } }, { "event_id": "evt-09f2e8452736371e3465a306", "kind": "directory_service", "frame_number": 948, "timestamp_epoch": "1641571491.768616000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "samr.opnum": "39" } }, { "event_id": "evt-b4d820c44609ea160365121e", "kind": "directory_service", "frame_number": 949, "timestamp_epoch": "1641571491.769000000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "samr.opnum": "39" } }, { "event_id": "evt-9fadc934efa16becb66cbf41", "kind": "directory_service", "frame_number": 950, "timestamp_epoch": "1641571491.769247000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "samr.opnum": "16" } }, { "event_id": "evt-1f46feb9e7fe9521f3fdbe32", "kind": "directory_service", "frame_number": 951, "timestamp_epoch": "1641571491.769604000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "samr.opnum": "16" } }, { "event_id": "evt-175b0e562998adf8545d1e1c", "kind": "directory_service", "frame_number": 952, "timestamp_epoch": "1641571491.769906000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "samr.opnum": "1" } }, { "event_id": "evt-ebebac0cd11d96af7b0c6d07", "kind": "directory_service", "frame_number": 953, "timestamp_epoch": "1641571491.770231000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "samr.opnum": "1" } }, { "event_id": "evt-9d59e29eecdb5e404b893749", "kind": "directory_service", "frame_number": 954, "timestamp_epoch": "1641571491.770452000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "samr.opnum": "1" } }, { "event_id": "evt-b7265166a1101766c7086453", "kind": "directory_service", "frame_number": 955, "timestamp_epoch": "1641571491.770746000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "samr.opnum": "1" } }, { "event_id": "evt-51717dae727f7aaf6ec88a69", "kind": "directory_service", "frame_number": 956, "timestamp_epoch": "1641571491.770996000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "samr.opnum": "1" } }, { "event_id": "evt-6fe991418f6d98de0572d50c", "kind": "directory_service", "frame_number": 957, "timestamp_epoch": "1641571491.771295000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "samr.opnum": "1" } }, { "event_id": "evt-d2b652a0e2db4d52b0a4132c", "kind": "directory_service", "frame_number": 958, "timestamp_epoch": "1641571491.771531000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "samr.opnum": "1" } }, { "event_id": "evt-a7bc44721e688d1972faef34", "kind": "directory_service", "frame_number": 959, "timestamp_epoch": "1641571491.771855000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "samr.opnum": "1" } }, { "event_id": "evt-0cd61f2cf1977957d0154cda", "kind": "directory_service", "frame_number": 1007, "timestamp_epoch": "1641571492.071286000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 49, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-6bdf446e088bd9bda0151424", "kind": "directory_service", "frame_number": 1009, "timestamp_epoch": "1641571492.072146000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 49, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-4d685bde09ce3b6e70f56eb7", "kind": "directory_service", "frame_number": 1010, "timestamp_epoch": "1641571492.078435000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 49, "udp_stream": null, "fields": { "ldap.baseObject": "DC=spoonwatch,DC=net", "ldap.filter": "1", "ldap.protocolOp": "3" } }, { "event_id": "evt-091c635864d0695a0bdbd207", "kind": "directory_service", "frame_number": 1011, "timestamp_epoch": "1641571492.078889000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 49, "udp_stream": null, "fields": { "ldap.protocolOp": "4,19,19,19,5" } }, { "event_id": "evt-b8d68f76309134cedbac3877", "kind": "directory_service", "frame_number": 1016, "timestamp_epoch": "1641571492.087887000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 50, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-1e8c3ac4189c172352a795e3", "kind": "directory_service", "frame_number": 1018, "timestamp_epoch": "1641571492.088787000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 50, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-37343e9afc73f5549ca1313f", "kind": "directory_service", "frame_number": 1019, "timestamp_epoch": "1641571492.089840000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 50, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-de93823e8490881ee740900a", "kind": "directory_service", "frame_number": 1020, "timestamp_epoch": "1641571492.090063000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 50, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-6db6d5515a542321200b68ef", "kind": "directory_service", "frame_number": 1021, "timestamp_epoch": "1641571492.090311000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 50, "udp_stream": null, "fields": { "ldap.baseObject": "CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=spoonwatch,DC=net", "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-1a7e06d5a4e258d3a2b61c97", "kind": "directory_service", "frame_number": 1022, "timestamp_epoch": "1641571492.090556000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 50, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-0e2487c01633da690e48e941", "kind": "directory_service", "frame_number": 1023, "timestamp_epoch": "1641571492.090801000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 49, "udp_stream": null, "fields": { "ldap.baseObject": "cn=policies,cn=system,DC=spoonwatch,DC=net", "ldap.filter": "0", "ldap.protocolOp": "3" } }, { "event_id": "evt-8a1089cd893f9a770e7cbfef", "kind": "directory_service", "frame_number": 1024, "timestamp_epoch": "1641571492.091320000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 49, "udp_stream": null, "fields": { "ldap.protocolOp": "5" } }, { "event_id": "evt-687ecf9e60e5ae199f6fbff5", "kind": "directory_service", "frame_number": 1027, "timestamp_epoch": "1641571492.410630000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 50, "udp_stream": null, "fields": { "ldap.protocolOp": "2" } }, { "event_id": "evt-8ed129b5773781ca61e19470", "kind": "directory_service", "frame_number": 1031, "timestamp_epoch": "1641571492.418679000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 49, "udp_stream": null, "fields": { "ldap.protocolOp": "2" } }, { "event_id": "evt-f767b051d4b99289b438e837", "kind": "directory_service", "frame_number": 1282, "timestamp_epoch": "1641571552.682757000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 59, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-8588c3dc5f67d65b664b987f", "kind": "directory_service", "frame_number": 1283, "timestamp_epoch": "1641571552.683126000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 59, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-a874748696665f18512c9506", "kind": "directory_service", "frame_number": 1284, "timestamp_epoch": "1641571552.683595000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 59, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-62ab8abeb7bd5bafd84033c1", "kind": "directory_service", "frame_number": 1285, "timestamp_epoch": "1641571552.683986000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 59, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-6b185bc7179ae1a6a5f9808d", "kind": "directory_service", "frame_number": 1286, "timestamp_epoch": "1641571552.684309000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 59, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-818d098052efa41597318ab6", "kind": "directory_service", "frame_number": 1287, "timestamp_epoch": "1641571552.684546000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 59, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-de96ad3c1e056b0b92d95190", "kind": "directory_service", "frame_number": 1290, "timestamp_epoch": "1641571552.686083000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 59, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-685f4c6e99015ffe9e89f236", "kind": "directory_service", "frame_number": 1291, "timestamp_epoch": "1641571552.686361000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 59, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-b2956b1613c76623e0baaab0", "kind": "directory_service", "frame_number": 1292, "timestamp_epoch": "1641571552.686716000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 59, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-30b625b63aab513101c3b2c6", "kind": "directory_service", "frame_number": 1293, "timestamp_epoch": "1641571552.687064000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 59, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-d61872cbdd355400c358edd1", "kind": "directory_service", "frame_number": 1294, "timestamp_epoch": "1641571552.687333000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 59, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-3a357fe840dc31db394ba2fa", "kind": "directory_service", "frame_number": 1295, "timestamp_epoch": "1641571552.687556000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 59, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-740def5d7665fe1f32a225cd", "kind": "directory_service", "frame_number": 1299, "timestamp_epoch": "1641571552.690072000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 60, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-736a99c960ba3d14f2e5fb7c", "kind": "directory_service", "frame_number": 1301, "timestamp_epoch": "1641571552.690387000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 60, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-4b01c4c139c37df09bce3c29", "kind": "directory_service", "frame_number": 1304, "timestamp_epoch": "1641571552.691378000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 60, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-a8f9bfd23196cbd8a2f08288", "kind": "directory_service", "frame_number": 1306, "timestamp_epoch": "1641571552.692352000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 60, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-834b496b8d8e665dc3183c38", "kind": "directory_service", "frame_number": 1307, "timestamp_epoch": "1641571552.692973000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 60, "udp_stream": null, "fields": { "ldap.baseObject": "CN=DESKTOP-GXMYNO2,CN=Computers,DC=spoonwatch,DC=net", "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-c85c2f0d8020e970ecd65afd", "kind": "directory_service", "frame_number": 1308, "timestamp_epoch": "1641571552.693351000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 60, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-ff915fe61d98a352a5aa5a79", "kind": "directory_service", "frame_number": 1309, "timestamp_epoch": "1641571552.693680000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 60, "udp_stream": null, "fields": { "ldap.baseObject": "CN=DESKTOP-GXMYNO2,CN=Computers,DC=spoonwatch,DC=net", "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-89de734333655fbb7651bf12", "kind": "directory_service", "frame_number": 1310, "timestamp_epoch": "1641571552.693923000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 60, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-52f3738d548a5c520e1e1724", "kind": "directory_service", "frame_number": 1311, "timestamp_epoch": "1641571552.694215000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 60, "udp_stream": null, "fields": { "ldap.baseObject": "CN=DESKTOP-GXMYNO2,CN=Computers,DC=spoonwatch,DC=net", "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-6b78be45c23581e5f85e3e9c", "kind": "directory_service", "frame_number": 1312, "timestamp_epoch": "1641571552.694537000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 60, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-e9187eb463e45f70cc7afbcb", "kind": "directory_service", "frame_number": 1317, "timestamp_epoch": "1641571552.697751000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 61, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-fa47bb879717f087efd01793", "kind": "directory_service", "frame_number": 1319, "timestamp_epoch": "1641571552.698593000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 61, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-501f764935bc7e9f0ba69dc1", "kind": "directory_service", "frame_number": 1320, "timestamp_epoch": "1641571552.699027000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 61, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-3abebaabb701e56f50d38214", "kind": "directory_service", "frame_number": 1323, "timestamp_epoch": "1641571552.699332000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 61, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-d75e0962d509ffb3621930c5", "kind": "directory_service", "frame_number": 1325, "timestamp_epoch": "1641571552.699715000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 61, "udp_stream": null, "fields": { "ldap.baseObject": "CN=62a0ff2e-97b9-4513-943f-0d221bd30080,CN=Device Registration Configuration,CN=services,CN=Configuration,DC=spoonwatch,DC=net", "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-1866737a240d19d397a0167c", "kind": "directory_service", "frame_number": 1326, "timestamp_epoch": "1641571552.700008000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": null, "dst_port": null, "tcp_stream": 61, "udp_stream": null, "fields": { "ldap.protocolOp": "5" } }, { "event_id": "evt-12ef604f5961e7b0c4b672cc", "kind": "directory_service", "frame_number": 1327, "timestamp_epoch": "1641571552.700270000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 61, "udp_stream": null, "fields": { "ldap.protocolOp": "2" } }, { "event_id": "evt-7738a2661eb4bcf9e2a1e97f", "kind": "directory_service", "frame_number": 1330, "timestamp_epoch": "1641571552.700472000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": null, "dst_port": null, "tcp_stream": 60, "udp_stream": null, "fields": { "ldap.protocolOp": "2" } } ], "unclassified_tcp": [ { "event_id": "evt-bbedac9a56bd9fcc150e1417", "kind": "unclassified_tcp", "frame_number": 872, "timestamp_epoch": "1641571491.733127000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": 49670, "dst_port": 445, "tcp_stream": 1, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-aeef55d1750abe79fc9efebd", "kind": "unclassified_tcp", "frame_number": 1214, "timestamp_epoch": "1641571521.739036000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": 49670, "dst_port": 445, "tcp_stream": 1, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-fd1411a952b672a4d115defb", "kind": "unclassified_tcp", "frame_number": 1220, "timestamp_epoch": "1641571533.896501000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": 49719, "dst_port": 445, "tcp_stream": 46, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-b6422c84e46cfaf59d5763f7", "kind": "unclassified_tcp", "frame_number": 1260, "timestamp_epoch": "1641571551.755567000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": 49670, "dst_port": 445, "tcp_stream": 1, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-7e22706143b802ae09d596cb", "kind": "unclassified_tcp", "frame_number": 1338, "timestamp_epoch": "1641571563.912125000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": 49719, "dst_port": 445, "tcp_stream": 46, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-736b2c46fecedadcee7acaaa", "kind": "unclassified_tcp", "frame_number": 1347, "timestamp_epoch": "1641571581.771481000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": 445, "dst_port": 49670, "tcp_stream": 1, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-5c9f012aa90dbdef09937758", "kind": "unclassified_tcp", "frame_number": 1349, "timestamp_epoch": "1641571581.772026000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": 49670, "dst_port": 445, "tcp_stream": 1, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-4f1327dff8833ec2bf8954fe", "kind": "unclassified_tcp", "frame_number": 1411, "timestamp_epoch": "1641571611.788909000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": 49670, "dst_port": 445, "tcp_stream": 1, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-33f5aed109f3741a5c437982", "kind": "unclassified_tcp", "frame_number": 1418, "timestamp_epoch": "1641571623.927908000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": 445, "dst_port": 49719, "tcp_stream": 46, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-5cade52748324e70a5513459", "kind": "unclassified_tcp", "frame_number": 4833, "timestamp_epoch": "1641571680.446861000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": 49719, "dst_port": 445, "tcp_stream": 46, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-af26a1e62b5703382c94838e", "kind": "unclassified_tcp", "frame_number": 4840, "timestamp_epoch": "1641571710.462708000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": 49719, "dst_port": 445, "tcp_stream": 46, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-dcd26745d7d6c6bf7b8db9c0", "kind": "unclassified_tcp", "frame_number": 4844, "timestamp_epoch": "1641571770.478842000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": 445, "dst_port": 49719, "tcp_stream": 46, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-ebf1193b0516a20f5251b9ae", "kind": "unclassified_tcp", "frame_number": 4884, "timestamp_epoch": "1641571890.497126000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": 445, "dst_port": 49719, "tcp_stream": 46, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-019192ee8d908a8e20d7a708", "kind": "unclassified_tcp", "frame_number": 4899, "timestamp_epoch": "1641572010.500915000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": 445, "dst_port": 49719, "tcp_stream": 46, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-49f944498d673f3e674c8faf", "kind": "unclassified_tcp", "frame_number": 5747, "timestamp_epoch": "1641572080.174354000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": 49719, "dst_port": 445, "tcp_stream": 46, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-0d18b7a1811882fcfab12d24", "kind": "unclassified_tcp", "frame_number": 5772, "timestamp_epoch": "1641572110.190829000", "src_ip": "192.168.1.216", "dst_ip": "192.168.1.2", "src_port": 49719, "dst_port": 445, "tcp_stream": 46, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-36ee38d6cc6ba590d1571516", "kind": "unclassified_tcp", "frame_number": 5815, "timestamp_epoch": "1641572170.206650000", "src_ip": "192.168.1.2", "dst_ip": "192.168.1.216", "src_port": 445, "dst_port": 49719, "tcp_stream": 46, "udp_stream": null, "fields": { "tcp.payload": "00" } } ] }, "artifacts": [ { "artifact_id": "artifact-d97603f25e66cddb706fcb20", "type": "http-exported-object", "filename": "5(1).jpg", "filenames": [ "5(1).jpg" ], "occurrences": 1, "static_features": { "content_kind": "pe", "inspected_bytes": 262144, "inspection_truncated": true, "features": [], "interpretation": "Static content only; not proof of execution, intent, or malware family" }, "size_bytes": 1246160, "sha256": "e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78", "media_type": "image/jpeg", "extraction_method": "tshark-http-export-objects", "content_retained_by_analyzer": false }, { "artifact_id": "artifact-ba77ea8a3332a19a181b9027", "type": "http-exported-object", "filename": "1(1).jpg", "filenames": [ "1(1).jpg" ], "occurrences": 1, "static_features": { "content_kind": "pe", "inspected_bytes": 262144, "inspection_truncated": true, "features": [], "interpretation": "Static content only; not proof of execution, intent, or malware family" }, "size_bytes": 645592, "sha256": "16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660", "media_type": "image/jpeg", "extraction_method": "tshark-http-export-objects", "content_retained_by_analyzer": false }, { "artifact_id": "artifact-8b9b0493a287d17c5f1eecc5", "type": "http-exported-object", "filename": "4(1).jpg", "filenames": [ "4(1).jpg" ], "occurrences": 1, "static_features": { "content_kind": "pe", "inspected_bytes": 262144, "inspection_truncated": true, "features": [], "interpretation": "Static content only; not proof of execution, intent, or malware family" }, "size_bytes": 440120, "sha256": "334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4", "media_type": "image/jpeg", "extraction_method": "tshark-http-export-objects", "content_retained_by_analyzer": false }, { "artifact_id": "artifact-bd16fd17c273bd4649e10555", "type": "http-exported-object", "filename": "2(1).jpg", "filenames": [ "2(1).jpg" ], "occurrences": 1, "static_features": { "content_kind": "pe", "inspected_bytes": 262144, "inspection_truncated": true, "features": [], "interpretation": "Static content only; not proof of execution, intent, or malware family" }, "size_bytes": 334288, "sha256": "a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba", "media_type": "image/jpeg", "extraction_method": "tshark-http-export-objects", "content_retained_by_analyzer": false }, { "artifact_id": "artifact-30b70f8f317e596afba72144", "type": "http-exported-object", "filename": "am_delta_patch_1.355.1569.0_f5fe52e10a18f6ce4bc39541e4aae4a97c270c81(2).exe", "filenames": [ "am_delta_patch_1.355.1569.0_f5fe52e10a18f6ce4bc39541e4aae4a97c270c81(2).exe" ], "occurrences": 1, "static_features": { "content_kind": "pe", "inspected_bytes": 262144, "inspection_truncated": true, "features": [], "interpretation": "Static content only; not proof of execution, intent, or malware family" }, "size_bytes": 307632, "sha256": "6482cf553a8dd0d2b4812ed1e4916423e9b233e77b3f73e8dcf1e1afdef0d1e9", "media_type": "application/octet-stream", "extraction_method": "tshark-http-export-objects", "content_retained_by_analyzer": false }, { "artifact_id": "artifact-3df279c0ad09da471f95cba4", "type": "http-exported-object", "filename": "6(1).jpg", "filenames": [ "6(1).jpg" ], "occurrences": 1, "static_features": { "content_kind": "pe", "inspected_bytes": 144848, "inspection_truncated": false, "features": [ { "feature": "dynamic-evaluation", "excerpt": "IEX", "offset": 135147 } ], "interpretation": "Static content only; not proof of execution, intent, or malware family" }, "size_bytes": 144848, "sha256": "43536adef2ddcc811c28d35fa6ce3031029a2424ad393989db36169ff2995083", "media_type": "image/jpeg", "extraction_method": "tshark-http-export-objects", "content_retained_by_analyzer": false }, { "artifact_id": "artifact-b63db24888c4d881e4ad1cb1", "type": "http-exported-object", "filename": "3(1).jpg", "filenames": [ "3(1).jpg" ], "occurrences": 1, "static_features": { "content_kind": "pe", "inspected_bytes": 137168, "inspection_truncated": false, "features": [ { "feature": "dynamic-evaluation", "excerpt": "IEX", "offset": 126724 } ], "interpretation": "Static content only; not proof of execution, intent, or malware family" }, "size_bytes": 137168, "sha256": "3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd", "media_type": "image/jpeg", "extraction_method": "tshark-http-export-objects", "content_retained_by_analyzer": false }, { "artifact_id": "artifact-2b220b474ce8fb1830deb524", "type": "http-exported-object", "filename": "7(1).jpg", "filenames": [ "7(1).jpg" ], "occurrences": 1, "static_features": { "content_kind": "pe", "inspected_bytes": 83784, "inspection_truncated": false, "features": [], "interpretation": "Static content only; not proof of execution, intent, or malware family" }, "size_bytes": 83784, "sha256": "c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d", "media_type": "image/jpeg", "extraction_method": "tshark-http-export-objects", "content_retained_by_analyzer": false }, { "artifact_id": "artifact-c63ac0bd2578aef5d655ca36", "type": "http-exported-object", "filename": "osk", "filenames": [ "osk" ], "occurrences": 1, "static_features": { "content_kind": "unclassified", "inspected_bytes": 262144, "inspection_truncated": true, "features": [], "interpretation": "Static content only; not proof of execution, intent, or malware family" }, "size_bytes": 379629, "sha256": "1ecee6ff37e03c1160b8bf66d5ca8dc784e0b35fb9fd105f0964b314d310c07f", "media_type": "application/octet-stream", "extraction_method": "tshark-http-export-objects", "content_retained_by_analyzer": false }, { "artifact_id": "artifact-4eba74982d2765516cf1de50", "type": "http-exported-object", "filename": "35969632_c422aaaf8becdd90e50fb6936708c77c7f97631f.cab", "filenames": [ "35969632_c422aaaf8becdd90e50fb6936708c77c7f97631f.cab" ], "occurrences": 1, "static_features": { "content_kind": "unclassified", "inspected_bytes": 10885, "inspection_truncated": false, "features": [], "interpretation": "Static content only; not proof of execution, intent, or malware family" }, "size_bytes": 10885, "sha256": "18180895844cba1cd9d310f04e0cfa26cff43b84eebacdc74809edf0e165d082", "media_type": "application/octet-stream", "extraction_method": "tshark-http-export-objects", "content_retained_by_analyzer": false }, { "artifact_id": "artifact-cf32cd5e7ba8303d854bb0db", "type": "http-exported-object", "filename": "35969516_5bcaf676a3e98426394e538836033ea5ce2bb8c3.cab", "filenames": [ "35969516_5bcaf676a3e98426394e538836033ea5ce2bb8c3.cab" ], "occurrences": 1, "static_features": { "content_kind": "unclassified", "inspected_bytes": 7317, "inspection_truncated": false, "features": [], "interpretation": "Static content only; not proof of execution, intent, or malware family" }, "size_bytes": 7317, "sha256": "0cb0222fbde977f15ebc3a7d555ed658763d9a3f507b3f7869416e1b2885adf2", "media_type": "application/octet-stream", "extraction_method": "tshark-http-export-objects", "content_retained_by_analyzer": false }, { "artifact_id": "artifact-be106ab865a5b9976c83cb52", "type": "http-exported-object", "filename": "35969515_2975e5b79f9857b7a2d7aa07e0d43359735c8e80.cab", "filenames": [ "35969515_2975e5b79f9857b7a2d7aa07e0d43359735c8e80.cab" ], "occurrences": 1, "static_features": { "content_kind": "unclassified", "inspected_bytes": 7313, "inspection_truncated": false, "features": [], "interpretation": "Static content only; not proof of execution, intent, or malware family" }, "size_bytes": 7313, "sha256": "835eb064fabd072bd2aa6079f0b0949fbaf6fb677369c1a0cadcec666dbfffc7", "media_type": "application/octet-stream", "extraction_method": "tshark-http-export-objects", "content_retained_by_analyzer": false }, { "artifact_id": "artifact-d36bed8c61ca4d283e8647d0", "type": "http-exported-object", "filename": "1.jpg", "filenames": [ "1.jpg", "2.jpg", "3.jpg", "4.jpg", "5.jpg", "6.jpg", "7.jpg", "main.php" ], "occurrences": 8, "static_features": { "content_kind": "unclassified", "inspected_bytes": 25, "inspection_truncated": false, "features": [], "interpretation": "Static content only; not proof of execution, intent, or malware family" }, "size_bytes": 25, "sha256": "7b8ab07521c24e8ec610611e7e15d2fd39336166db6509885b8500d2a2bbfb14", "media_type": "image/jpeg", "extraction_method": "tshark-http-export-objects", "content_retained_by_analyzer": false }, { "artifact_id": "artifact-5f9d35a4b989c4ac72ebc230", "type": "http-exported-object", "filename": "am_delta_patch_1.355.1569.0_f5fe52e10a18f6ce4bc39541e4aae4a97c270c81(1).exe", "filenames": [ "am_delta_patch_1.355.1569.0_f5fe52e10a18f6ce4bc39541e4aae4a97c270c81(1).exe", "am_delta_patch_1.355.1569.0_f5fe52e10a18f6ce4bc39541e4aae4a97c270c81.exe" ], "occurrences": 2, "static_features": { "content_kind": "unclassified", "inspected_bytes": 2, "inspection_truncated": false, "features": [], "interpretation": "Static content only; not proof of execution, intent, or malware family" }, "size_bytes": 2, "sha256": "9b8db510ef42b8ed54a3712636fda55a4f8cfcd5493e20b74ab00cd4f3979f2d", "media_type": "application/octet-stream", "extraction_method": "tshark-http-export-objects", "content_retained_by_analyzer": false } ], "observables": [ { "observable_id": "observable-536097ba66b1b88eae257dec", "type": "domain", "value": "api.msn.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1641571494.108159000", "last_seen_epoch": "1641571494.191063000", "evidence": [ { "frame_number": 1061, "timestamp_epoch": "1641571494.108159000", "display_filter": "frame.number == 1061", "udp_stream": 42 }, { "frame_number": 1062, "timestamp_epoch": "1641571494.127684000", "display_filter": "frame.number == 1062", "udp_stream": 42 }, { "frame_number": 1066, "timestamp_epoch": "1641571494.191063000", "display_filter": "frame.number == 1066", "tcp_stream": 52 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-f430733d136e7bbeb2e37fc1", "type": "domain", "value": "au.download.windowsupdate.com", "roles": [ "dns-query", "http-host" ], "is_private": null, "first_seen_epoch": "1641572062.424316000", "last_seen_epoch": "1641572062.491933000", "evidence": [ { "frame_number": 5302, "timestamp_epoch": "1641572062.424316000", "display_filter": "frame.number == 5302", "udp_stream": 61 }, { "frame_number": 5303, "timestamp_epoch": "1641572062.424599000", "display_filter": "frame.number == 5303", "udp_stream": 61 }, { "frame_number": 5309, "timestamp_epoch": "1641572062.462443000", "display_filter": "frame.number == 5309", "tcp_stream": 76 }, { "frame_number": 5313, "timestamp_epoch": "1641572062.465939000", "display_filter": "frame.number == 5313", "tcp_stream": 77 }, { "frame_number": 5317, "timestamp_epoch": "1641572062.491933000", "display_filter": "frame.number == 5317", "tcp_stream": 76 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-c19aea13a381d0f4cc52ffd6", "type": "domain", "value": "client.wns.windows.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1641571629.707631000", "last_seen_epoch": "1641571629.829871000", "evidence": [ { "frame_number": 1429, "timestamp_epoch": "1641571629.707631000", "display_filter": "frame.number == 1429", "udp_stream": 51 }, { "frame_number": 1430, "timestamp_epoch": "1641571629.756383000", "display_filter": "frame.number == 1430", "udp_stream": 51 }, { "frame_number": 1435, "timestamp_epoch": "1641571629.829871000", "display_filter": "frame.number == 1435", "tcp_stream": 63 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-95197449f1072c764744447e", "type": "domain", "value": "cp801.prod.do.dsp.mp.microsoft.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1641572062.288601000", "last_seen_epoch": "1641572062.313505000", "evidence": [ { "frame_number": 5282, "timestamp_epoch": "1641572062.288601000", "display_filter": "frame.number == 5282", "udp_stream": 60 }, { "frame_number": 5283, "timestamp_epoch": "1641572062.288922000", "display_filter": "frame.number == 5283", "udp_stream": 60 }, { "frame_number": 5287, "timestamp_epoch": "1641572062.313505000", "display_filter": "frame.number == 5287", "tcp_stream": 75 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-cfeb39496058c32c39cb4bed", "type": "domain", "value": "ctldl.windowsupdate.com", "roles": [ "dns-query", "http-host" ], "is_private": null, "first_seen_epoch": "1641572117.846671000", "last_seen_epoch": "1641572117.914696000", "evidence": [ { "frame_number": 5774, "timestamp_epoch": "1641572117.846671000", "display_filter": "frame.number == 5774", "udp_stream": 65 }, { "frame_number": 5775, "timestamp_epoch": "1641572117.890524000", "display_filter": "frame.number == 5775", "udp_stream": 65 }, { "frame_number": 5779, "timestamp_epoch": "1641572117.914696000", "display_filter": "frame.number == 5779", "tcp_stream": 83 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-d8607b90d64cbb178bd902c7", "type": "domain", "value": "dns.msftncsi.com", "roles": [ "dns-query" ], "is_private": null, "first_seen_epoch": "1641571450.459752000", "last_seen_epoch": "1641571450.489184000", "evidence": [ { "frame_number": 49, "timestamp_epoch": "1641571450.459752000", "display_filter": "frame.number == 49", "udp_stream": 11 }, { "frame_number": 50, "timestamp_epoch": "1641571450.489184000", "display_filter": "frame.number == 50", "udp_stream": 11 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-b6f671f9d1dca4e379602695", "type": "domain", "value": "download.windowsupdate.com", "roles": [ "dns-query", "http-host" ], "is_private": null, "first_seen_epoch": "1641572058.185053000", "last_seen_epoch": "1641572058.294727000", "evidence": [ { "frame_number": 5042, "timestamp_epoch": "1641572058.185053000", "display_filter": "frame.number == 5042", "udp_stream": 55 }, { "frame_number": 5043, "timestamp_epoch": "1641572058.223585000", "display_filter": "frame.number == 5043", "udp_stream": 55 }, { "frame_number": 5047, "timestamp_epoch": "1641572058.247368000", "display_filter": "frame.number == 5047", "tcp_stream": 69 }, { "frame_number": 5058, "timestamp_epoch": "1641572058.269626000", "display_filter": "frame.number == 5058", "tcp_stream": 69 }, { "frame_number": 5069, "timestamp_epoch": "1641572058.294727000", "display_filter": "frame.number == 5069", "tcp_stream": 69 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-766cdbab54400ed26496b593", "type": "domain", "value": "fe2cr.update.microsoft.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1641572057.582136000", "last_seen_epoch": "1641572057.634152000", "evidence": [ { "frame_number": 4936, "timestamp_epoch": "1641572057.582136000", "display_filter": "frame.number == 4936", "udp_stream": 54 }, { "frame_number": 4937, "timestamp_epoch": "1641572057.607589000", "display_filter": "frame.number == 4937", "udp_stream": 54 }, { "frame_number": 4941, "timestamp_epoch": "1641572057.634152000", "display_filter": "frame.number == 4941", "tcp_stream": 68 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-f6c725624712780348cfbd1a", "type": "domain", "value": "fe3cr.delivery.mp.microsoft.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1641572059.380280000", "last_seen_epoch": "1641572059.551713000", "evidence": [ { "frame_number": 5148, "timestamp_epoch": "1641572059.380280000", "display_filter": "frame.number == 5148", "udp_stream": 57 }, { "frame_number": 5149, "timestamp_epoch": "1641572059.425017000", "display_filter": "frame.number == 5149", "udp_stream": 57 }, { "frame_number": 5153, "timestamp_epoch": "1641572059.551713000", "display_filter": "frame.number == 5153", "tcp_stream": 71 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-d0f0434bd69e450b83415417", "type": "domain", "value": "geo.prod.do.dsp.mp.microsoft.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1641572061.667800000", "last_seen_epoch": "1641572061.764439000", "evidence": [ { "frame_number": 5235, "timestamp_epoch": "1641572061.667800000", "display_filter": "frame.number == 5235", "udp_stream": 58 }, { "frame_number": 5236, "timestamp_epoch": "1641572061.710826000", "display_filter": "frame.number == 5236", "udp_stream": 58 }, { "frame_number": 5240, "timestamp_epoch": "1641572061.764439000", "display_filter": "frame.number == 5240", "tcp_stream": 73 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-46ed1c4f469ea61ef05802af", "type": "domain", "value": "kv801.prod.do.dsp.mp.microsoft.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1641572062.028713000", "last_seen_epoch": "1641572062.119414000", "evidence": [ { "frame_number": 5259, "timestamp_epoch": "1641572062.028713000", "display_filter": "frame.number == 5259", "udp_stream": 59 }, { "frame_number": 5260, "timestamp_epoch": "1641572062.084821000", "display_filter": "frame.number == 5260", "udp_stream": 59 }, { "frame_number": 5266, "timestamp_epoch": "1641572062.119414000", "display_filter": "frame.number == 5266", "tcp_stream": 74 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-cfd9e90b8f3ea1d6f6537fb5", "type": "domain", "value": "pti.store.microsoft.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1641571629.810602000", "last_seen_epoch": "1641571629.959009000", "evidence": [ { "frame_number": 1432, "timestamp_epoch": "1641571629.810602000", "display_filter": "frame.number == 1432", "udp_stream": 52 }, { "frame_number": 1437, "timestamp_epoch": "1641571629.857438000", "display_filter": "frame.number == 1437", "udp_stream": 52 }, { "frame_number": 1447, "timestamp_epoch": "1641571629.959009000", "display_filter": "frame.number == 1447", "tcp_stream": 64 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-d03bbd12e235ded7dc93d830", "type": "domain", "value": "self.events.data.microsoft.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1641571461.683546000", "last_seen_epoch": "1641571782.361469000", "evidence": [ { "frame_number": 760, "timestamp_epoch": "1641571461.683546000", "display_filter": "frame.number == 760", "udp_stream": 36 }, { "frame_number": 761, "timestamp_epoch": "1641571461.710748000", "display_filter": "frame.number == 761", "udp_stream": 36 }, { "frame_number": 770, "timestamp_epoch": "1641571461.775438000", "display_filter": "frame.number == 770", "tcp_stream": 38 }, { "frame_number": 4851, "timestamp_epoch": "1641571782.361469000", "display_filter": "frame.number == 4851", "tcp_stream": 66 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-d418dfc6ee6752db05e2a038", "type": "domain", "value": "settings-win.data.microsoft.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1641571508.772862000", "last_seen_epoch": "1641572052.001142000", "evidence": [ { "frame_number": 1143, "timestamp_epoch": "1641571508.772862000", "display_filter": "frame.number == 1143", "udp_stream": 44 }, { "frame_number": 1144, "timestamp_epoch": "1641571508.830152000", "display_filter": "frame.number == 1144", "udp_stream": 44 }, { "frame_number": 4908, "timestamp_epoch": "1641572051.907753000", "display_filter": "frame.number == 4908", "udp_stream": 53 }, { "frame_number": 4909, "timestamp_epoch": "1641572051.961202000", "display_filter": "frame.number == 4909", "udp_stream": 53 }, { "frame_number": 1148, "timestamp_epoch": "1641571508.868078000", "display_filter": "frame.number == 1148", "tcp_stream": 54 }, { "frame_number": 1165, "timestamp_epoch": "1641571509.072635000", "display_filter": "frame.number == 1165", "tcp_stream": 55 }, { "frame_number": 1189, "timestamp_epoch": "1641571509.881795000", "display_filter": "frame.number == 1189", "tcp_stream": 56 }, { "frame_number": 4913, "timestamp_epoch": "1641572052.001142000", "display_filter": "frame.number == 4913", "tcp_stream": 67 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-3dfdd1f093ccd41c1c89c2c0", "type": "domain", "value": "settingsfd-geo.trafficmanager.net", "roles": [ "dns-cname" ], "is_private": null, "first_seen_epoch": "1641571508.830152000", "last_seen_epoch": "1641572051.961202000", "evidence": [ { "frame_number": 1144, "timestamp_epoch": "1641571508.830152000", "display_filter": "frame.number == 1144", "udp_stream": 44 }, { "frame_number": 4909, "timestamp_epoch": "1641572051.961202000", "display_filter": "frame.number == 4909", "udp_stream": 53 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-c3d0893f527be89ccbb7fa33", "type": "domain", "value": "spoonwatch-dc.spoonwatch.net", "roles": [ "dns-query" ], "is_private": null, "first_seen_epoch": "1641571449.667717000", "last_seen_epoch": "1641571451.429803000", "evidence": [ { "frame_number": 18, "timestamp_epoch": "1641571449.667717000", "display_filter": "frame.number == 18", "udp_stream": 5 }, { "frame_number": 19, "timestamp_epoch": "1641571449.667971000", "display_filter": "frame.number == 19", "udp_stream": 5 }, { "frame_number": 369, "timestamp_epoch": "1641571451.429178000", "display_filter": "frame.number == 369", "udp_stream": 28 }, { "frame_number": 374, "timestamp_epoch": "1641571451.429803000", "display_filter": "frame.number == 374", "udp_stream": 28 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-2666113137a14137ccd2d35f", "type": "domain", "value": "spoonwatch.net", "roles": [ "dns-query" ], "is_private": null, "first_seen_epoch": "1641571491.724441000", "last_seen_epoch": "1641571491.724670000", "evidence": [ { "frame_number": 863, "timestamp_epoch": "1641571491.724441000", "display_filter": "frame.number == 863", "udp_stream": 40 }, { "frame_number": 864, "timestamp_epoch": "1641571491.724670000", "display_filter": "frame.number == 864", "udp_stream": 40 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-84c2884eb53d1cfb024ce562", "type": "domain", "value": "v10.events.data.microsoft.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1641571594.628885000", "last_seen_epoch": "1641572072.174376000", "evidence": [ { "frame_number": 1351, "timestamp_epoch": "1641571594.628885000", "display_filter": "frame.number == 1351", "udp_stream": 50 }, { "frame_number": 1352, "timestamp_epoch": "1641571594.651655000", "display_filter": "frame.number == 1352", "udp_stream": 50 }, { "frame_number": 5083, "timestamp_epoch": "1641572058.338024000", "display_filter": "frame.number == 5083", "udp_stream": 56 }, { "frame_number": 5084, "timestamp_epoch": "1641572058.364212000", "display_filter": "frame.number == 5084", "udp_stream": 56 }, { "frame_number": 5638, "timestamp_epoch": "1641572062.804566000", "display_filter": "frame.number == 5638", "udp_stream": 62 }, { "frame_number": 5639, "timestamp_epoch": "1641572062.833150000", "display_filter": "frame.number == 5639", "udp_stream": 62 }, { "frame_number": 5716, "timestamp_epoch": "1641572072.032616000", "display_filter": "frame.number == 5716", "udp_stream": 64 }, { "frame_number": 5717, "timestamp_epoch": "1641572072.033379000", "display_filter": "frame.number == 5717", "udp_stream": 64 }, { "frame_number": 1356, "timestamp_epoch": "1641571594.718926000", "display_filter": "frame.number == 1356", "tcp_stream": 62 }, { "frame_number": 5112, "timestamp_epoch": "1641572058.513465000", "display_filter": "frame.number == 5112", "tcp_stream": 70 }, { "frame_number": 5182, "timestamp_epoch": "1641572060.594492000", "display_filter": "frame.number == 5182", "tcp_stream": 72 }, { "frame_number": 5643, "timestamp_epoch": "1641572062.974471000", "display_filter": "frame.number == 5643", "tcp_stream": 78 }, { "frame_number": 5666, "timestamp_epoch": "1641572064.091820000", "display_filter": "frame.number == 5666", "tcp_stream": 79 }, { "frame_number": 5721, "timestamp_epoch": "1641572072.174376000", "display_filter": "frame.number == 5721", "tcp_stream": 82 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-cceba1908fe516147b38dfea", "type": "domain", "value": "v20.events.data.microsoft.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1641571493.065847000", "last_seen_epoch": "1641571493.262910000", "evidence": [ { "frame_number": 1037, "timestamp_epoch": "1641571493.065847000", "display_filter": "frame.number == 1037", "udp_stream": 41 }, { "frame_number": 1038, "timestamp_epoch": "1641571493.096639000", "display_filter": "frame.number == 1038", "udp_stream": 41 }, { "frame_number": 1042, "timestamp_epoch": "1641571493.262910000", "display_filter": "frame.number == 1042", "tcp_stream": 51 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-94e09c23419bb90092a8b2e3", "type": "domain", "value": "wns.notify.trafficmanager.net", "roles": [ "dns-cname" ], "is_private": null, "first_seen_epoch": "1641571629.756383000", "last_seen_epoch": "1641571629.756383000", "evidence": [ { "frame_number": 1430, "timestamp_epoch": "1641571629.756383000", "display_filter": "frame.number == 1430", "udp_stream": 51 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-4e93127c8426d9d30681f1f1", "type": "domain", "value": "wpad.localdomain", "roles": [ "dns-query" ], "is_private": null, "first_seen_epoch": "1641571450.736957000", "last_seen_epoch": "1641572125.810645000", "evidence": [ { "frame_number": 58, "timestamp_epoch": "1641571450.736957000", "display_filter": "frame.number == 58", "udp_stream": 15 }, { "frame_number": 59, "timestamp_epoch": "1641571450.737214000", "display_filter": "frame.number == 59", "udp_stream": 15 }, { "frame_number": 806, "timestamp_epoch": "1641571465.751109000", "display_filter": "frame.number == 806", "udp_stream": 38 }, { "frame_number": 807, "timestamp_epoch": "1641571465.751365000", "display_filter": "frame.number == 807", "udp_stream": 38 }, { "frame_number": 1218, "timestamp_epoch": "1641571525.759254000", "display_filter": "frame.number == 1218", "udp_stream": 46 }, { "frame_number": 1219, "timestamp_epoch": "1641571525.759539000", "display_filter": "frame.number == 1219", "udp_stream": 46 }, { "frame_number": 5785, "timestamp_epoch": "1641572125.773568000", "display_filter": "frame.number == 5785", "udp_stream": 67 }, { "frame_number": 5786, "timestamp_epoch": "1641572125.810645000", "display_filter": "frame.number == 5786", "udp_stream": 67 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-7f884fc1a38b8a31d74169f3", "type": "domain", "value": "wpad.spoonwatch.net", "roles": [ "dns-query" ], "is_private": null, "first_seen_epoch": "1641571450.735414000", "last_seen_epoch": "1641572125.773037000", "evidence": [ { "frame_number": 56, "timestamp_epoch": "1641571450.735414000", "display_filter": "frame.number == 56", "udp_stream": 14 }, { "frame_number": 57, "timestamp_epoch": "1641571450.735787000", "display_filter": "frame.number == 57", "udp_stream": 14 }, { "frame_number": 804, "timestamp_epoch": "1641571465.750273000", "display_filter": "frame.number == 804", "udp_stream": 37 }, { "frame_number": 805, "timestamp_epoch": "1641571465.750678000", "display_filter": "frame.number == 805", "udp_stream": 37 }, { "frame_number": 1216, "timestamp_epoch": "1641571525.758283000", "display_filter": "frame.number == 1216", "udp_stream": 45 }, { "frame_number": 1217, "timestamp_epoch": "1641571525.758686000", "display_filter": "frame.number == 1217", "udp_stream": 45 }, { "frame_number": 5783, "timestamp_epoch": "1641572125.772644000", "display_filter": "frame.number == 5783", "udp_stream": 66 }, { "frame_number": 5784, "timestamp_epoch": "1641572125.773037000", "display_filter": "frame.number == 5784", "udp_stream": 66 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-ddb0aab3ce3ac0ea936ec0bb", "type": "domain", "value": "www.bing.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1641571496.446316000", "last_seen_epoch": "1641572170.943202000", "evidence": [ { "frame_number": 1085, "timestamp_epoch": "1641571496.446316000", "display_filter": "frame.number == 1085", "udp_stream": 43 }, { "frame_number": 1086, "timestamp_epoch": "1641571496.507251000", "display_filter": "frame.number == 1086", "udp_stream": 43 }, { "frame_number": 1226, "timestamp_epoch": "1641571549.025125000", "display_filter": "frame.number == 1226", "udp_stream": 47 }, { "frame_number": 1227, "timestamp_epoch": "1641571549.058698000", "display_filter": "frame.number == 1227", "udp_stream": 47 }, { "frame_number": 5820, "timestamp_epoch": "1641572170.859000000", "display_filter": "frame.number == 5820", "udp_stream": 69 }, { "frame_number": 5821, "timestamp_epoch": "1641572170.913852000", "display_filter": "frame.number == 5821", "udp_stream": 69 }, { "frame_number": 1090, "timestamp_epoch": "1641571496.575343000", "display_filter": "frame.number == 1090", "tcp_stream": 53 }, { "frame_number": 1232, "timestamp_epoch": "1641571549.090667000", "display_filter": "frame.number == 1232", "tcp_stream": 57 }, { "frame_number": 5825, "timestamp_epoch": "1641572170.943202000", "display_filter": "frame.number == 5825", "tcp_stream": 85 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-2a43d0ba5eacdad4f45235a2", "type": "ipv4", "value": "0.0.0.0", "roles": [ "network-endpoint" ], "is_private": true, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-eaa2bfb6782dcb2c2cf80341", "type": "ipv4", "value": "104.212.67.47", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1641571629.857438000", "last_seen_epoch": "1641571629.857438000", "evidence": [ { "frame_number": 1437, "timestamp_epoch": "1641571629.857438000", "display_filter": "frame.number == 1437", "udp_stream": 52 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-38dc29c93f828fae15688575", "type": "ipv4", "value": "13.107.21.200", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1641571496.507251000", "last_seen_epoch": "1641572170.913852000", "evidence": [ { "frame_number": 1086, "timestamp_epoch": "1641571496.507251000", "display_filter": "frame.number == 1086", "udp_stream": 43 }, { "frame_number": 1227, "timestamp_epoch": "1641571549.058698000", "display_filter": "frame.number == 1227", "udp_stream": 47 }, { "frame_number": 5821, "timestamp_epoch": "1641572170.913852000", "display_filter": "frame.number == 5821", "udp_stream": 69 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-19af47aa8837a7f85ad369d1", "type": "ipv4", "value": "131.107.255.255", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1641571450.489184000", "last_seen_epoch": "1641571450.489184000", "evidence": [ { "frame_number": 50, "timestamp_epoch": "1641571450.489184000", "display_filter": "frame.number == 50", "udp_stream": 11 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-4940cf5d99afc38b80080447", "type": "ipv4", "value": "184.50.62.43", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1641572062.084821000", "last_seen_epoch": "1641572062.288922000", "evidence": [ { "frame_number": 5260, "timestamp_epoch": "1641572062.084821000", "display_filter": "frame.number == 5260", "udp_stream": 59 }, { "frame_number": 5283, "timestamp_epoch": "1641572062.288922000", "display_filter": "frame.number == 5283", "udp_stream": 60 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-1bdc709e7fd25754a57d6039", "type": "ipv4", "value": "192.168.1.1", "roles": [ "network-endpoint" ], "is_private": true, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-9b3e5ec2de5458151956cce3", "type": "ipv4", "value": "192.168.1.2", "roles": [ "dns-answer", "network-endpoint" ], "is_private": true, "first_seen_epoch": "1641571449.663053000", "last_seen_epoch": "1641571552.557345000", "evidence": [ { "frame_number": 17, "timestamp_epoch": "1641571449.663053000", "display_filter": "frame.number == 17", "udp_stream": 4 }, { "frame_number": 19, "timestamp_epoch": "1641571449.667971000", "display_filter": "frame.number == 19", "udp_stream": 5 }, { "frame_number": 53, "timestamp_epoch": "1641571450.650111000", "display_filter": "frame.number == 53", "udp_stream": 12 }, { "frame_number": 55, "timestamp_epoch": "1641571450.659897000", "display_filter": "frame.number == 55", "udp_stream": 13 }, { "frame_number": 223, "timestamp_epoch": "1641571450.996311000", "display_filter": "frame.number == 223", "udp_stream": 22 }, { "frame_number": 343, "timestamp_epoch": "1641571451.139418000", "display_filter": "frame.number == 343", "udp_stream": 24 }, { "frame_number": 359, "timestamp_epoch": "1641571451.297339000", "display_filter": "frame.number == 359", "udp_stream": 26 }, { "frame_number": 374, "timestamp_epoch": "1641571451.429803000", "display_filter": "frame.number == 374", "udp_stream": 28 }, { "frame_number": 600, "timestamp_epoch": "1641571454.426813000", "display_filter": "frame.number == 600", "udp_stream": 29 }, { "frame_number": 864, "timestamp_epoch": "1641571491.724670000", "display_filter": "frame.number == 864", "udp_stream": 40 }, { "frame_number": 1263, "timestamp_epoch": "1641571552.557345000", "display_filter": "frame.number == 1263", "udp_stream": 48 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-b50499e6364eb3d16c225ded", "type": "ipv4", "value": "192.168.1.216", "roles": [ "network-endpoint" ], "is_private": true, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-4836910be75bfbdcc3e12e0a", "type": "ipv4", "value": "192.168.1.255", "roles": [ "network-endpoint" ], "is_private": true, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-3a3131a2a6b154c019e38ae1", "type": "ipv4", "value": "2.56.57.108", "roles": [ "http-host", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1641571652.212441000", "last_seen_epoch": "1641571656.376674000", "evidence": [ { "frame_number": 1501, "timestamp_epoch": "1641571652.212441000", "display_filter": "frame.number == 1501", "tcp_stream": 65 }, { "frame_number": 1641, "timestamp_epoch": "1641571652.751829000", "display_filter": "frame.number == 1641", "tcp_stream": 65 }, { "frame_number": 2225, "timestamp_epoch": "1641571653.452444000", "display_filter": "frame.number == 2225", "tcp_stream": 65 }, { "frame_number": 2541, "timestamp_epoch": "1641571653.743431000", "display_filter": "frame.number == 2541", "tcp_stream": 65 }, { "frame_number": 2691, "timestamp_epoch": "1641571653.942407000", "display_filter": "frame.number == 2691", "tcp_stream": 65 }, { "frame_number": 3054, "timestamp_epoch": "1641571654.219054000", "display_filter": "frame.number == 3054", "tcp_stream": 65 }, { "frame_number": 4194, "timestamp_epoch": "1641571654.755050000", "display_filter": "frame.number == 4194", "tcp_stream": 65 }, { "frame_number": 4275, "timestamp_epoch": "1641571655.625187000", "display_filter": "frame.number == 4275", "tcp_stream": 65 }, { "frame_number": 4816, "timestamp_epoch": "1641571656.376674000", "display_filter": "frame.number == 4816", "tcp_stream": 65 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-b6a21150999f862a3459f2c7", "type": "ipv4", "value": "20.189.173.1", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1641571594.651655000", "last_seen_epoch": "1641571594.651655000", "evidence": [ { "frame_number": 1352, "timestamp_epoch": "1641571594.651655000", "display_filter": "frame.number == 1352", "udp_stream": 50 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-27b86818f327438255b9e3ef", "type": "ipv4", "value": "20.50.80.210", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1641571493.096639000", "last_seen_epoch": "1641571493.096639000", "evidence": [ { "frame_number": 1038, "timestamp_epoch": "1641571493.096639000", "display_filter": "frame.number == 1038", "udp_stream": 41 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-1bb41a5a3c62ad68c5244b70", "type": "ipv4", "value": "20.54.89.15", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1641572059.425017000", "last_seen_epoch": "1641572059.425017000", "evidence": [ { "frame_number": 5149, "timestamp_epoch": "1641572059.425017000", "display_filter": "frame.number == 5149", "udp_stream": 57 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-7d578ad77519991843ff3ea8", "type": "ipv4", "value": "204.79.197.200", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1641571496.507251000", "last_seen_epoch": "1641572170.913852000", "evidence": [ { "frame_number": 1086, "timestamp_epoch": "1641571496.507251000", "display_filter": "frame.number == 1086", "udp_stream": 43 }, { "frame_number": 1227, "timestamp_epoch": "1641571549.058698000", "display_filter": "frame.number == 1227", "udp_stream": 47 }, { "frame_number": 5821, "timestamp_epoch": "1641572170.913852000", "display_filter": "frame.number == 5821", "udp_stream": 69 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-3eea0d6bdf8af512509fe545", "type": "ipv4", "value": "204.79.197.203", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1641571494.127684000", "last_seen_epoch": "1641571494.127684000", "evidence": [ { "frame_number": 1062, "timestamp_epoch": "1641571494.127684000", "display_filter": "frame.number == 1062", "udp_stream": 42 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-650abbcc0cfb31003660e80f", "type": "ipv4", "value": "224.0.0.22", "roles": [ "network-endpoint" ], "is_private": false, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-4684a88a34a2c79701ff1d39", "type": "ipv4", "value": "224.0.0.251", "roles": [ "network-endpoint" ], "is_private": false, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-bf2c4bd8d97dd5153de5afd0", "type": "ipv4", "value": "224.0.0.252", "roles": [ "network-endpoint" ], "is_private": false, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-a4a2cba3b2569c48bdb8d1a1", "type": "ipv4", "value": "23.38.189.201", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1641572058.223585000", "last_seen_epoch": "1641572062.424599000", "evidence": [ { "frame_number": 5043, "timestamp_epoch": "1641572058.223585000", "display_filter": "frame.number == 5043", "udp_stream": 55 }, { "frame_number": 5303, "timestamp_epoch": "1641572062.424599000", "display_filter": "frame.number == 5303", "udp_stream": 61 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-bc1d3b5c53c3feb6e6975748", "type": "ipv4", "value": "23.38.189.225", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1641572058.223585000", "last_seen_epoch": "1641572062.424599000", "evidence": [ { "frame_number": 5043, "timestamp_epoch": "1641572058.223585000", "display_filter": "frame.number == 5043", "udp_stream": 55 }, { "frame_number": 5303, "timestamp_epoch": "1641572062.424599000", "display_filter": "frame.number == 5303", "udp_stream": 61 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-5a7e427507fb7c3294492c94", "type": "ipv4", "value": "239.255.255.250", "roles": [ "http-host", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1641572065.601007000", "last_seen_epoch": "1641572071.597874000", "evidence": [ { "frame_number": 5688, "timestamp_epoch": "1641572065.601007000", "display_filter": "frame.number == 5688" }, { "frame_number": 5689, "timestamp_epoch": "1641572065.608030000", "display_filter": "frame.number == 5689" }, { "frame_number": 5690, "timestamp_epoch": "1641572065.814742000", "display_filter": "frame.number == 5690" }, { "frame_number": 5691, "timestamp_epoch": "1641572068.596452000", "display_filter": "frame.number == 5691" }, { "frame_number": 5692, "timestamp_epoch": "1641572068.596676000", "display_filter": "frame.number == 5692" }, { "frame_number": 5693, "timestamp_epoch": "1641572068.830367000", "display_filter": "frame.number == 5693" }, { "frame_number": 5714, "timestamp_epoch": "1641572071.597689000", "display_filter": "frame.number == 5714" }, { "frame_number": 5715, "timestamp_epoch": "1641572071.597874000", "display_filter": "frame.number == 5715" } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-c72460b2c8fba2a8536efb3a", "type": "ipv4", "value": "255.255.255.255", "roles": [ "network-endpoint" ], "is_private": true, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-d993ea2d048cb72b083000da", "type": "ipv4", "value": "40.83.240.146", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1641571629.756383000", "last_seen_epoch": "1641571629.756383000", "evidence": [ { "frame_number": 1430, "timestamp_epoch": "1641571629.756383000", "display_filter": "frame.number == 1430", "udp_stream": 51 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-c19475ecd545c371b2316675", "type": "ipv4", "value": "52.168.112.67", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1641571461.710748000", "last_seen_epoch": "1641571461.710748000", "evidence": [ { "frame_number": 761, "timestamp_epoch": "1641571461.710748000", "display_filter": "frame.number == 761", "udp_stream": 36 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-58f9fa4102fee6030438cd3c", "type": "ipv4", "value": "52.178.17.2", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1641572058.364212000", "last_seen_epoch": "1641572072.033379000", "evidence": [ { "frame_number": 5084, "timestamp_epoch": "1641572058.364212000", "display_filter": "frame.number == 5084", "udp_stream": 56 }, { "frame_number": 5639, "timestamp_epoch": "1641572062.833150000", "display_filter": "frame.number == 5639", "udp_stream": 62 }, { "frame_number": 5717, "timestamp_epoch": "1641572072.033379000", "display_filter": "frame.number == 5717", "udp_stream": 64 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-c76478f076a55c758e0ee115", "type": "ipv4", "value": "52.179.216.235", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1641572061.710826000", "last_seen_epoch": "1641572061.710826000", "evidence": [ { "frame_number": 5236, "timestamp_epoch": "1641572061.710826000", "display_filter": "frame.number == 5236", "udp_stream": 58 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-bf34d5c56aea09b83d2bdde2", "type": "ipv4", "value": "52.183.220.149", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1641571508.830152000", "last_seen_epoch": "1641572051.961202000", "evidence": [ { "frame_number": 1144, "timestamp_epoch": "1641571508.830152000", "display_filter": "frame.number == 1144", "udp_stream": 44 }, { "frame_number": 4909, "timestamp_epoch": "1641572051.961202000", "display_filter": "frame.number == 4909", "udp_stream": 53 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-863787e4f2f327490e03c9bd", "type": "ipv4", "value": "52.238.248.1", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1641572057.607589000", "last_seen_epoch": "1641572057.607589000", "evidence": [ { "frame_number": 4937, "timestamp_epoch": "1641572057.607589000", "display_filter": "frame.number == 4937", "udp_stream": 54 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-6d15a7adfc7fc4650095da7e", "type": "ipv4", "value": "52.249.36.204", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1641572057.607589000", "last_seen_epoch": "1641572057.607589000", "evidence": [ { "frame_number": 4937, "timestamp_epoch": "1641572057.607589000", "display_filter": "frame.number == 4937", "udp_stream": 54 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-5865e750a53314c6fd564e09", "type": "ipv4", "value": "67.27.123.126", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1641572117.890524000", "last_seen_epoch": "1641572117.890524000", "evidence": [ { "frame_number": 5775, "timestamp_epoch": "1641572117.890524000", "display_filter": "frame.number == 5775", "udp_stream": 65 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-ee36782f99fe13d7db311ced", "type": "ipv4", "value": "8.240.136.254", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1641572117.890524000", "last_seen_epoch": "1641572117.890524000", "evidence": [ { "frame_number": 5775, "timestamp_epoch": "1641572117.890524000", "display_filter": "frame.number == 5775", "udp_stream": 65 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-1acda88bad0937946f5251a2", "type": "ipv4", "value": "8.249.3.254", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1641572117.890524000", "last_seen_epoch": "1641572117.890524000", "evidence": [ { "frame_number": 5775, "timestamp_epoch": "1641572117.890524000", "display_filter": "frame.number == 5775", "udp_stream": 65 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-d08a8f37a553a86251ba5ef1", "type": "ipv4", "value": "8.249.7.254", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1641572117.890524000", "last_seen_epoch": "1641572117.890524000", "evidence": [ { "frame_number": 5775, "timestamp_epoch": "1641572117.890524000", "display_filter": "frame.number == 5775", "udp_stream": 65 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-ed620f332be23b5e6fb496e0", "type": "ipv4", "value": "8.253.189.126", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1641572117.890524000", "last_seen_epoch": "1641572117.890524000", "evidence": [ { "frame_number": 5775, "timestamp_epoch": "1641572117.890524000", "display_filter": "frame.number == 5775", "udp_stream": 65 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-a5d2b8353462a9e411f51691", "type": "ja3", "value": "28a2c9bd18a11de089ef85a160da29e4", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1641571493.262910000", "last_seen_epoch": "1641572072.174376000", "evidence": [ { "frame_number": 1042, "timestamp_epoch": "1641571493.262910000", "display_filter": "frame.number == 1042", "tcp_stream": 51 }, { "frame_number": 1165, "timestamp_epoch": "1641571509.072635000", "display_filter": "frame.number == 1165", "tcp_stream": 55 }, { "frame_number": 1356, "timestamp_epoch": "1641571594.718926000", "display_filter": "frame.number == 1356", "tcp_stream": 62 }, { "frame_number": 1447, "timestamp_epoch": "1641571629.959009000", "display_filter": "frame.number == 1447", "tcp_stream": 64 }, { "frame_number": 4913, "timestamp_epoch": "1641572052.001142000", "display_filter": "frame.number == 4913", "tcp_stream": 67 }, { "frame_number": 4941, "timestamp_epoch": "1641572057.634152000", "display_filter": "frame.number == 4941", "tcp_stream": 68 }, { "frame_number": 5112, "timestamp_epoch": "1641572058.513465000", "display_filter": "frame.number == 5112", "tcp_stream": 70 }, { "frame_number": 5153, "timestamp_epoch": "1641572059.551713000", "display_filter": "frame.number == 5153", "tcp_stream": 71 }, { "frame_number": 5182, "timestamp_epoch": "1641572060.594492000", "display_filter": "frame.number == 5182", "tcp_stream": 72 }, { "frame_number": 5240, "timestamp_epoch": "1641572061.764439000", "display_filter": "frame.number == 5240", "tcp_stream": 73 }, { "frame_number": 5266, "timestamp_epoch": "1641572062.119414000", "display_filter": "frame.number == 5266", "tcp_stream": 74 }, { "frame_number": 5287, "timestamp_epoch": "1641572062.313505000", "display_filter": "frame.number == 5287", "tcp_stream": 75 }, { "frame_number": 5643, "timestamp_epoch": "1641572062.974471000", "display_filter": "frame.number == 5643", "tcp_stream": 78 }, { "frame_number": 5666, "timestamp_epoch": "1641572064.091820000", "display_filter": "frame.number == 5666", "tcp_stream": 79 }, { "frame_number": 5721, "timestamp_epoch": "1641572072.174376000", "display_filter": "frame.number == 5721", "tcp_stream": 82 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-afaf8f972bd6db7b3b230ae0", "type": "ja3", "value": "37f463bf4616ecd445d4a1937da06e19", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1641571494.191063000", "last_seen_epoch": "1641571494.191063000", "evidence": [ { "frame_number": 1066, "timestamp_epoch": "1641571494.191063000", "display_filter": "frame.number == 1066", "tcp_stream": 52 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-762db5d905ebf87187f192dd", "type": "ja3", "value": "3b5074b1b5d032e5620f69f9f700ff0e", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1641571629.829871000", "last_seen_epoch": "1641571629.829871000", "evidence": [ { "frame_number": 1435, "timestamp_epoch": "1641571629.829871000", "display_filter": "frame.number == 1435", "tcp_stream": 63 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-57321def6bdb132d670f998c", "type": "ja3", "value": "6271f898ce5be7dd52b0fc260d0662b3", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1641571496.575343000", "last_seen_epoch": "1641572170.943202000", "evidence": [ { "frame_number": 1090, "timestamp_epoch": "1641571496.575343000", "display_filter": "frame.number == 1090", "tcp_stream": 53 }, { "frame_number": 1232, "timestamp_epoch": "1641571549.090667000", "display_filter": "frame.number == 1232", "tcp_stream": 57 }, { "frame_number": 5825, "timestamp_epoch": "1641572170.943202000", "display_filter": "frame.number == 5825", "tcp_stream": 85 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-c5d1d9dc21961898bcdf1a5d", "type": "ja3", "value": "a0e9f5d64349fb13191bc781f81f42e1", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1641571461.775438000", "last_seen_epoch": "1641571782.361469000", "evidence": [ { "frame_number": 770, "timestamp_epoch": "1641571461.775438000", "display_filter": "frame.number == 770", "tcp_stream": 38 }, { "frame_number": 1148, "timestamp_epoch": "1641571508.868078000", "display_filter": "frame.number == 1148", "tcp_stream": 54 }, { "frame_number": 1189, "timestamp_epoch": "1641571509.881795000", "display_filter": "frame.number == 1189", "tcp_stream": 56 }, { "frame_number": 4851, "timestamp_epoch": "1641571782.361469000", "display_filter": "frame.number == 4851", "tcp_stream": 66 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-a1ee2702bc2e1f2b31c93e46", "type": "sha256", "value": "0cb0222fbde977f15ebc3a7d555ed658763d9a3f507b3f7869416e1b2885adf2", "roles": [ "exported-object" ], "is_private": null, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-58e69b1eb81703a31486bd29", "type": "sha256", "value": "16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660", "roles": [ "exported-object" ], "is_private": null, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-feeaafbb5c4ffcb50e077091", "type": "sha256", "value": "18180895844cba1cd9d310f04e0cfa26cff43b84eebacdc74809edf0e165d082", "roles": [ "exported-object" ], "is_private": null, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-2590e07fb61b6af03cea0e72", "type": "sha256", "value": "1ecee6ff37e03c1160b8bf66d5ca8dc784e0b35fb9fd105f0964b314d310c07f", "roles": [ "exported-object" ], "is_private": null, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-f979e25f84bf37862d2213a7", "type": "sha256", "value": "334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4", "roles": [ "exported-object" ], "is_private": null, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-f36b4b8c82844eadd9be5e71", "type": "sha256", "value": "3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd", "roles": [ "exported-object" ], "is_private": null, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-1068a5bb709f1413280958e6", "type": "sha256", "value": "43536adef2ddcc811c28d35fa6ce3031029a2424ad393989db36169ff2995083", "roles": [ "exported-object" ], "is_private": null, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-34685c0b737491bf2909ad3b", "type": "sha256", "value": "6482cf553a8dd0d2b4812ed1e4916423e9b233e77b3f73e8dcf1e1afdef0d1e9", "roles": [ "exported-object" ], "is_private": null, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-c2de1fa8facdcba9e5112212", "type": "sha256", "value": "7b8ab07521c24e8ec610611e7e15d2fd39336166db6509885b8500d2a2bbfb14", "roles": [ "exported-object" ], "is_private": null, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-ecfcf9c1e1fa6937a61b9009", "type": "sha256", "value": "835eb064fabd072bd2aa6079f0b0949fbaf6fb677369c1a0cadcec666dbfffc7", "roles": [ "exported-object" ], "is_private": null, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-7f5f7bba35986d77056db03c", "type": "sha256", "value": "9b8db510ef42b8ed54a3712636fda55a4f8cfcd5493e20b74ab00cd4f3979f2d", "roles": [ "exported-object" ], "is_private": null, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-f370d76bc73c22258da95714", "type": "sha256", "value": "a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba", "roles": [ "exported-object" ], "is_private": null, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-035142932002c1a8ae6bc157", "type": "sha256", "value": "c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d", "roles": [ "exported-object" ], "is_private": null, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-004f6ae8752e48da546d9dc5", "type": "sha256", "value": "e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78", "roles": [ "exported-object" ], "is_private": null, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-aa5bd30d41a1d7155ea3d1a4", "type": "url", "value": "http://2.56.57.108/osk/", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1641571656.376674000", "last_seen_epoch": "1641571656.376674000", "evidence": [ { "frame_number": 4816, "timestamp_epoch": "1641571656.376674000", "display_filter": "frame.number == 4816", "tcp_stream": 65 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-7bd5fd9500eb63ea553fa216", "type": "url", "value": "http://2.56.57.108/osk//1.jpg", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1641571652.751829000", "last_seen_epoch": "1641571652.751829000", "evidence": [ { "frame_number": 1641, "timestamp_epoch": "1641571652.751829000", "display_filter": "frame.number == 1641", "tcp_stream": 65 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-6627a4b4ffc3d7a668b14fe2", "type": "url", "value": "http://2.56.57.108/osk//2.jpg", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1641571653.452444000", "last_seen_epoch": "1641571653.452444000", "evidence": [ { "frame_number": 2225, "timestamp_epoch": "1641571653.452444000", "display_filter": "frame.number == 2225", "tcp_stream": 65 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-72365ccb255975021bcc8eeb", "type": "url", "value": "http://2.56.57.108/osk//3.jpg", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1641571653.743431000", "last_seen_epoch": "1641571653.743431000", "evidence": [ { "frame_number": 2541, "timestamp_epoch": "1641571653.743431000", "display_filter": "frame.number == 2541", "tcp_stream": 65 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-352bc2ec49764bb6fb35bbb9", "type": "url", "value": "http://2.56.57.108/osk//4.jpg", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1641571653.942407000", "last_seen_epoch": "1641571653.942407000", "evidence": [ { "frame_number": 2691, "timestamp_epoch": "1641571653.942407000", "display_filter": "frame.number == 2691", "tcp_stream": 65 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-ce10737a4e5fd91d202af079", "type": "url", "value": "http://2.56.57.108/osk//5.jpg", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1641571654.219054000", "last_seen_epoch": "1641571654.219054000", "evidence": [ { "frame_number": 3054, "timestamp_epoch": "1641571654.219054000", "display_filter": "frame.number == 3054", "tcp_stream": 65 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-f110bfa76cf89d59ea9725b1", "type": "url", "value": "http://2.56.57.108/osk//6.jpg", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1641571652.212441000", "last_seen_epoch": "1641571652.212441000", "evidence": [ { "frame_number": 1501, "timestamp_epoch": "1641571652.212441000", "display_filter": "frame.number == 1501", "tcp_stream": 65 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-9d4bf23eb28d5a83d365fe02", "type": "url", "value": "http://2.56.57.108/osk//7.jpg", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1641571654.755050000", "last_seen_epoch": "1641571654.755050000", "evidence": [ { "frame_number": 4194, "timestamp_epoch": "1641571654.755050000", "display_filter": "frame.number == 4194", "tcp_stream": 65 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-2ae234419d2f98035e835647", "type": "url", "value": "http://2.56.57.108/osk//main.php", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1641571655.625187000", "last_seen_epoch": "1641571655.625187000", "evidence": [ { "frame_number": 4275, "timestamp_epoch": "1641571655.625187000", "display_filter": "frame.number == 4275", "tcp_stream": 65 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-7d316d7591c1656cea5fe199", "type": "url", "value": "http://239.255.255.250:1900*", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1641572065.601007000", "last_seen_epoch": "1641572071.597874000", "evidence": [ { "frame_number": 5688, "timestamp_epoch": "1641572065.601007000", "display_filter": "frame.number == 5688" }, { "frame_number": 5689, "timestamp_epoch": "1641572065.608030000", "display_filter": "frame.number == 5689" }, { "frame_number": 5690, "timestamp_epoch": "1641572065.814742000", "display_filter": "frame.number == 5690" }, { "frame_number": 5691, "timestamp_epoch": "1641572068.596452000", "display_filter": "frame.number == 5691" }, { "frame_number": 5692, "timestamp_epoch": "1641572068.596676000", "display_filter": "frame.number == 5692" }, { "frame_number": 5693, "timestamp_epoch": "1641572068.830367000", "display_filter": "frame.number == 5693" }, { "frame_number": 5714, "timestamp_epoch": "1641572071.597689000", "display_filter": "frame.number == 5714" }, { "frame_number": 5715, "timestamp_epoch": "1641572071.597874000", "display_filter": "frame.number == 5715" } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-ab04af850e0fa6812fbeb8a5", "type": "url", "value": "http://au.download.windowsupdate.com/c/msdownload/update/software/defu/2022/01/am_delta_patch_1.355.1569.0_f5fe52e10a18f6ce4bc39541e4aae4a97c270c81.exe", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1641572062.462443000", "last_seen_epoch": "1641572062.491933000", "evidence": [ { "frame_number": 5309, "timestamp_epoch": "1641572062.462443000", "display_filter": "frame.number == 5309", "tcp_stream": 76 }, { "frame_number": 5313, "timestamp_epoch": "1641572062.465939000", "display_filter": "frame.number == 5313", "tcp_stream": 77 }, { "frame_number": 5317, "timestamp_epoch": "1641572062.491933000", "display_filter": "frame.number == 5317", "tcp_stream": 76 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-32190619dff7dec4ec72851f", "type": "url", "value": "http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?f622d06ddf57408d", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1641572117.914696000", "last_seen_epoch": "1641572117.914696000", "evidence": [ { "frame_number": 5779, "timestamp_epoch": "1641572117.914696000", "display_filter": "frame.number == 5779", "tcp_stream": 83 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-b2792dde1de3a8d3d8190932", "type": "url", "value": "http://download.windowsupdate.com/c/msdownload/update/others/2022/01/35969515_2975e5b79f9857b7a2d7aa07e0d43359735c8e80.cab", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1641572058.269626000", "last_seen_epoch": "1641572058.269626000", "evidence": [ { "frame_number": 5058, "timestamp_epoch": "1641572058.269626000", "display_filter": "frame.number == 5058", "tcp_stream": 69 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-33e8859b9d6f9005fd4d82e0", "type": "url", "value": "http://download.windowsupdate.com/c/msdownload/update/others/2022/01/35969516_5bcaf676a3e98426394e538836033ea5ce2bb8c3.cab", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1641572058.247368000", "last_seen_epoch": "1641572058.247368000", "evidence": [ { "frame_number": 5047, "timestamp_epoch": "1641572058.247368000", "display_filter": "frame.number == 5047", "tcp_stream": 69 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-14cde320b1420d33cab1cdea", "type": "url", "value": "http://download.windowsupdate.com/c/msdownload/update/others/2022/01/35969632_c422aaaf8becdd90e50fb6936708c77c7f97631f.cab", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1641572058.294727000", "last_seen_epoch": "1641572058.294727000", "evidence": [ { "frame_number": 5069, "timestamp_epoch": "1641572058.294727000", "display_filter": "frame.number == 5069", "tcp_stream": 69 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-f936310561cd13ee45ca7b20", "type": "user_agent", "value": "Microsoft-CryptoAPI/10.0", "roles": [ "http-client" ], "is_private": null, "first_seen_epoch": "1641572117.914696000", "last_seen_epoch": "1641572117.914696000", "evidence": [ { "frame_number": 5779, "timestamp_epoch": "1641572117.914696000", "display_filter": "frame.number == 5779", "tcp_stream": 83 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-e1d5eda19e468a4e136b22f9", "type": "user_agent", "value": "Microsoft-Delivery-Optimization/10.0", "roles": [ "http-client" ], "is_private": null, "first_seen_epoch": "1641572062.462443000", "last_seen_epoch": "1641572062.491933000", "evidence": [ { "frame_number": 5309, "timestamp_epoch": "1641572062.462443000", "display_filter": "frame.number == 5309", "tcp_stream": 76 }, { "frame_number": 5313, "timestamp_epoch": "1641572062.465939000", "display_filter": "frame.number == 5313", "tcp_stream": 77 }, { "frame_number": 5317, "timestamp_epoch": "1641572062.491933000", "display_filter": "frame.number == 5317", "tcp_stream": 76 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-842fd2d5a1df8af4315064c5", "type": "user_agent", "value": "Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.32", "roles": [ "http-client" ], "is_private": null, "first_seen_epoch": "1641572058.247368000", "last_seen_epoch": "1641572058.294727000", "evidence": [ { "frame_number": 5047, "timestamp_epoch": "1641572058.247368000", "display_filter": "frame.number == 5047", "tcp_stream": 69 }, { "frame_number": 5058, "timestamp_epoch": "1641572058.269626000", "display_filter": "frame.number == 5058", "tcp_stream": 69 }, { "frame_number": 5069, "timestamp_epoch": "1641572058.294727000", "display_filter": "frame.number == 5069", "tcp_stream": 69 } ], "enrichment_state": "not_requested" } ], "findings": [ { "finding_id": "finding-d7b07e629e8e0f6702dd148e", "rule_id": "script-or-executable-transfer", "rule_version": "pcap-rules-v3", "severity": "medium", "title": "Script, archive, or executable transfer candidate", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "confidence": 0.86, "status": "candidate", "evidence": [ { "frame_number": 5309, "timestamp_epoch": "1641572062.462443000", "display_filter": "frame.number == 5309", "tcp_stream": 76 }, { "frame_number": 5315, "timestamp_epoch": "1641572062.488577000", "display_filter": "frame.number == 5315", "tcp_stream": 76 }, { "frame_number": 5317, "timestamp_epoch": "1641572062.491933000", "display_filter": "frame.number == 5317", "tcp_stream": 76 }, { "frame_number": 5636, "timestamp_epoch": "1641572062.587068000", "display_filter": "frame.number == 5636", "tcp_stream": 76 } ], "metrics": { "response_count": 2, "source": "23.38.189.225", "destination": "192.168.1.216", "uri": "/c/msdownload/update/software/defu/2022/01/am_delta_patch_1.355.1569.0_f5fe52e10a18f6ce4bc39541e4aae4a97c270c81.exe", "content_type": "application/octet-stream", "declared_body_bytes": 307634 } }, { "finding_id": "finding-a5d772a1518cadd8ca9a6ccd", "rule_id": "script-or-executable-transfer", "rule_version": "pcap-rules-v3", "severity": "medium", "title": "Script, archive, or executable transfer candidate", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "confidence": 0.86, "status": "candidate", "evidence": [ { "frame_number": 5313, "timestamp_epoch": "1641572062.465939000", "display_filter": "frame.number == 5313", "tcp_stream": 77 }, { "frame_number": 5316, "timestamp_epoch": "1641572062.488580000", "display_filter": "frame.number == 5316", "tcp_stream": 77 } ], "metrics": { "response_count": 1, "source": "23.38.189.201", "destination": "192.168.1.216", "uri": "/c/msdownload/update/software/defu/2022/01/am_delta_patch_1.355.1569.0_f5fe52e10a18f6ce4bc39541e4aae4a97c270c81.exe", "content_type": "application/octet-stream", "declared_body_bytes": 2 } }, { "finding_id": "finding-2629b43176825e7ba8783aaf", "rule_id": "directory-service-activity", "rule_version": "pcap-rules-v3", "severity": "low", "title": "Directory-service protocol activity", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "confidence": 0.95, "status": "candidate", "evidence": [ { "frame_number": 246, "timestamp_epoch": "1641571451.003845000", "display_filter": "frame.number == 246", "tcp_stream": 6 }, { "frame_number": 253, "timestamp_epoch": "1641571451.004569000", "display_filter": "frame.number == 253", "tcp_stream": 6 }, { "frame_number": 254, "timestamp_epoch": "1641571451.004734000", "display_filter": "frame.number == 254", "tcp_stream": 10 }, { "frame_number": 257, "timestamp_epoch": "1641571451.005072000", "display_filter": "frame.number == 257", "tcp_stream": 6 }, { "frame_number": 262, "timestamp_epoch": "1641571451.005520000", "display_filter": "frame.number == 262", "tcp_stream": 6 }, { "frame_number": 263, "timestamp_epoch": "1641571451.005596000", "display_filter": "frame.number == 263", "tcp_stream": 10 }, { "frame_number": 265, "timestamp_epoch": "1641571451.005981000", "display_filter": "frame.number == 265", "tcp_stream": 10 }, { "frame_number": 280, "timestamp_epoch": "1641571451.008749000", "display_filter": "frame.number == 280", "tcp_stream": 6 }, { "frame_number": 284, "timestamp_epoch": "1641571451.011706000", "display_filter": "frame.number == 284", "tcp_stream": 6 }, { "frame_number": 286, "timestamp_epoch": "1641571451.014021000", "display_filter": "frame.number == 286", "tcp_stream": 6 }, { "frame_number": 330, "timestamp_epoch": "1641571451.128893000", "display_filter": "frame.number == 330", "tcp_stream": 19 }, { "frame_number": 337, "timestamp_epoch": "1641571451.129893000", "display_filter": "frame.number == 337", "tcp_stream": 19 }, { "frame_number": 339, "timestamp_epoch": "1641571451.130453000", "display_filter": "frame.number == 339", "tcp_stream": 19 }, { "frame_number": 341, "timestamp_epoch": "1641571451.130833000", "display_filter": "frame.number == 341", "tcp_stream": 19 }, { "frame_number": 622, "timestamp_epoch": "1641571454.555556000", "display_filter": "frame.number == 622", "tcp_stream": 31 }, { "frame_number": 624, "timestamp_epoch": "1641571454.556869000", "display_filter": "frame.number == 624", "tcp_stream": 31 }, { "frame_number": 626, "timestamp_epoch": "1641571454.557533000", "display_filter": "frame.number == 626", "tcp_stream": 31 }, { "frame_number": 630, "timestamp_epoch": "1641571454.559408000", "display_filter": "frame.number == 630", "tcp_stream": 31 }, { "frame_number": 632, "timestamp_epoch": "1641571454.559994000", "display_filter": "frame.number == 632", "tcp_stream": 31 }, { "frame_number": 634, "timestamp_epoch": "1641571454.560773000", "display_filter": "frame.number == 634", "tcp_stream": 31 }, { "frame_number": 903, "timestamp_epoch": "1641571491.751288000", "display_filter": "frame.number == 903", "tcp_stream": 10 }, { "frame_number": 905, "timestamp_epoch": "1641571491.751833000", "display_filter": "frame.number == 905", "tcp_stream": 10 }, { "frame_number": 907, "timestamp_epoch": "1641571491.752292000", "display_filter": "frame.number == 907", "tcp_stream": 10 }, { "frame_number": 910, "timestamp_epoch": "1641571491.752713000", "display_filter": "frame.number == 910", "tcp_stream": 10 }, { "frame_number": 1283, "timestamp_epoch": "1641571552.683126000", "display_filter": "frame.number == 1283", "tcp_stream": 59 }, { "frame_number": 1285, "timestamp_epoch": "1641571552.683986000", "display_filter": "frame.number == 1285", "tcp_stream": 59 }, { "frame_number": 1287, "timestamp_epoch": "1641571552.684546000", "display_filter": "frame.number == 1287", "tcp_stream": 59 }, { "frame_number": 1291, "timestamp_epoch": "1641571552.686361000", "display_filter": "frame.number == 1291", "tcp_stream": 59 }, { "frame_number": 1293, "timestamp_epoch": "1641571552.687064000", "display_filter": "frame.number == 1293", "tcp_stream": 59 }, { "frame_number": 1295, "timestamp_epoch": "1641571552.687556000", "display_filter": "frame.number == 1295", "tcp_stream": 59 } ], "metrics": { "source": "192.168.1.2", "destination": "192.168.1.216", "protocol": "drsuapi", "event_count": 30, "operation_numbers": [ "0", "1", "12", "13", "30" ] } }, { "finding_id": "finding-9db47598ea52192f7844b3b1", "rule_id": "directory-service-activity", "rule_version": "pcap-rules-v3", "severity": "low", "title": "Directory-service protocol activity", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "confidence": 0.95, "status": "candidate", "evidence": [ { "frame_number": 29, "timestamp_epoch": "1641571449.760917000", "display_filter": "frame.number == 29", "tcp_stream": 0 }, { "frame_number": 191, "timestamp_epoch": "1641571450.989667000", "display_filter": "frame.number == 191", "tcp_stream": 15 }, { "frame_number": 213, "timestamp_epoch": "1641571450.993333000", "display_filter": "frame.number == 213", "tcp_stream": 15 }, { "frame_number": 219, "timestamp_epoch": "1641571450.994494000", "display_filter": "frame.number == 219", "tcp_stream": 15 }, { "frame_number": 221, "timestamp_epoch": "1641571450.995376000", "display_filter": "frame.number == 221", "tcp_stream": 15 }, { "frame_number": 266, "timestamp_epoch": "1641571451.006109000", "display_filter": "frame.number == 266", "tcp_stream": 0 }, { "frame_number": 336, "timestamp_epoch": "1641571451.129832000", "display_filter": "frame.number == 336", "tcp_stream": 15 }, { "frame_number": 357, "timestamp_epoch": "1641571451.296908000", "display_filter": "frame.number == 357", "tcp_stream": 15 }, { "frame_number": 373, "timestamp_epoch": "1641571451.429677000", "display_filter": "frame.number == 373", "tcp_stream": 15 }, { "frame_number": 382, "timestamp_epoch": "1641571451.460801000", "display_filter": "frame.number == 382", "tcp_stream": 15 }, { "frame_number": 384, "timestamp_epoch": "1641571451.461821000", "display_filter": "frame.number == 384", "tcp_stream": 15 }, { "frame_number": 401, "timestamp_epoch": "1641571452.071453000", "display_filter": "frame.number == 401", "tcp_stream": 25 }, { "frame_number": 406, "timestamp_epoch": "1641571452.073968000", "display_filter": "frame.number == 406", "tcp_stream": 25 }, { "frame_number": 422, "timestamp_epoch": "1641571452.365154000", "display_filter": "frame.number == 422", "tcp_stream": 25 }, { "frame_number": 429, "timestamp_epoch": "1641571452.369088000", "display_filter": "frame.number == 429", "tcp_stream": 27 }, { "frame_number": 431, "timestamp_epoch": "1641571452.369795000", "display_filter": "frame.number == 431", "tcp_stream": 27 }, { "frame_number": 433, "timestamp_epoch": "1641571452.370428000", "display_filter": "frame.number == 433", "tcp_stream": 27 }, { "frame_number": 435, "timestamp_epoch": "1641571452.371863000", "display_filter": "frame.number == 435", "tcp_stream": 25 }, { "frame_number": 640, "timestamp_epoch": "1641571454.565359000", "display_filter": "frame.number == 640", "tcp_stream": 32 }, { "frame_number": 645, "timestamp_epoch": "1641571454.567281000", "display_filter": "frame.number == 645", "tcp_stream": 32 }, { "frame_number": 647, "timestamp_epoch": "1641571454.568025000", "display_filter": "frame.number == 647", "tcp_stream": 32 }, { "frame_number": 649, "timestamp_epoch": "1641571454.568648000", "display_filter": "frame.number == 649", "tcp_stream": 32 }, { "frame_number": 651, "timestamp_epoch": "1641571454.569313000", "display_filter": "frame.number == 651", "tcp_stream": 32 }, { "frame_number": 658, "timestamp_epoch": "1641571454.575321000", "display_filter": "frame.number == 658", "tcp_stream": 33 }, { "frame_number": 662, "timestamp_epoch": "1641571454.576692000", "display_filter": "frame.number == 662", "tcp_stream": 33 }, { "frame_number": 665, "timestamp_epoch": "1641571454.577451000", "display_filter": "frame.number == 665", "tcp_stream": 33 }, { "frame_number": 706, "timestamp_epoch": "1641571460.157120000", "display_filter": "frame.number == 706", "tcp_stream": 34 }, { "frame_number": 711, "timestamp_epoch": "1641571460.159345000", "display_filter": "frame.number == 711", "tcp_stream": 34 }, { "frame_number": 713, "timestamp_epoch": "1641571460.162077000", "display_filter": "frame.number == 713", "tcp_stream": 34 }, { "frame_number": 715, "timestamp_epoch": "1641571460.162667000", "display_filter": "frame.number == 715", "tcp_stream": 34 }, { "frame_number": 717, "timestamp_epoch": "1641571460.163177000", "display_filter": "frame.number == 717", "tcp_stream": 34 }, { "frame_number": 719, "timestamp_epoch": "1641571460.163665000", "display_filter": "frame.number == 719", "tcp_stream": 34 }, { "frame_number": 721, "timestamp_epoch": "1641571460.164190000", "display_filter": "frame.number == 721", "tcp_stream": 34 }, { "frame_number": 1009, "timestamp_epoch": "1641571492.072146000", "display_filter": "frame.number == 1009", "tcp_stream": 49 }, { "frame_number": 1011, "timestamp_epoch": "1641571492.078889000", "display_filter": "frame.number == 1011", "tcp_stream": 49 }, { "frame_number": 1018, "timestamp_epoch": "1641571492.088787000", "display_filter": "frame.number == 1018", "tcp_stream": 50 }, { "frame_number": 1020, "timestamp_epoch": "1641571492.090063000", "display_filter": "frame.number == 1020", "tcp_stream": 50 }, { "frame_number": 1022, "timestamp_epoch": "1641571492.090556000", "display_filter": "frame.number == 1022", "tcp_stream": 50 }, { "frame_number": 1024, "timestamp_epoch": "1641571492.091320000", "display_filter": "frame.number == 1024", "tcp_stream": 49 }, { "frame_number": 1301, "timestamp_epoch": "1641571552.690387000", "display_filter": "frame.number == 1301", "tcp_stream": 60 }, { "frame_number": 1306, "timestamp_epoch": "1641571552.692352000", "display_filter": "frame.number == 1306", "tcp_stream": 60 }, { "frame_number": 1308, "timestamp_epoch": "1641571552.693351000", "display_filter": "frame.number == 1308", "tcp_stream": 60 }, { "frame_number": 1310, "timestamp_epoch": "1641571552.693923000", "display_filter": "frame.number == 1310", "tcp_stream": 60 }, { "frame_number": 1312, "timestamp_epoch": "1641571552.694537000", "display_filter": "frame.number == 1312", "tcp_stream": 60 }, { "frame_number": 1319, "timestamp_epoch": "1641571552.698593000", "display_filter": "frame.number == 1319", "tcp_stream": 61 }, { "frame_number": 1323, "timestamp_epoch": "1641571552.699332000", "display_filter": "frame.number == 1323", "tcp_stream": 61 }, { "frame_number": 1326, "timestamp_epoch": "1641571552.700008000", "display_filter": "frame.number == 1326", "tcp_stream": 61 } ], "metrics": { "source": "192.168.1.2", "destination": "192.168.1.216", "protocol": "ldap", "event_count": 47, "operation_numbers": [ "", "1", "4,19,19,19,5", "4,5", "5" ] } }, { "finding_id": "finding-91ee3e149e111692dc445e62", "rule_id": "directory-service-activity", "rule_version": "pcap-rules-v3", "severity": "low", "title": "Directory-service protocol activity", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "confidence": 0.95, "status": "candidate", "evidence": [ { "frame_number": 931, "timestamp_epoch": "1641571491.762873000", "display_filter": "frame.number == 931", "tcp_stream": 43 }, { "frame_number": 933, "timestamp_epoch": "1641571491.763490000", "display_filter": "frame.number == 933", "tcp_stream": 43 }, { "frame_number": 935, "timestamp_epoch": "1641571491.764023000", "display_filter": "frame.number == 935", "tcp_stream": 43 }, { "frame_number": 937, "timestamp_epoch": "1641571491.765022000", "display_filter": "frame.number == 937", "tcp_stream": 43 }, { "frame_number": 939, "timestamp_epoch": "1641571491.765641000", "display_filter": "frame.number == 939", "tcp_stream": 43 }, { "frame_number": 941, "timestamp_epoch": "1641571491.766298000", "display_filter": "frame.number == 941", "tcp_stream": 43 }, { "frame_number": 943, "timestamp_epoch": "1641571491.766964000", "display_filter": "frame.number == 943", "tcp_stream": 43 }, { "frame_number": 945, "timestamp_epoch": "1641571491.767646000", "display_filter": "frame.number == 945", "tcp_stream": 43 }, { "frame_number": 947, "timestamp_epoch": "1641571491.768351000", "display_filter": "frame.number == 947", "tcp_stream": 43 }, { "frame_number": 949, "timestamp_epoch": "1641571491.769000000", "display_filter": "frame.number == 949", "tcp_stream": 43 }, { "frame_number": 951, "timestamp_epoch": "1641571491.769604000", "display_filter": "frame.number == 951", "tcp_stream": 43 }, { "frame_number": 953, "timestamp_epoch": "1641571491.770231000", "display_filter": "frame.number == 953", "tcp_stream": 43 }, { "frame_number": 955, "timestamp_epoch": "1641571491.770746000", "display_filter": "frame.number == 955", "tcp_stream": 43 }, { "frame_number": 957, "timestamp_epoch": "1641571491.771295000", "display_filter": "frame.number == 957", "tcp_stream": 43 }, { "frame_number": 959, "timestamp_epoch": "1641571491.771855000", "display_filter": "frame.number == 959", "tcp_stream": 43 } ], "metrics": { "source": "192.168.1.2", "destination": "192.168.1.216", "protocol": "samr", "event_count": 15, "operation_numbers": [ "1", "16", "17", "3", "34", "36", "39", "5", "6", "64", "7" ] } }, { "finding_id": "finding-f921ff23cf0e8136c3155ef5", "rule_id": "directory-service-activity", "rule_version": "pcap-rules-v3", "severity": "low", "title": "Directory-service protocol activity", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "confidence": 0.95, "status": "candidate", "evidence": [ { "frame_number": 241, "timestamp_epoch": "1641571451.003468000", "display_filter": "frame.number == 241", "tcp_stream": 6 }, { "frame_number": 251, "timestamp_epoch": "1641571451.004195000", "display_filter": "frame.number == 251", "tcp_stream": 6 }, { "frame_number": 252, "timestamp_epoch": "1641571451.004462000", "display_filter": "frame.number == 252", "tcp_stream": 10 }, { "frame_number": 255, "timestamp_epoch": "1641571451.004759000", "display_filter": "frame.number == 255", "tcp_stream": 6 }, { "frame_number": 256, "timestamp_epoch": "1641571451.005062000", "display_filter": "frame.number == 256", "tcp_stream": 10 }, { "frame_number": 261, "timestamp_epoch": "1641571451.005293000", "display_filter": "frame.number == 261", "tcp_stream": 6 }, { "frame_number": 264, "timestamp_epoch": "1641571451.005796000", "display_filter": "frame.number == 264", "tcp_stream": 10 }, { "frame_number": 279, "timestamp_epoch": "1641571451.008528000", "display_filter": "frame.number == 279", "tcp_stream": 6 }, { "frame_number": 283, "timestamp_epoch": "1641571451.011418000", "display_filter": "frame.number == 283", "tcp_stream": 6 }, { "frame_number": 285, "timestamp_epoch": "1641571451.013823000", "display_filter": "frame.number == 285", "tcp_stream": 6 }, { "frame_number": 329, "timestamp_epoch": "1641571451.128651000", "display_filter": "frame.number == 329", "tcp_stream": 19 }, { "frame_number": 331, "timestamp_epoch": "1641571451.129114000", "display_filter": "frame.number == 331", "tcp_stream": 19 }, { "frame_number": 338, "timestamp_epoch": "1641571451.130065000", "display_filter": "frame.number == 338", "tcp_stream": 19 }, { "frame_number": 340, "timestamp_epoch": "1641571451.130682000", "display_filter": "frame.number == 340", "tcp_stream": 19 }, { "frame_number": 621, "timestamp_epoch": "1641571454.554962000", "display_filter": "frame.number == 621", "tcp_stream": 31 }, { "frame_number": 623, "timestamp_epoch": "1641571454.556207000", "display_filter": "frame.number == 623", "tcp_stream": 31 }, { "frame_number": 625, "timestamp_epoch": "1641571454.557228000", "display_filter": "frame.number == 625", "tcp_stream": 31 }, { "frame_number": 629, "timestamp_epoch": "1641571454.559129000", "display_filter": "frame.number == 629", "tcp_stream": 31 }, { "frame_number": 631, "timestamp_epoch": "1641571454.559666000", "display_filter": "frame.number == 631", "tcp_stream": 31 }, { "frame_number": 633, "timestamp_epoch": "1641571454.560505000", "display_filter": "frame.number == 633", "tcp_stream": 31 }, { "frame_number": 902, "timestamp_epoch": "1641571491.751061000", "display_filter": "frame.number == 902", "tcp_stream": 10 }, { "frame_number": 904, "timestamp_epoch": "1641571491.751508000", "display_filter": "frame.number == 904", "tcp_stream": 10 }, { "frame_number": 906, "timestamp_epoch": "1641571491.752019000", "display_filter": "frame.number == 906", "tcp_stream": 10 }, { "frame_number": 908, "timestamp_epoch": "1641571491.752465000", "display_filter": "frame.number == 908", "tcp_stream": 10 }, { "frame_number": 1282, "timestamp_epoch": "1641571552.682757000", "display_filter": "frame.number == 1282", "tcp_stream": 59 }, { "frame_number": 1284, "timestamp_epoch": "1641571552.683595000", "display_filter": "frame.number == 1284", "tcp_stream": 59 }, { "frame_number": 1286, "timestamp_epoch": "1641571552.684309000", "display_filter": "frame.number == 1286", "tcp_stream": 59 }, { "frame_number": 1290, "timestamp_epoch": "1641571552.686083000", "display_filter": "frame.number == 1290", "tcp_stream": 59 }, { "frame_number": 1292, "timestamp_epoch": "1641571552.686716000", "display_filter": "frame.number == 1292", "tcp_stream": 59 }, { "frame_number": 1294, "timestamp_epoch": "1641571552.687333000", "display_filter": "frame.number == 1294", "tcp_stream": 59 } ], "metrics": { "source": "192.168.1.216", "destination": "192.168.1.2", "protocol": "drsuapi", "event_count": 30, "operation_numbers": [ "0", "1", "12", "13", "30" ] } }, { "finding_id": "finding-9d5591aa667e378ce0d979d4", "rule_id": "directory-service-activity", "rule_version": "pcap-rules-v3", "severity": "low", "title": "Directory-service protocol activity", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "confidence": 0.95, "status": "candidate", "evidence": [ { "frame_number": 27, "timestamp_epoch": "1641571449.760632000", "display_filter": "frame.number == 27", "tcp_stream": 0 }, { "frame_number": 189, "timestamp_epoch": "1641571450.989411000", "display_filter": "frame.number == 189", "tcp_stream": 15 }, { "frame_number": 210, "timestamp_epoch": "1641571450.992655000", "display_filter": "frame.number == 210", "tcp_stream": 15 }, { "frame_number": 218, "timestamp_epoch": "1641571450.994306000", "display_filter": "frame.number == 218", "tcp_stream": 15 }, { "frame_number": 220, "timestamp_epoch": "1641571450.995080000", "display_filter": "frame.number == 220", "tcp_stream": 15 }, { "frame_number": 259, "timestamp_epoch": "1641571451.005120000", "display_filter": "frame.number == 259", "tcp_stream": 0 }, { "frame_number": 274, "timestamp_epoch": "1641571451.007930000", "display_filter": "frame.number == 274", "tcp_stream": 0 }, { "frame_number": 333, "timestamp_epoch": "1641571451.129551000", "display_filter": "frame.number == 333", "tcp_stream": 15 }, { "frame_number": 354, "timestamp_epoch": "1641571451.296482000", "display_filter": "frame.number == 354", "tcp_stream": 15 }, { "frame_number": 370, "timestamp_epoch": "1641571451.429300000", "display_filter": "frame.number == 370", "tcp_stream": 15 }, { "frame_number": 379, "timestamp_epoch": "1641571451.460400000", "display_filter": "frame.number == 379", "tcp_stream": 15 }, { "frame_number": 383, "timestamp_epoch": "1641571451.461512000", "display_filter": "frame.number == 383", "tcp_stream": 15 }, { "frame_number": 385, "timestamp_epoch": "1641571451.462109000", "display_filter": "frame.number == 385", "tcp_stream": 15 }, { "frame_number": 399, "timestamp_epoch": "1641571452.071100000", "display_filter": "frame.number == 399", "tcp_stream": 25 }, { "frame_number": 404, "timestamp_epoch": "1641571452.073024000", "display_filter": "frame.number == 404", "tcp_stream": 25 }, { "frame_number": 421, "timestamp_epoch": "1641571452.364742000", "display_filter": "frame.number == 421", "tcp_stream": 25 }, { "frame_number": 427, "timestamp_epoch": "1641571452.367990000", "display_filter": "frame.number == 427", "tcp_stream": 27 }, { "frame_number": 430, "timestamp_epoch": "1641571452.369578000", "display_filter": "frame.number == 430", "tcp_stream": 27 }, { "frame_number": 432, "timestamp_epoch": "1641571452.370081000", "display_filter": "frame.number == 432", "tcp_stream": 27 }, { "frame_number": 434, "timestamp_epoch": "1641571452.371397000", "display_filter": "frame.number == 434", "tcp_stream": 25 }, { "frame_number": 586, "timestamp_epoch": "1641571452.658399000", "display_filter": "frame.number == 586", "tcp_stream": 27 }, { "frame_number": 591, "timestamp_epoch": "1641571452.719218000", "display_filter": "frame.number == 591", "tcp_stream": 25 }, { "frame_number": 638, "timestamp_epoch": "1641571454.564967000", "display_filter": "frame.number == 638", "tcp_stream": 32 }, { "frame_number": 643, "timestamp_epoch": "1641571454.566408000", "display_filter": "frame.number == 643", "tcp_stream": 32 }, { "frame_number": 646, "timestamp_epoch": "1641571454.567691000", "display_filter": "frame.number == 646", "tcp_stream": 32 }, { "frame_number": 648, "timestamp_epoch": "1641571454.568306000", "display_filter": "frame.number == 648", "tcp_stream": 32 }, { "frame_number": 650, "timestamp_epoch": "1641571454.568981000", "display_filter": "frame.number == 650", "tcp_stream": 32 }, { "frame_number": 656, "timestamp_epoch": "1641571454.574377000", "display_filter": "frame.number == 656", "tcp_stream": 33 }, { "frame_number": 659, "timestamp_epoch": "1641571454.576382000", "display_filter": "frame.number == 659", "tcp_stream": 33 }, { "frame_number": 664, "timestamp_epoch": "1641571454.577162000", "display_filter": "frame.number == 664", "tcp_stream": 33 }, { "frame_number": 666, "timestamp_epoch": "1641571454.577816000", "display_filter": "frame.number == 666", "tcp_stream": 33 }, { "frame_number": 670, "timestamp_epoch": "1641571454.578524000", "display_filter": "frame.number == 670", "tcp_stream": 32 }, { "frame_number": 704, "timestamp_epoch": "1641571460.156613000", "display_filter": "frame.number == 704", "tcp_stream": 34 }, { "frame_number": 709, "timestamp_epoch": "1641571460.158393000", "display_filter": "frame.number == 709", "tcp_stream": 34 }, { "frame_number": 712, "timestamp_epoch": "1641571460.161773000", "display_filter": "frame.number == 712", "tcp_stream": 34 }, { "frame_number": 714, "timestamp_epoch": "1641571460.162404000", "display_filter": "frame.number == 714", "tcp_stream": 34 }, { "frame_number": 716, "timestamp_epoch": "1641571460.162900000", "display_filter": "frame.number == 716", "tcp_stream": 34 }, { "frame_number": 718, "timestamp_epoch": "1641571460.163374000", "display_filter": "frame.number == 718", "tcp_stream": 34 }, { "frame_number": 720, "timestamp_epoch": "1641571460.163945000", "display_filter": "frame.number == 720", "tcp_stream": 34 }, { "frame_number": 752, "timestamp_epoch": "1641571460.176928000", "display_filter": "frame.number == 752", "tcp_stream": 34 }, { "frame_number": 1007, "timestamp_epoch": "1641571492.071286000", "display_filter": "frame.number == 1007", "tcp_stream": 49 }, { "frame_number": 1010, "timestamp_epoch": "1641571492.078435000", "display_filter": "frame.number == 1010", "tcp_stream": 49 }, { "frame_number": 1016, "timestamp_epoch": "1641571492.087887000", "display_filter": "frame.number == 1016", "tcp_stream": 50 }, { "frame_number": 1019, "timestamp_epoch": "1641571492.089840000", "display_filter": "frame.number == 1019", "tcp_stream": 50 }, { "frame_number": 1021, "timestamp_epoch": "1641571492.090311000", "display_filter": "frame.number == 1021", "tcp_stream": 50 }, { "frame_number": 1023, "timestamp_epoch": "1641571492.090801000", "display_filter": "frame.number == 1023", "tcp_stream": 49 }, { "frame_number": 1027, "timestamp_epoch": "1641571492.410630000", "display_filter": "frame.number == 1027", "tcp_stream": 50 }, { "frame_number": 1031, "timestamp_epoch": "1641571492.418679000", "display_filter": "frame.number == 1031", "tcp_stream": 49 }, { "frame_number": 1299, "timestamp_epoch": "1641571552.690072000", "display_filter": "frame.number == 1299", "tcp_stream": 60 }, { "frame_number": 1304, "timestamp_epoch": "1641571552.691378000", "display_filter": "frame.number == 1304", "tcp_stream": 60 }, { "frame_number": 1307, "timestamp_epoch": "1641571552.692973000", "display_filter": "frame.number == 1307", "tcp_stream": 60 }, { "frame_number": 1309, "timestamp_epoch": "1641571552.693680000", "display_filter": "frame.number == 1309", "tcp_stream": 60 }, { "frame_number": 1311, "timestamp_epoch": "1641571552.694215000", "display_filter": "frame.number == 1311", "tcp_stream": 60 }, { "frame_number": 1317, "timestamp_epoch": "1641571552.697751000", "display_filter": "frame.number == 1317", "tcp_stream": 61 }, { "frame_number": 1320, "timestamp_epoch": "1641571552.699027000", "display_filter": "frame.number == 1320", "tcp_stream": 61 }, { "frame_number": 1325, "timestamp_epoch": "1641571552.699715000", "display_filter": "frame.number == 1325", "tcp_stream": 61 }, { "frame_number": 1327, "timestamp_epoch": "1641571552.700270000", "display_filter": "frame.number == 1327", "tcp_stream": 61 }, { "frame_number": 1330, "timestamp_epoch": "1641571552.700472000", "display_filter": "frame.number == 1330", "tcp_stream": 60 } ], "metrics": { "source": "192.168.1.216", "destination": "192.168.1.2", "protocol": "ldap", "event_count": 58, "operation_numbers": [ "", "0", "2", "3" ] } }, { "finding_id": "finding-e15ebfc8332800559cc11421", "rule_id": "directory-service-activity", "rule_version": "pcap-rules-v3", "severity": "low", "title": "Directory-service protocol activity", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "confidence": 0.95, "status": "candidate", "evidence": [ { "frame_number": 930, "timestamp_epoch": "1641571491.762466000", "display_filter": "frame.number == 930", "tcp_stream": 43 }, { "frame_number": 932, "timestamp_epoch": "1641571491.763188000", "display_filter": "frame.number == 932", "tcp_stream": 43 }, { "frame_number": 934, "timestamp_epoch": "1641571491.763726000", "display_filter": "frame.number == 934", "tcp_stream": 43 }, { "frame_number": 936, "timestamp_epoch": "1641571491.764652000", "display_filter": "frame.number == 936", "tcp_stream": 43 }, { "frame_number": 938, "timestamp_epoch": "1641571491.765254000", "display_filter": "frame.number == 938", "tcp_stream": 43 }, { "frame_number": 940, "timestamp_epoch": "1641571491.765851000", "display_filter": "frame.number == 940", "tcp_stream": 43 }, { "frame_number": 942, "timestamp_epoch": "1641571491.766518000", "display_filter": "frame.number == 942", "tcp_stream": 43 }, { "frame_number": 944, "timestamp_epoch": "1641571491.767254000", "display_filter": "frame.number == 944", "tcp_stream": 43 }, { "frame_number": 946, "timestamp_epoch": "1641571491.767888000", "display_filter": "frame.number == 946", "tcp_stream": 43 }, { "frame_number": 948, "timestamp_epoch": "1641571491.768616000", "display_filter": "frame.number == 948", "tcp_stream": 43 }, { "frame_number": 950, "timestamp_epoch": "1641571491.769247000", "display_filter": "frame.number == 950", "tcp_stream": 43 }, { "frame_number": 952, "timestamp_epoch": "1641571491.769906000", "display_filter": "frame.number == 952", "tcp_stream": 43 }, { "frame_number": 954, "timestamp_epoch": "1641571491.770452000", "display_filter": "frame.number == 954", "tcp_stream": 43 }, { "frame_number": 956, "timestamp_epoch": "1641571491.770996000", "display_filter": "frame.number == 956", "tcp_stream": 43 }, { "frame_number": 958, "timestamp_epoch": "1641571491.771531000", "display_filter": "frame.number == 958", "tcp_stream": 43 } ], "metrics": { "source": "192.168.1.216", "destination": "192.168.1.2", "protocol": "samr", "event_count": 15, "operation_numbers": [ "1", "16", "17", "3", "34", "36", "39", "5", "6", "64", "7" ] } } ], "attack_candidates": [ { "attack_id": "T1105", "name": "Ingress Tool Transfer", "tactic": "command-and-control", "confidence": 0.8, "status": "suggested", "mapping_basis": "versioned-deterministic-rule", "finding_ids": [ "finding-a5d772a1518cadd8ca9a6ccd", "finding-d7b07e629e8e0f6702dd148e" ], "evidence": [ { "frame_number": 5309, "timestamp_epoch": "1641572062.462443000", "display_filter": "frame.number == 5309", "tcp_stream": 76 }, { "frame_number": 5313, "timestamp_epoch": "1641572062.465939000", "display_filter": "frame.number == 5313", "tcp_stream": 77 }, { "frame_number": 5315, "timestamp_epoch": "1641572062.488577000", "display_filter": "frame.number == 5315", "tcp_stream": 76 }, { "frame_number": 5316, "timestamp_epoch": "1641572062.488580000", "display_filter": "frame.number == 5316", "tcp_stream": 77 }, { "frame_number": 5317, "timestamp_epoch": "1641572062.491933000", "display_filter": "frame.number == 5317", "tcp_stream": 76 }, { "frame_number": 5636, "timestamp_epoch": "1641572062.587068000", "display_filter": "frame.number == 5636", "tcp_stream": 76 } ] } ], "actor_leads": [], "coverage": { "event_limits": { "dns": { "returned": 88, "truncated": false }, "http_request": { "returned": 24, "truncated": false }, "http_response": { "returned": 16, "truncated": false }, "tls_client_hello": { "returned": 24, "truncated": false }, "dhcp": { "returned": 2, "truncated": false }, "identity": { "returned": 382, "truncated": false }, "directory_service": { "returned": 195, "truncated": false }, "unclassified_tcp": { "returned": 17, "truncated": false } }, "warnings": [], "encrypted_payload_visibility": "metadata-only", "name_resolution": false, "http_objects": { "exported_objects": 22, "hashed_objects": 22, "unique_hashes": 14, "returned_unique_hashes": 14, "detailed_objects": 14, "compact_hash_index": [], "compact_objects": 0, "omitted_unique_hashes": 0, "unhashed_objects": 0, "hashed_bytes": 3744940, "selection": "content-classified first, then size descending, SHA256 tie-break; deduplicated by full hash; overflow retains a compact hash index", "complete": true }, "complete_within_profile": true, "limitations": [ "Encrypted application contents are not decrypted", "Protocol decoding and heuristic findings do not establish malware family or attribution", "No endpoint execution, persistence, or credential-theft proof without corresponding evidence" ] }, "summary": "Decoded 5880 packets across 27 IP endpoints and 157 transport flows. Observed 88 DNS events, 24 HTTP requests, 24 TLS ClientHello events, and 14 exported HTTP object(s). Deterministic rules produced 8 finding(s): 0 high, 2 medium, and 6 low. Findings are evidence-bound candidates and require analyst review; encrypted payload contents remain unavailable.", "semantic_sha256": "d99f9f0718d2f13b17822949ddc765679358c5ce545ed0bc49ba70534ed25482" }, "context": { "schema_version": "pcap-context-v1", "created_at": "2026-09-19T12:09:31.260950+00:00", "session_id": "91100160-1a16-4165-bf1d-6b5876fb4e11", "source_semantic_sha256": "d99f9f0718d2f13b17822949ddc765679358c5ce545ed0bc49ba70534ed25482", "mode": "local-only", "external_enrichment": { "status": "not-requested", "requests": 0, "reason": "Requires explicit provider consent and privacy review" }, "coverage": { "observables_total": 94, "observables_checked": 94, "observable_limit": 5000, "truncated": false, "matched_observables": 0, "no_exact_match": 94, "prior_cases_checked": 12, "prior_case_limit_reached": false }, "matches": [], "source_actor_links": [], "techniques": [ { "attack_id": "T1105", "name": "Ingress Tool Transfer", "catalog_version_id": 851, "url": "https://attack.mitre.org/techniques/T1105", "platforms": [ "ESXi", "Linux", "macOS", "Network Devices", "Windows" ], "data_sources": [ "WinEventLog:Sysmon", "auditd:SYSCALL", "iptables:LOG", "macos:endpointsecurity", "macos:unifiedlog", "esxi:hostd", "esxi:vmkernel", "NSM:Flow", "snmp:syslog" ], "detection": "", "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--67677c4c-5778-49eb-ae74-1920645b8554", "attack_id": "DET0060", "name": "Detect Ingress Tool Transfers via Behavioral Chain" } ], "detection_links_truncated": false, "status": "catalog-context-not-validation-of-behavior" } ], "cross_case_correlations": [ { "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4", "session_id": "bfa8693a-227f-4f5d-8e70-aff8c425ac42", "source_sha256": "eefc7e61b50e7846f5a3282d7645539d7b2b4b85aa08a09d0b823896c9449d1f", "shared_observables": [ { "type": "domain", "value": "api.msn.com" }, { "type": "domain", "value": "client.wns.windows.com" }, { "type": "domain", "value": "ctldl.windowsupdate.com" }, { "type": "domain", "value": "dns.msftncsi.com" }, { "type": "domain", "value": "fe2cr.update.microsoft.com" }, { "type": "domain", "value": "fe3cr.delivery.mp.microsoft.com" }, { "type": "domain", "value": "pti.store.microsoft.com" }, { "type": "domain", "value": "self.events.data.microsoft.com" }, { "type": "domain", "value": "settings-win.data.microsoft.com" }, { "type": "domain", "value": "v10.events.data.microsoft.com" }, { "type": "domain", "value": "v20.events.data.microsoft.com" }, { "type": "domain", "value": "wns.notify.trafficmanager.net" }, { "type": "domain", "value": "wpad.localdomain" }, { "type": "domain", "value": "www.bing.com" }, { "type": "ipv4", "value": "13.107.21.200" }, { "type": "ipv4", "value": "131.107.255.255" }, { "type": "ipv4", "value": "20.50.80.210" }, { "type": "ipv4", "value": "20.54.89.15" }, { "type": "ipv4", "value": "204.79.197.200" }, { "type": "ipv4", "value": "204.79.197.203" }, { "type": "ipv4", "value": "224.0.0.22" }, { "type": "ipv4", "value": "224.0.0.251" }, { "type": "ipv4", "value": "224.0.0.252" }, { "type": "ipv4", "value": "239.255.255.250" }, { "type": "ipv4", "value": "40.83.240.146" }, { "type": "ipv4", "value": "52.183.220.149" }, { "type": "ipv4", "value": "52.238.248.1" } ], "shared_count": 27, "status": "shared-observation-not-common-campaign" }, { "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807", "session_id": "2571013a-e926-41d7-b13c-b180a0720a96", "source_sha256": "d9b67e18bca13cf6135874fd81d167403c7cb6b8a422679948db914e9959b90d", "shared_observables": [ { "type": "domain", "value": "api.msn.com" }, { "type": "domain", "value": "client.wns.windows.com" }, { "type": "domain", "value": "ctldl.windowsupdate.com" }, { "type": "domain", "value": "dns.msftncsi.com" }, { "type": "domain", "value": "settings-win.data.microsoft.com" }, { "type": "domain", "value": "v10.events.data.microsoft.com" }, { "type": "domain", "value": "wns.notify.trafficmanager.net" }, { "type": "domain", "value": "www.bing.com" }, { "type": "ipv4", "value": "13.107.21.200" }, { "type": "ipv4", "value": "131.107.255.255" }, { "type": "ipv4", "value": "204.79.197.200" }, { "type": "ipv4", "value": "204.79.197.203" }, { "type": "ipv4", "value": "224.0.0.22" }, { "type": "ipv4", "value": "224.0.0.251" }, { "type": "ipv4", "value": "224.0.0.252" }, { "type": "ipv4", "value": "239.255.255.250" }, { "type": "ipv4", "value": "40.83.240.146" }, { "type": "ipv4", "value": "52.183.220.149" } ], "shared_count": 18, "status": "shared-observation-not-common-campaign" }, { "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "session_id": "ce8cf5b8-2927-4b30-804c-2fedaec840f1", "source_sha256": "c48854c24223cf7b4e9880ea72a21a877e4138e4ce36df7b7656e5c6c4043f68", "shared_observables": [ { "type": "domain", "value": "api.msn.com" }, { "type": "domain", "value": "client.wns.windows.com" }, { "type": "domain", "value": "pti.store.microsoft.com" }, { "type": "domain", "value": "settings-win.data.microsoft.com" }, { "type": "domain", "value": "v10.events.data.microsoft.com" }, { "type": "domain", "value": "v20.events.data.microsoft.com" }, { "type": "domain", "value": "wns.notify.trafficmanager.net" }, { "type": "domain", "value": "www.bing.com" }, { "type": "ipv4", "value": "204.79.197.203" }, { "type": "ipv4", "value": "224.0.0.22" }, { "type": "ipv4", "value": "224.0.0.251" }, { "type": "ipv4", "value": "224.0.0.252" }, { "type": "ipv4", "value": "239.255.255.250" } ], "shared_count": 13, "status": "shared-observation-not-common-campaign" }, { "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "session_id": "a894fbbc-d0d5-4309-bd04-2eda8773adfa", "source_sha256": "e154de6895c5f0a9edd07b1279b33014507236dbb44a449790c255b87a327a3c", "shared_observables": [ { "type": "domain", "value": "api.msn.com" }, { "type": "domain", "value": "client.wns.windows.com" }, { "type": "domain", "value": "fe2cr.update.microsoft.com" }, { "type": "domain", "value": "fe3cr.delivery.mp.microsoft.com" }, { "type": "domain", "value": "pti.store.microsoft.com" }, { "type": "domain", "value": "settings-win.data.microsoft.com" }, { "type": "domain", "value": "v10.events.data.microsoft.com" }, { "type": "domain", "value": "v20.events.data.microsoft.com" }, { "type": "domain", "value": "wns.notify.trafficmanager.net" }, { "type": "domain", "value": "www.bing.com" }, { "type": "ipv4", "value": "204.79.197.203" }, { "type": "ipv4", "value": "224.0.0.22" }, { "type": "ipv4", "value": "224.0.0.251" }, { "type": "ipv4", "value": "224.0.0.252" }, { "type": "ipv4", "value": "239.255.255.250" } ], "shared_count": 15, "status": "shared-observation-not-common-campaign" }, { "analysis_id": "faf041c3-70e0-4a01-8780-10917e5e187c", "session_id": "df6c55a2-3630-4e95-82d0-0eebb41c3b51", "source_sha256": "8fee06d0b1686faab4364f5b7a741e736ad7e713d5ca9299ff9161a4b4d4862e", "shared_observables": [ { "type": "domain", "value": "api.msn.com" }, { "type": "domain", "value": "client.wns.windows.com" }, { "type": "domain", "value": "ctldl.windowsupdate.com" }, { "type": "domain", "value": "dns.msftncsi.com" }, { "type": "domain", "value": "download.windowsupdate.com" }, { "type": "domain", "value": "pti.store.microsoft.com" }, { "type": "domain", "value": "settings-win.data.microsoft.com" }, { "type": "domain", "value": "v10.events.data.microsoft.com" }, { "type": "domain", "value": "www.bing.com" }, { "type": "ipv4", "value": "131.107.255.255" }, { "type": "ipv4", "value": "20.189.173.1" }, { "type": "ipv4", "value": "204.79.197.203" }, { "type": "ipv4", "value": "224.0.0.251" }, { "type": "ipv4", "value": "224.0.0.252" } ], "shared_count": 14, "status": "shared-observation-not-common-campaign" }, { "analysis_id": "08324647-35af-4af2-8d82-4387eec03918", "session_id": "426471ed-5e63-4b7e-ac6c-d36e060a4739", "source_sha256": "a38267943a7bf3b0e445d7e51cb0a68b3dee797d67081bc9a033f73d079c0f50", "shared_observables": [ { "type": "domain", "value": "api.msn.com" }, { "type": "domain", "value": "client.wns.windows.com" }, { "type": "domain", "value": "ctldl.windowsupdate.com" }, { "type": "domain", "value": "dns.msftncsi.com" }, { "type": "domain", "value": "fe3cr.delivery.mp.microsoft.com" }, { "type": "domain", "value": "v10.events.data.microsoft.com" }, { "type": "domain", "value": "wns.notify.trafficmanager.net" }, { "type": "domain", "value": "www.bing.com" }, { "type": "ipv4", "value": "131.107.255.255" }, { "type": "ipv4", "value": "204.79.197.203" }, { "type": "ipv4", "value": "224.0.0.251" }, { "type": "ipv4", "value": "224.0.0.252" }, { "type": "ipv4", "value": "239.255.255.250" }, { "type": "ipv4", "value": "52.168.112.67" } ], "shared_count": 14, "status": "shared-observation-not-common-campaign" }, { "analysis_id": "616a90fa-f15e-4fcb-8d56-7b8e0eff5785", "session_id": "1ea146b9-1fb6-4be9-8adc-154756a8642c", "source_sha256": "21bb800849459709a7ceb5513573b2b20f090ffccd00eb89b9886feedd47a2df", "shared_observables": [ { "type": "domain", "value": "settings-win.data.microsoft.com" }, { "type": "domain", "value": "v10.events.data.microsoft.com" }, { "type": "domain", "value": "v20.events.data.microsoft.com" }, { "type": "domain", "value": "www.bing.com" }, { "type": "ipv4", "value": "52.168.112.67" } ], "shared_count": 5, "status": "shared-observation-not-common-campaign" }, { "analysis_id": "459e119d-191f-49e8-85ea-c78f9de41826", "session_id": "45dead98-56f7-41bd-bcd0-62bcf13e9f9b", "source_sha256": "0ea6b597732a9ce6af9a7e3adff4512c9a91b4bce27184c8fdeb746f05cce170", "shared_observables": [ { "type": "domain", "value": "api.msn.com" }, { "type": "domain", "value": "au.download.windowsupdate.com" }, { "type": "domain", "value": "client.wns.windows.com" }, { "type": "domain", "value": "ctldl.windowsupdate.com" }, { "type": "domain", "value": "download.windowsupdate.com" }, { "type": "domain", "value": "fe2cr.update.microsoft.com" }, { "type": "domain", "value": "geo.prod.do.dsp.mp.microsoft.com" }, { "type": "domain", "value": "pti.store.microsoft.com" }, { "type": "domain", "value": "settings-win.data.microsoft.com" }, { "type": "domain", "value": "v10.events.data.microsoft.com" }, { "type": "domain", "value": "v20.events.data.microsoft.com" }, { "type": "domain", "value": "wns.notify.trafficmanager.net" }, { "type": "domain", "value": "www.bing.com" }, { "type": "ipv4", "value": "204.79.197.203" }, { "type": "ipv4", "value": "224.0.0.22" }, { "type": "ipv4", "value": "224.0.0.251" }, { "type": "ipv4", "value": "224.0.0.252" }, { "type": "ipv4", "value": "52.168.112.67" } ], "shared_count": 18, "status": "shared-observation-not-common-campaign" }, { "analysis_id": "7a2cfe72-f48d-4894-8a2d-8889cb3b11b2", "session_id": "d201ef05-c1ff-4b51-bfb6-594810367b62", "source_sha256": "3dc470f5490ec15b4024c513e87c67e0b17caeae2a2ce3d83541be24ef407e61", "shared_observables": [ { "type": "domain", "value": "api.msn.com" }, { "type": "domain", "value": "client.wns.windows.com" }, { "type": "domain", "value": "ctldl.windowsupdate.com" }, { "type": "domain", "value": "self.events.data.microsoft.com" }, { "type": "domain", "value": "settings-win.data.microsoft.com" }, { "type": "domain", "value": "v10.events.data.microsoft.com" }, { "type": "domain", "value": "wns.notify.trafficmanager.net" }, { "type": "domain", "value": "www.bing.com" }, { "type": "ipv4", "value": "20.189.173.1" }, { "type": "ipv4", "value": "204.79.197.203" }, { "type": "ipv4", "value": "224.0.0.251" }, { "type": "ipv4", "value": "224.0.0.252" }, { "type": "ipv4", "value": "239.255.255.250" }, { "type": "ipv4", "value": "52.168.112.67" }, { "type": "ipv4", "value": "52.183.220.149" } ], "shared_count": 15, "status": "shared-observation-not-common-campaign" }, { "analysis_id": "81373b30-6a59-49d1-89b0-bad73ed19eaa", "session_id": "28d700f9-1f64-46d0-ab25-5dd6123537fa", "source_sha256": "f755444d0b6eac847e07b73dea0774084b232d8577f536547a12f39b959d7833", "shared_observables": [ { "type": "domain", "value": "api.msn.com" }, { "type": "domain", "value": "client.wns.windows.com" }, { "type": "domain", "value": "dns.msftncsi.com" }, { "type": "domain", "value": "settings-win.data.microsoft.com" }, { "type": "domain", "value": "v10.events.data.microsoft.com" }, { "type": "domain", "value": "v20.events.data.microsoft.com" }, { "type": "domain", "value": "www.bing.com" }, { "type": "ipv4", "value": "131.107.255.255" }, { "type": "ipv4", "value": "204.79.197.203" }, { "type": "ipv4", "value": "224.0.0.251" }, { "type": "ipv4", "value": "224.0.0.252" }, { "type": "ipv4", "value": "239.255.255.250" } ], "shared_count": 12, "status": "shared-observation-not-common-campaign" }, { "analysis_id": "38851ad7-b3a0-423d-ae89-3b7be4e4b908", "session_id": "d001b3fc-7e55-401a-8bb6-381e0c10fbda", "source_sha256": "33e274d7246f4eca8fbe7337c465c7ded077cd650d5d4d42481cad822c962741", "shared_observables": [ { "type": "domain", "value": "api.msn.com" }, { "type": "domain", "value": "client.wns.windows.com" }, { "type": "domain", "value": "ctldl.windowsupdate.com" }, { "type": "domain", "value": "dns.msftncsi.com" }, { "type": "domain", "value": "geo.prod.do.dsp.mp.microsoft.com" }, { "type": "domain", "value": "settings-win.data.microsoft.com" }, { "type": "domain", "value": "v10.events.data.microsoft.com" }, { "type": "domain", "value": "wns.notify.trafficmanager.net" }, { "type": "domain", "value": "www.bing.com" }, { "type": "ipv4", "value": "131.107.255.255" }, { "type": "ipv4", "value": "204.79.197.203" }, { "type": "ipv4", "value": "224.0.0.251" }, { "type": "ipv4", "value": "224.0.0.252" }, { "type": "ipv4", "value": "239.255.255.250" } ], "shared_count": 14, "status": "shared-observation-not-common-campaign" }, { "analysis_id": "bfccc426-aa9b-4007-8558-a66d37ecb90c", "session_id": "bc2c808d-5171-4ed5-9832-5cbf7c3a8866", "source_sha256": "e59db1c07c6fdefafa0abdbca03248c341cdc36c09c34753204d3162802a3586", "shared_observables": [ { "type": "domain", "value": "api.msn.com" }, { "type": "domain", "value": "au.download.windowsupdate.com" }, { "type": "domain", "value": "client.wns.windows.com" }, { "type": "domain", "value": "cp801.prod.do.dsp.mp.microsoft.com" }, { "type": "domain", "value": "ctldl.windowsupdate.com" }, { "type": "domain", "value": "dns.msftncsi.com" }, { "type": "domain", "value": "download.windowsupdate.com" }, { "type": "domain", "value": "fe2cr.update.microsoft.com" }, { "type": "domain", "value": "geo.prod.do.dsp.mp.microsoft.com" }, { "type": "domain", "value": "kv801.prod.do.dsp.mp.microsoft.com" }, { "type": "domain", "value": "pti.store.microsoft.com" }, { "type": "domain", "value": "settings-win.data.microsoft.com" }, { "type": "domain", "value": "v10.events.data.microsoft.com" }, { "type": "domain", "value": "v20.events.data.microsoft.com" }, { "type": "domain", "value": "wns.notify.trafficmanager.net" }, { "type": "domain", "value": "www.bing.com" }, { "type": "ipv4", "value": "131.107.255.255" }, { "type": "ipv4", "value": "204.79.197.203" }, { "type": "ipv4", "value": "224.0.0.251" }, { "type": "ipv4", "value": "224.0.0.252" }, { "type": "ipv4", "value": "239.255.255.250" } ], "shared_count": 21, "status": "shared-observation-not-common-campaign" } ], "interpretation": "No match means unknown in this corpus. Local CTI may postdate the capture. Matches and shared infrastructure require review; no automatic promotion or attribution.", "snapshot_sha256": "4775c16cd4ef1258e6af0730109f96f3ed0ac43a533ee465dd460c85c852613e" }, "techniques": [ { "attack_id": "T1105", "name": "Ingress Tool Transfer", "tactic": "command-and-control", "confidence": 0.8, "evidence": "T1105 Ingress Tool Transfer", "review_status": "suggested", "evidence_start": 5779, "evidence_end": 5806, "evidence_source": "source-text", "llm_verified": true, "review_note": null, "reviewer": null, "reviewed_at": null } ], "apt_matches": [ { "group_attack_id": "G0123", "group_name": "Volatile Cedar", "similarity": 0.2, "shared_count": 1, "shared_techniques": [ "T1105" ] }, { "group_attack_id": "G0044", "group_name": "Winnti Group", "similarity": 0.1667, "shared_count": 1, "shared_techniques": [ "T1105" ] }, { "group_attack_id": "G0130", "group_name": "Ajax Security Team", "similarity": 0.1667, "shared_count": 1, "shared_techniques": [ "T1105" ] }, { "group_attack_id": "G0136", "group_name": "IndigoZebra", "similarity": 0.1429, "shared_count": 1, "shared_techniques": [ "T1105" ] }, { "group_attack_id": "G0133", "group_name": "Nomadic Octopus", "similarity": 0.1429, "shared_count": 1, "shared_techniques": [ "T1105" ] }, { "group_attack_id": "G0107", "group_name": "Whitefly", "similarity": 0.1111, "shared_count": 1, "shared_techniques": [ "T1105" ] }, { "group_attack_id": "G1013", "group_name": "Metador", "similarity": 0.1111, "shared_count": 1, "shared_techniques": [ "T1105" ] }, { "group_attack_id": "G0066", "group_name": "Elderwood", "similarity": 0.1111, "shared_count": 1, "shared_techniques": [ "T1105" ] }, { "group_attack_id": "G0075", "group_name": "Rancor", "similarity": 0.1111, "shared_count": 1, "shared_techniques": [ "T1105" ] }, { "group_attack_id": "G0120", "group_name": "Evilnum", "similarity": 0.0909, "shared_count": 1, "shared_techniques": [ "T1105" ] } ] }